Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
21/02/2024, 07:01
General
-
Target
Purchase order.xls
-
Size
573KB
-
MD5
2057adda9d066eaf2b27b19c4643fea1
-
SHA1
41599cc28565373fe49464a4413ec3eaf03356e4
-
SHA256
1919a1b877651e00acebeae51a55aaf26ba8828ee78bffbe420339cf204545cc
-
SHA512
e096995223135a5c331f38e55bbd53a03feebe16705383d4d2b7a1eaf015523235e779d87250def268b9e55f37fb50f09d50ebae2dc97a5facb9b5f26a4fa0b5
-
SSDEEP
12288:VTk6SEXMcbNedomzE23bVGvMIgJWG+/ryf9wbw8oRU:/SSMMednE23bV/cE8z
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Purchase order.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
159KB
MD587c75868b142ca8e3cd269be8a680d14
SHA17cf08ab542b5735bce769e8a83eccf74918726c1
SHA25633d0dc298ef46312f0e725eecddd979163a6374401d2308cb83f73e46bef15e9
SHA512b88a9090c60cfe974603a8ca87e715220997c60de1de6770e3b1fba181c0052a64e259fe15e4b372f6310096131cdca6bdc94cb91ff57f3a054e8706773e1c19
-
Filesize
2KB
MD57712e2fc3df932008ed5b42e2584de1a
SHA1c9fbc72aa2d2947f437dcf5d1793ffafaa288608
SHA256bf9028708d2238a44f1fa031b9a43792dd31eca0b9fa71fb8dbdf4535d60e172
SHA5124b7f9217bc29b86953dd0e0b02f78664e295ff451d59cd7724c140e1e40f26bf7aca4e0c8b153e9672757d57d75f6eba23509e9822d806281d02d2f005204de7
-
Filesize
2KB
MD587b4b97722018a37fbf4fa39b5dbfb6a
SHA1edb2ba9e3e4419b33eb63b32243bfbc431527a61
SHA25617ebbcff4e95202974cc7829c2764e7fa551fc3322232430ddc19025f4f38091
SHA512bf6db1cc682e923e17cdbf1899edb5b339d9fffc27330147fcdf7c02eb532143f48eb599ea32888bf1c031a658a9c211292e4a96c67803ec0cac5cdaac2e7fb8
-
Filesize
66KB
MD51e9c3b0f39c13c25423e676e4da9b940
SHA1563cbb6126b3add2f872d250c40a68e9372151bf
SHA256464c336ea903590b0ccc26e8eaa734e8b819b31f860d0d20a67d3239b2cc7f92
SHA512735ac74fa7d1219abfcb3b2fc09c0a1d1de74c83ba185503059b88a22883addabfafb823aade144bec051eb22888339214e37d87b3c855db6213478bb2294c94
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB