Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04/01/2024, 15:21
Static task
static1
Behavioral task
behavioral1
Sample
statelocal12 (1).csv
Resource
win7-20231215-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
statelocal12 (1).csv
Resource
win10v2004-20231215-en
4 signatures
150 seconds
General
-
Target
statelocal12 (1).csv
-
Size
2.9MB
-
MD5
7c8c9a4b2b2ae1d29c652375749fb941
-
SHA1
85308271b9de896f14a33a3bf99ed0639f2bc512
-
SHA256
e439cab869f4b37d5f0b646a65f831d49a7b8f9f5d0243196a17934dc00aefe9
-
SHA512
08651a95242afc5671bdf734babab6aafdd3723f9263149f78883e418eaa7416eb64038e92f4dbcecadecd090de38bb432bdeee9abaf6a2d5977e48265846b0f
-
SSDEEP
12288:1/KPcn76Z6+MOR4c9rgLuHhNuvnHlTRPc:hL+MORvgLuHhNuvno
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3964 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 3964 EXCEL.EXE 3964 EXCEL.EXE 3964 EXCEL.EXE 3964 EXCEL.EXE 3964 EXCEL.EXE 3964 EXCEL.EXE 3964 EXCEL.EXE 3964 EXCEL.EXE 3964 EXCEL.EXE 3964 EXCEL.EXE 3964 EXCEL.EXE 3964 EXCEL.EXE 3964 EXCEL.EXE 3964 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\statelocal12 (1).csv"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3964