Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
101s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12/02/2024, 04:18
General
-
Target
963a97b6efe44b61e3241b3747028987.xlsm
-
Size
238KB
-
MD5
963a97b6efe44b61e3241b3747028987
-
SHA1
65cc1ec0d4434bbe52d2c8e73943c3f845504f12
-
SHA256
3e5c3ca2dba4a97b5ce64954a2b4a01b29a140dacfc0401dcc75471545c1f49a
-
SHA512
649b9ec6872bfab560e1428a97bacd818d9bcc5577d5f73e80dcf83a8145abd8eb11bfcc3d186cc43da4d63df9fdd5ff528d5b33b9287a71b6d1976fff945a3f
-
SSDEEP
6144:StNSLcq+YXEstmCKKIfVeSrPwqWaswkoWMM:CPYXEszKTwaEoWMM
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 5 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\963a97b6efe44b61e3241b3747028987.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\MSHTA.exeMSHTA C:\ProgramData\kzbUSLmXY.sct2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
26KB
MD53cfaacfbd117f564097a6a915b452bff
SHA19800ad914f3f1b728d171e7e8c1a4966377e20f4
SHA25694d939eaa531caa4c4748573eb52c7f6fb752c918b4f885ef14bc4a23ecd87ec
SHA5129fde4357f647c59a42e3383c8aabb56eb0feb3b7a6b8bf2d3c8d3bd60d8d675b4d20306ad9f23802a032be5decd9c5166894946ba7a2045769c484df3696dfd6
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB