Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
107s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
24/01/2024, 18:13 UTC
General
-
Target
72b5f08d8fdb49354633b86307d1ddb7.xlsx
-
Size
9KB
-
MD5
72b5f08d8fdb49354633b86307d1ddb7
-
SHA1
2ab1f737e978ade0b36ac0f76ea844292062bac4
-
SHA256
61238d164faf3be8e191f2655c6e1e68f594a324494cc394952cf18e0b970a68
-
SHA512
941ffd8ab2380170efa945ef1bf2c7b4b52aa7d9f76bc9e06ee45ab9b02a8c219c1e6932a624eff049340a5a12084eea2e935712f497399d82cb12507d3e4c9f
-
SSDEEP
192:APb+uQtqpbzlVd3Yd9eFEBPJ2Z3Km4oLCcjBHP4:8etqpNOBPJ2coFjJ4
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\72b5f08d8fdb49354633b86307d1ddb7.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
-
DNS97.17.167.52.in-addr.arpaRemote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse -
DNS97.32.109.52.in-addr.arpaRemote address:8.8.8.8:53Request97.32.109.52.in-addr.arpaIN PTRResponse
-
DNS69.31.126.40.in-addr.arpaRemote address:8.8.8.8:53Request69.31.126.40.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS228.249.119.40.in-addr.arpaRemote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
DNS208.143.182.52.in-addr.arpaRemote address:8.8.8.8:53Request208.143.182.52.in-addr.arpaIN PTRResponse
-
DNS217.106.137.52.in-addr.arpaRemote address:8.8.8.8:53Request217.106.137.52.in-addr.arpaIN PTRResponse
-
DNS103.169.127.40.in-addr.arpaRemote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
DNS15.164.165.52.in-addr.arpaRemote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
DNS140.71.91.104.in-addr.arpaRemote address:8.8.8.8:53Request140.71.91.104.in-addr.arpaIN PTRResponse140.71.91.104.in-addr.arpaIN PTRa104-91-71-140deploystaticakamaitechnologiescom
-
DNS177.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request177.178.17.96.in-addr.arpaIN PTRResponse177.178.17.96.in-addr.arpaIN PTRa96-17-178-177deploystaticakamaitechnologiescom
-
DNS14.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
DNS139.191.110.104.in-addr.arpaRemote address:8.8.8.8:53Request139.191.110.104.in-addr.arpaIN PTRResponse139.191.110.104.in-addr.arpaIN PTRa104-110-191-139deploystaticakamaitechnologiescom
No results found
-
8.8.8.8:5397.17.167.52.in-addr.arpadns
DNS Request
97.17.167.52.in-addr.arpa
-
8.8.8.8:5397.32.109.52.in-addr.arpadns
DNS Request
97.32.109.52.in-addr.arpa
-
8.8.8.8:5369.31.126.40.in-addr.arpadns
DNS Request
69.31.126.40.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:53208.143.182.52.in-addr.arpadns
DNS Request
208.143.182.52.in-addr.arpa
-
8.8.8.8:53228.249.119.40.in-addr.arpadns
DNS Request
228.249.119.40.in-addr.arpa
-
8.8.8.8:53217.106.137.52.in-addr.arpadns
DNS Request
217.106.137.52.in-addr.arpa
-
8.8.8.8:53103.169.127.40.in-addr.arpadns
DNS Request
103.169.127.40.in-addr.arpa
-
8.8.8.8:5315.164.165.52.in-addr.arpadns
DNS Request
15.164.165.52.in-addr.arpa
-
8.8.8.8:53140.71.91.104.in-addr.arpadns
DNS Request
140.71.91.104.in-addr.arpa
-
8.8.8.8:53177.178.17.96.in-addr.arpadns
DNS Request
177.178.17.96.in-addr.arpa
-
8.8.8.8:5314.227.111.52.in-addr.arpadns
DNS Request
14.227.111.52.in-addr.arpa
-
8.8.8.8:53139.191.110.104.in-addr.arpadns
DNS Request
139.191.110.104.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB