Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
172s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 07:08
Behavioral task
behavioral1
Sample
2cca7fb0f10195dc9a8b1f567f3712f7.xls
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2cca7fb0f10195dc9a8b1f567f3712f7.xls
Resource
win10v2004-20231215-en
General
-
Target
2cca7fb0f10195dc9a8b1f567f3712f7.xls
-
Size
35KB
-
MD5
2cca7fb0f10195dc9a8b1f567f3712f7
-
SHA1
64d6a600c44317d81768976abc06ff323e50dafc
-
SHA256
d6b02eb77ecbb4e9fb00c48dabaac1e3579a7888d3140835657fa7c4c44ec6c8
-
SHA512
a3240dfc7b625ccfd645878966560d61f89ebb91273ea75187687a286ed36ad8b688f9a0943e94b06b5dd61a42dfc66dc3d66f099ab47866174bf74fdd4a69c3
-
SSDEEP
768:nPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJ7iog3XW7tWiEUAQW:Pok3hbdlylKsgqopeJBWhZFGkE+cL2Np
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 3708 4752 explorer.exe 89 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4752 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4752 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4752 EXCEL.EXE 4752 EXCEL.EXE 4752 EXCEL.EXE 4752 EXCEL.EXE 4752 EXCEL.EXE 4752 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4752 wrote to memory of 3708 4752 EXCEL.EXE 92 PID 4752 wrote to memory of 3708 4752 EXCEL.EXE 92 PID 2308 wrote to memory of 4432 2308 explorer.exe 94 PID 2308 wrote to memory of 4432 2308 explorer.exe 94
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2cca7fb0f10195dc9a8b1f567f3712f7.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\explorer.exeexplorer.exe C:\Users\Public\Documents\NfC2eG0O.vbs2⤵
- Process spawned unexpected child process
PID:3708
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\NfC2eG0O.vbs"2⤵PID:4432
-