Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 01:34

General

  • Target

    6075724cb5729f6695b86d0a2670e8a2d98650a71fe26d1a421115a0d3d8cc5c.xlam

  • Size

    24KB

  • MD5

    111a75360a5cd60838a48680389a405c

  • SHA1

    f22b05a1e72378c8d31e7fd381b085514e8f9047

  • SHA256

    6075724cb5729f6695b86d0a2670e8a2d98650a71fe26d1a421115a0d3d8cc5c

  • SHA512

    52be28f95d10d155ac9fd25e2ad454b519ec8f4a4c5a6a9363941cc85a48ddd903ff1004c894cac23b17f6adc96aca080393b1ab5bf63db95827f30076333103

  • SSDEEP

    384:AKcqJPHXoRjsHNX6T13fzmH6k+olI8ZmSpEDF4fOUD7SRtWo/waYYz:AKctRGw3fhKIQp44mP7W3Jq

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\6075724cb5729f6695b86d0a2670e8a2d98650a71fe26d1a421115a0d3d8cc5c.xlam"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1144

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1144-5-0x00007FF81BF90000-0x00007FF81BFA0000-memory.dmp

    Filesize

    64KB

  • memory/1144-6-0x00007FF85BF10000-0x00007FF85C105000-memory.dmp

    Filesize

    2.0MB

  • memory/1144-4-0x00007FF81BF90000-0x00007FF81BFA0000-memory.dmp

    Filesize

    64KB

  • memory/1144-11-0x00007FF85BF10000-0x00007FF85C105000-memory.dmp

    Filesize

    2.0MB

  • memory/1144-17-0x00007FF85BF10000-0x00007FF85C105000-memory.dmp

    Filesize

    2.0MB

  • memory/1144-21-0x00007FF85BF10000-0x00007FF85C105000-memory.dmp

    Filesize

    2.0MB

  • memory/1144-23-0x00007FF85BF10000-0x00007FF85C105000-memory.dmp

    Filesize

    2.0MB

  • memory/1144-22-0x00007FF819B70000-0x00007FF819B80000-memory.dmp

    Filesize

    64KB

  • memory/1144-20-0x00007FF85BF10000-0x00007FF85C105000-memory.dmp

    Filesize

    2.0MB

  • memory/1144-19-0x00007FF85BF10000-0x00007FF85C105000-memory.dmp

    Filesize

    2.0MB

  • memory/1144-18-0x00007FF85BF10000-0x00007FF85C105000-memory.dmp

    Filesize

    2.0MB

  • memory/1144-16-0x00007FF85BF10000-0x00007FF85C105000-memory.dmp

    Filesize

    2.0MB

  • memory/1144-15-0x00007FF85BF10000-0x00007FF85C105000-memory.dmp

    Filesize

    2.0MB

  • memory/1144-14-0x00007FF85BF10000-0x00007FF85C105000-memory.dmp

    Filesize

    2.0MB

  • memory/1144-13-0x00007FF819B70000-0x00007FF819B80000-memory.dmp

    Filesize

    64KB

  • memory/1144-12-0x00007FF85BF10000-0x00007FF85C105000-memory.dmp

    Filesize

    2.0MB

  • memory/1144-10-0x00007FF85BF10000-0x00007FF85C105000-memory.dmp

    Filesize

    2.0MB

  • memory/1144-9-0x00007FF85BF10000-0x00007FF85C105000-memory.dmp

    Filesize

    2.0MB

  • memory/1144-8-0x00007FF85BF10000-0x00007FF85C105000-memory.dmp

    Filesize

    2.0MB

  • memory/1144-7-0x00007FF85BF10000-0x00007FF85C105000-memory.dmp

    Filesize

    2.0MB

  • memory/1144-3-0x00007FF85BFAD000-0x00007FF85BFAE000-memory.dmp

    Filesize

    4KB

  • memory/1144-2-0x00007FF81BF90000-0x00007FF81BFA0000-memory.dmp

    Filesize

    64KB

  • memory/1144-1-0x00007FF81BF90000-0x00007FF81BFA0000-memory.dmp

    Filesize

    64KB

  • memory/1144-0-0x00007FF81BF90000-0x00007FF81BFA0000-memory.dmp

    Filesize

    64KB

  • memory/1144-40-0x00007FF85BF10000-0x00007FF85C105000-memory.dmp

    Filesize

    2.0MB

  • memory/1144-58-0x00007FF81BF90000-0x00007FF81BFA0000-memory.dmp

    Filesize

    64KB

  • memory/1144-60-0x00007FF85BF10000-0x00007FF85C105000-memory.dmp

    Filesize

    2.0MB

  • memory/1144-59-0x00007FF81BF90000-0x00007FF81BFA0000-memory.dmp

    Filesize

    64KB

  • memory/1144-57-0x00007FF81BF90000-0x00007FF81BFA0000-memory.dmp

    Filesize

    64KB

  • memory/1144-56-0x00007FF81BF90000-0x00007FF81BFA0000-memory.dmp

    Filesize

    64KB