Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

19/03/2024, 18:01

240319-wl6crabc6t 10

19/03/2024, 16:49

240319-vbm8ragh33 1

Analysis

  • max time kernel
    153s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/03/2024, 16:49

General

  • Target

    march19-D3145-2024[1314225].xlsx

  • Size

    56KB

  • MD5

    60d07f9e7daf81bb5a9bb4b3bed41bfd

  • SHA1

    2757c793b96639f3bca33bdd07576d3ad95d063b

  • SHA256

    2766eeb9422ef9dccc1f208e7cbb807c57decae2b08d82995aaf897a67583c94

  • SHA512

    a90b3a0d6af36d1b404d687d71b8d59f234129cfefe972381af5479c4501cf2d513b7131c4107a7a0ab45d4a5722f7e0854e5ff52578b4bcfcdaae8dc5c49a45

  • SSDEEP

    1536:Fkws9oLE3Ow6DyPgMUti9xx7bxNfI5ydaRLgIui3pqDyBROnlTE:FSoEOfEgMNdxI5yYhgu5zBRYg

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\march19-D3145-2024[1314225].xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3088

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3088-0-0x00007FF7E0F70000-0x00007FF7E0F80000-memory.dmp

    Filesize

    64KB

  • memory/3088-1-0x00007FF7E0F70000-0x00007FF7E0F80000-memory.dmp

    Filesize

    64KB

  • memory/3088-3-0x00007FF820EF0000-0x00007FF8210E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3088-2-0x00007FF7E0F70000-0x00007FF7E0F80000-memory.dmp

    Filesize

    64KB

  • memory/3088-4-0x00007FF7E0F70000-0x00007FF7E0F80000-memory.dmp

    Filesize

    64KB

  • memory/3088-5-0x00007FF820EF0000-0x00007FF8210E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3088-7-0x00007FF7E0F70000-0x00007FF7E0F80000-memory.dmp

    Filesize

    64KB

  • memory/3088-6-0x00007FF820EF0000-0x00007FF8210E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3088-8-0x00007FF820EF0000-0x00007FF8210E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3088-9-0x00007FF820EF0000-0x00007FF8210E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3088-10-0x00007FF820EF0000-0x00007FF8210E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3088-11-0x00007FF820EF0000-0x00007FF8210E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3088-12-0x00007FF820EF0000-0x00007FF8210E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3088-13-0x00007FF7DEAC0000-0x00007FF7DEAD0000-memory.dmp

    Filesize

    64KB

  • memory/3088-14-0x00007FF7DEAC0000-0x00007FF7DEAD0000-memory.dmp

    Filesize

    64KB

  • memory/3088-15-0x00007FF820EF0000-0x00007FF8210E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3088-16-0x00007FF820EF0000-0x00007FF8210E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3088-17-0x00007FF820EF0000-0x00007FF8210E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3088-30-0x00007FF820EF0000-0x00007FF8210E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3088-47-0x00007FF7E0F70000-0x00007FF7E0F80000-memory.dmp

    Filesize

    64KB

  • memory/3088-48-0x00007FF7E0F70000-0x00007FF7E0F80000-memory.dmp

    Filesize

    64KB

  • memory/3088-49-0x00007FF7E0F70000-0x00007FF7E0F80000-memory.dmp

    Filesize

    64KB

  • memory/3088-51-0x00007FF820EF0000-0x00007FF8210E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3088-50-0x00007FF7E0F70000-0x00007FF7E0F80000-memory.dmp

    Filesize

    64KB

  • memory/3088-52-0x00007FF820EF0000-0x00007FF8210E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3088-53-0x00007FF820EF0000-0x00007FF8210E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3088-54-0x00007FF820EF0000-0x00007FF8210E5000-memory.dmp

    Filesize

    2.0MB