Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
1stroop-master.zip
windows11-21h2-x64
1stroop-mas...x.html
windows11-21h2-x64
1stroop-mas...ers.js
windows11-21h2-x64
1stroop-mas...oop.js
windows11-21h2-x64
1stroop-mas...oop.py
windows11-21h2-x64
3stroop-mas...run.py
windows11-21h2-x64
3stroop-mas...s.xlsx
windows11-21h2-x64
1Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
23/04/2024, 15:02
Static task
static1
Behavioral task
behavioral1
Sample
stroop-master.zip
Resource
win11-20240412-en
Behavioral task
behavioral2
Sample
stroop-master/index.html
Resource
win11-20240412-en
Behavioral task
behavioral3
Sample
stroop-master/stroop-legacy-browsers.js
Resource
win11-20240412-en
Behavioral task
behavioral4
Sample
stroop-master/stroop.js
Resource
win11-20240412-en
Behavioral task
behavioral5
Sample
stroop-master/stroop.py
Resource
win11-20240412-en
Behavioral task
behavioral6
Sample
stroop-master/stroop_lastrun.py
Resource
win11-20240412-en
Behavioral task
behavioral7
Sample
stroop-master/trialTypes.xlsx
Resource
win11-20240412-en
General
-
Target
stroop-master/trialTypes.xlsx
-
Size
9KB
-
MD5
38bdb12bb9788b207eb28f03f756899f
-
SHA1
4b1f6bb7b65e0af57bb137150c0e5482fbfe1f5f
-
SHA256
87c22f474af8b9fbe5907b890973945a30e95f9e81a191cd99b721a5ab789a19
-
SHA512
7735a8ef0aa18660c97419c75633460ff46be707f23819c377cc6bb5dd10ff46200b40d5f5a81efa39ded71a87e6914eacd891cac862f60a205b8c97e1ccb13f
-
SSDEEP
96:wkd8A9V+igFjAnYi3U2zDq0Nr6Ol+c0emSuAGQarWvc+iuHMB77HcOkRr86m3IFZ:wc8mV6Anb3U2FJ6+TuAe+nHMuleQLsM
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4160 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4160 EXCEL.EXE 4160 EXCEL.EXE 4160 EXCEL.EXE 4160 EXCEL.EXE 4160 EXCEL.EXE 4160 EXCEL.EXE 4160 EXCEL.EXE 4160 EXCEL.EXE 4160 EXCEL.EXE 4160 EXCEL.EXE 4160 EXCEL.EXE 4160 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\stroop-master\trialTypes.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4160