Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
101s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
08/03/2024, 16:40
General
-
Target
bbbf5097ad620e1c5fc086dea200700c.xlsm
-
Size
216KB
-
MD5
bbbf5097ad620e1c5fc086dea200700c
-
SHA1
64b30ec37556e53eb7bcd49684ad3946575ec28d
-
SHA256
24da86aa9324d1111d69a2737083c9489f682c991fe9694a950a9dddf72cf796
-
SHA512
191de26ee4f61b07f6e321fbb8bd6d3cd906fbaf560a24f73fd5db5da99272ee052602f9e885000bd0939634e33aad6a6a2d41ae63cea5e551275ce45dcf952e
-
SSDEEP
6144:SJs7MOD8srVURv59QexqaFLLaL8WL9VwXrnDdNH1:ws7MOHyRBmezFHaLHVInDdh1
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 3 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\bbbf5097ad620e1c5fc086dea200700c.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\MSHTA.exeMSHTA C:\ProgramData\YeoeNxDw.sct2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD58101e49aeb02325b61f66d6de31afcc9
SHA1e921753c552b40d3d693d924f901905e6b64bdf4
SHA256e480ca5ff96c21b2bbc0bfe9e161129976ff02bc096a2120a5b71314c4bfab20
SHA512056401131de71bb860ceb6789721ef467e0d097c2a4bdbc49837efd2713d5a6c0fa422243f3bdc63b6a5b23074e2f51c3d492e9cc43e83eefb7b4aec0a9e934b
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB