Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 00:53
Static task
static1
Behavioral task
behavioral1
Sample
5c595e6e7a518e6e59781233b9f0a0fa_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5c595e6e7a518e6e59781233b9f0a0fa_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
data1748814.rtf
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
data1748814.rtf
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
data2607577.xls
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
data2607577.xls
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
data865134.pdf
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
data865134.pdf
Resource
win10v2004-20240508-en
General
-
Target
data2607577.xls
-
Size
713KB
-
MD5
be42586f6fad2dea13f45fbc2606b352
-
SHA1
bdb6180240438a7c1d062806b6f8ce8ceb2b1993
-
SHA256
bf7dd08b8f3f5efda5eb2a6a2cb3d8b772fc1f715f61bc5b0bb226f1bece496b
-
SHA512
5c6d5301771bcc52b5c99da8346306a42a4bcc131b0aff21182c1cfe9f1ee4bf523b2a5a2cc5d37c0b97dac778a6623faff26677d50091fa4ec34415a2140fae
-
SSDEEP
12288:/zxV2HMvz3v0Rb0jhOUvrw5TM7ZqZ6c1qkUK2707k8a3++AT3WBAMPnSGPyKnr:V9rUbT/NM7ZqZ61kd4ggSTG6ySGPXr
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2552 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 2552 EXCEL.EXE 2552 EXCEL.EXE 2552 EXCEL.EXE 2552 EXCEL.EXE 2552 EXCEL.EXE 2552 EXCEL.EXE 2552 EXCEL.EXE 2552 EXCEL.EXE 2552 EXCEL.EXE 2552 EXCEL.EXE 2552 EXCEL.EXE 2552 EXCEL.EXE 2552 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\data2607577.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2552