Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

Order2354.xls

windows7-x64

8

Order2354.xls

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Order2354.xls

  • Size

    654KB

  • Sample

    240514-gqctnsda9z

  • MD5

    0ea2f1e95f1c8a1917bb34a722cf78e8

  • SHA1

    4721806e7503fcb6a630697bc348e53074a22fa2

  • SHA256

    114ea93681433aaf40289d58407cb4b570748645aca682ddae3052b6f428b3f7

  • SHA512

    9a5b836d188bf1bc8f210560492475017f2f23577a708acd82af3f0ada2446690653e4e08c1f0908306aaabd5a53f741f8987ed76bcbc00f4786784c6f5d9de8

  • SSDEEP

    12288:/kTCQ5HK3hrUP/qPQZR8MxAm/S/xQE1A73DbFWgc4zkiVhPkLyH8gq1N:OCQ5HKRrUP/mMxCaE1GFWgJkChkqPK

Score
8/10
execution

Malware Config

Targets

    • Target

      Order2354.xls

    • Size

      654KB

    • MD5

      0ea2f1e95f1c8a1917bb34a722cf78e8

    • SHA1

      4721806e7503fcb6a630697bc348e53074a22fa2

    • SHA256

      114ea93681433aaf40289d58407cb4b570748645aca682ddae3052b6f428b3f7

    • SHA512

      9a5b836d188bf1bc8f210560492475017f2f23577a708acd82af3f0ada2446690653e4e08c1f0908306aaabd5a53f741f8987ed76bcbc00f4786784c6f5d9de8

    • SSDEEP

      12288:/kTCQ5HK3hrUP/qPQZR8MxAm/S/xQE1A73DbFWgc4zkiVhPkLyH8gq1N:OCQ5HKRrUP/mMxCaE1GFWgJkChkqPK

    Score
    8/10
    execution

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Abuses OpenXML format to download file from external location

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks