Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
594s -
max time network
571s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
17/04/2024, 09:14
General
-
Target
x (2).xls
-
Size
323KB
-
MD5
2be86255d5c58c9d1452c9cf39a6a66d
-
SHA1
058d72f3e45476408ffaca4ce9f7b39a05ed3405
-
SHA256
e6be399576b6bc96254e00a8743115604bf1dff765789d3483d3650575de6129
-
SHA512
7d00f8f3f4d7d287b3731cf7c6631824255066b1aae4adaa641837e258f34be7aa50ea3b42b2b9d4822fb10a9ef3ee0507851c6dedb36ed2fc98cd975c5e9d41
-
SSDEEP
6144:cuunJ1qZ+RwPONXoRjDhIcp0fDlavx+fgLt0d6oivSbVjHyNI89GQ8PYZMm/wOGP:cvJ1J3bVjyNI89f8P4wTUoIEn
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\x (2).xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
160KB
MD52ea2f2627c5d7466bcc288308834548d
SHA1f1a0d35307b7dd21345dce5bdeb6fa524ba19c23
SHA2562f8ba23b2d244f9aa2c69109735d6765bccef22f868c0be91da7376d0be62115
SHA512ee07a3a97e266bd7b68f297c4467a0f554cf000accfbfe417344470ffb60732979d2427ad1c2b1f552244c7b27b3aca2c3a46c91c262914d9ef39c9fd22315bf
-
Filesize
21KB
MD5b836cf062cdb9ceeb8cf5dbb8d901e76
SHA17d6e742741fca658069a0656720181dc3ff813ae
SHA256bee92eece58b375e53129e0ad6669ee84a68acd9b44b6acc4f7a6cd9b684c3bb
SHA5124ffc29f9cbee6ed03fcde974df3ad32532d8354a8c1237280fa2041575650cc8dee0add1e20d6a813ebe65a7686e58822df29638d3414124cd92e8ff55c670dc
-
Filesize
2KB
MD5377a433bf7c5de5000e1ace0367302e7
SHA1bd528a6ebdc1590349ab02660eef3ebf6dc0878f
SHA256e2377b21e8311e768a29befeb8f85f6f9651bb645c3b1d6e629c094977c0729b
SHA5125527ed7ddeb143c1010555852717e294fb96a60efb608d68c1b7e1c3526712f18f40871fc8f98b895135c9255e82089969cd37e8e55e09417c5865f698eaace4
-
Filesize
2KB
MD5d41dd7ee33d546bacd833a51ba05bd3b
SHA15b78d18725894fcd998cf13d54725f8389e2018a
SHA25665cf01024c941d6fe84ca248ae0c302b53fd50d35a22868c1c2eb7d81215b376
SHA5120fd2d34a445da33e7e7fe73f87ed67a96d3dfba91a5bd7225492b08281d3fb243d69caa2ba4d98ae06dcae8ba49f8e5dbb7dd19ba5da5093baf1e2570ec2589c
-
Filesize
78KB
MD5ed096dddbfcf9b78a74e3f65f30c0352
SHA14e736672d662dce4d9f5ee13324c41caa13b6743
SHA256f73be5ad393981cda5dcc30559f1a3c034540ffe13d03d6016d1bf3ccf03feb5
SHA51222c6828e0ce9f193b680e577da2b2a02219aef64ee9e86c39b25a29b61b0079fd68d31ecf7282d29f7bc909804e761dbbe9b53f9c903918c4e3a37ab756b494f
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
229B
MD5658ff462c010c0fa1eb0e3de8fc9bc3b
SHA124ad265f534c486f21b3de44a7b9f9a7ce2d01a7
SHA2563aa0fbe288067fe4700a1eb15c5932b2bbf5f7b638ef2f404492df2d4bbf4fb6
SHA512504c04bc5a1f754ca65695442ed741f0d76e0557b765e711bb7d676651f0ea9719b82133de5c13d03c9c66cbba8bc2db1ab7494c7479b3eeea5b15a514163dff
-
Filesize
5KB
MD5cb45d942d0ea7b1718a85e2262e3459d
SHA16982feebecc1c6df004ba89456e7b62bb3fb2d00
SHA2562cf976195e1275fafa3b834ce095480f7eaf91253b4c8b4b4c0099929d09ca1c
SHA5121ad0cdb9d6a386023e09bf1066af54b9f1b8b0185f640e1c23bfbd4ebda0e8bc5a702c66811370a1be280eb840bcfea3de73e3c6e9bb39307db8b4e73acaf65b
-
Filesize
3KB
MD53b172aae9a353b7c46a487064efc8171
SHA1a9ed7b98cc3438118564b5e36499dbbf1cb3c310
SHA256b61e151589caa36bdee443e857c5a9ad6e6b71e4065b017972d909510fc16413
SHA512c1f77d25f93d47319a1f053a8d520bd4c02474893cfcf209e90de7dd6df40afb28469381a5d07e8793ccce352274110ac272680e7c0248f287e763439cbd43ab
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB