Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
10/01/2024, 19:25
General
-
Target
384965395d191f40adaac4566b07973c.xlsm
-
Size
304KB
-
MD5
384965395d191f40adaac4566b07973c
-
SHA1
0dffcdff76b8aa1f4499074607898aab086f1f6a
-
SHA256
dc5987a650cd86daff6f68088cac0477cd90ee752f53f29e53b86db76ca4ccd6
-
SHA512
1a56feefa80e1ca45cc5dd1da0dec9f1241c44a001f3c41310edb4287052fe5c6f03fced9fd04370421991662875bad7902d16fdd9fe7f421f70a3ec22c61acb
-
SSDEEP
6144:SqNSLcq+YXEsMcTJuBHrZdProzBpkfeyGsiwLjkwPs2f3e1s+fScMp2:BPYXEsl9WFNQBpfyqIkwU2fmG2
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\384965395d191f40adaac4566b07973c.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\MSHTA.exeMSHTA C:\ProgramData\OxOCOwmY.sct2⤵
- Process spawned unexpected child process
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25KB
MD5aca67dc6f6dc2e2c3da3aa84a6382f41
SHA174696b041d3f47559d6febc653c9d8e1e404de2b
SHA256159514dffb992ca9710a89024b567e6dc53dcac3d71885bbd6032f1f0110200b
SHA51238472ba3c8012b80e535ac01cf6994a4624ad7e9ddcdd082117b335a9e372046932a2aba9f5f815439f4578d487e6b15c37b6e8c54e8f4ed6cad6fb8991458e2
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB