Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
16/04/2024, 10:08 UTC
General
-
Target
3c43c273329967a735e5a2775edfa84f195e15492262b5a3fde0bad3a2e3eeab.xls
-
Size
3.9MB
-
MD5
0bccf4196b3aaaf8a0b16f64f52bf58f
-
SHA1
11b77825fc60ce2ca222e490e1472ffc02f34f85
-
SHA256
3c43c273329967a735e5a2775edfa84f195e15492262b5a3fde0bad3a2e3eeab
-
SHA512
a9e6c0388f6b136d1b0a1a09bd524fe2cd25d74432e6878d4f9db1979a334287dd0055fa5b0959cadc9239ef67decefddbd44b099aa4088049c38f01d7763e45
-
SSDEEP
12288:+OuUfY7WD8FmMgQMgwH4NysUrZhCNPnMquXoTocXsKbLC+vAptFm07gqB8FEbvpJ:X8F2EeoMqucXNbcHFRgqhjvv3jFdRj
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\3c43c273329967a735e5a2775edfa84f195e15492262b5a3fde0bad3a2e3eeab.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
-
DNS46.28.109.52.in-addr.arpaRemote address:8.8.8.8:53Request46.28.109.52.in-addr.arpaIN PTRResponse -
DNS72.32.126.40.in-addr.arpaRemote address:8.8.8.8:53Request72.32.126.40.in-addr.arpaIN PTRResponse
-
DNS91.90.14.23.in-addr.arpaRemote address:8.8.8.8:53Request91.90.14.23.in-addr.arpaIN PTRResponse91.90.14.23.in-addr.arpaIN PTRa23-14-90-91deploystaticakamaitechnologiescom
-
DNS26.35.223.20.in-addr.arpaRemote address:8.8.8.8:53Request26.35.223.20.in-addr.arpaIN PTRResponse
-
GEThttps://www.bing.com/th?id=OADD2.10239368050262_1H4FJCNTCWVEV5UPC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90Remote address:23.62.61.96:443RequestGET /th?id=OADD2.10239368050262_1H4FJCNTCWVEV5UPC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
host: www.bing.com
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-type: image/png
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
content-length: 1678
date: Tue, 16 Apr 2024 10:08:58 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.5c3d3e17.1713262138.1326b0df
-
DNS96.61.62.23.in-addr.arpaRemote address:8.8.8.8:53Request96.61.62.23.in-addr.arpaIN PTRResponse96.61.62.23.in-addr.arpaIN PTRa23-62-61-96deploystaticakamaitechnologiescom
-
DNS26.73.42.20.in-addr.arpaRemote address:8.8.8.8:53Request26.73.42.20.in-addr.arpaIN PTRResponse
-
DNS86.23.85.13.in-addr.arpaRemote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
DNS198.187.3.20.in-addr.arpaRemote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
DNS240.221.184.93.in-addr.arpaRemote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
DNS26.173.189.20.in-addr.arpaRemote address:8.8.8.8:53Request26.173.189.20.in-addr.arpaIN PTRResponse
-
23.62.61.96:443https://www.bing.com/th?id=OADD2.10239368050262_1H4FJCNTCWVEV5UPC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90tls, http2
HTTP Request
GET https://www.bing.com/th?id=OADD2.10239368050262_1H4FJCNTCWVEV5UPC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90HTTP Response
200
-
8.8.8.8:5346.28.109.52.in-addr.arpadns
DNS Request
46.28.109.52.in-addr.arpa
-
8.8.8.8:5372.32.126.40.in-addr.arpadns
DNS Request
72.32.126.40.in-addr.arpa
-
8.8.8.8:5391.90.14.23.in-addr.arpadns
DNS Request
91.90.14.23.in-addr.arpa
-
8.8.8.8:5326.35.223.20.in-addr.arpadns
DNS Request
26.35.223.20.in-addr.arpa
-
8.8.8.8:5396.61.62.23.in-addr.arpadns
DNS Request
96.61.62.23.in-addr.arpa
-
8.8.8.8:5326.73.42.20.in-addr.arpadns
DNS Request
26.73.42.20.in-addr.arpa
-
8.8.8.8:5386.23.85.13.in-addr.arpadns
DNS Request
86.23.85.13.in-addr.arpa
-
8.8.8.8:53198.187.3.20.in-addr.arpadns
DNS Request
198.187.3.20.in-addr.arpa
-
8.8.8.8:53240.221.184.93.in-addr.arpadns
DNS Request
240.221.184.93.in-addr.arpa
-
8.8.8.8:5326.173.189.20.in-addr.arpadns
DNS Request
26.173.189.20.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB