Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
47s -
max time network
14s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
-
submitted
22/05/2024, 14:52 UTC
General
-
Target
Штатка_ТЦК_Деснянского_района_в_г_Киев.xlsx
-
Size
442KB
-
MD5
b5079dd93a5c3ed0902d825c2b13d3fb
-
SHA1
0c5ba1a38c4c912c985e92f15e40abef99fdd808
-
SHA256
436f30c03b857edf3ab9cd7e833327844bb6e9d27cc0fe34590c5d11bee944dd
-
SHA512
d668d5dee47d41cbae3bc014d68506bb245017403914f4adea21d3297ec08689b0ac90c574b1125383f6329100948471db4ec83b0cef76326dbcb4dfe45c6ea9
-
SSDEEP
6144:5lREBTRORW0qwh+4TdB3jZJWamgcdhyuEpNnYbXXDIC1K8fPl/VvOz:cdORjqws4T36XdoNnY7TIve5Fu
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Штатка_ТЦК_Деснянского_района_в_г_Киев.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
-
DNSroaming.officeapps.live.comRemote address:8.8.8.8:53Requestroaming.officeapps.live.comIN AResponseroaming.officeapps.live.comIN CNAMEprod.roaming1.live.com.akadns.netprod.roaming1.live.com.akadns.netIN CNAMEeur.roaming1.live.com.akadns.neteur.roaming1.live.com.akadns.netIN CNAMEfrc-azsc-000.roaming.officeapps.live.comfrc-azsc-000.roaming.officeapps.live.comIN CNAMEosiprod-frc-buff-azsc-000.francecentral.cloudapp.azure.comosiprod-frc-buff-azsc-000.francecentral.cloudapp.azure.comIN A52.109.68.129 -
DNS46.28.109.52.in-addr.arpaRemote address:8.8.8.8:53Request46.28.109.52.in-addr.arpaIN PTRResponse
-
DNS71.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request71.159.190.20.in-addr.arpaIN PTRResponse
-
DNS25.24.18.2.in-addr.arpaRemote address:8.8.8.8:53Request25.24.18.2.in-addr.arpaIN PTRResponse25.24.18.2.in-addr.arpaIN PTRa2-18-24-25deploystaticakamaitechnologiescom
-
DNS35.197.79.40.in-addr.arpaRemote address:8.8.8.8:53Request35.197.79.40.in-addr.arpaIN PTRResponse
-
POSThttps://roaming.officeapps.live.com/rs/RoamingSoapService.svcRemote address:52.109.68.129:443RequestPOST /rs/RoamingSoapService.svc HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Content-Type: text/xml; charset=utf-8
User-Agent: MS-WebServices/1.0
SOAPAction: "http://tempuri.org/IRoamingSettingsService/GetConfig"
Content-Length: 511
Host: roaming.officeapps.live.com
ResponseHTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/xml; charset=utf-8
Server: Microsoft-IIS/10.0
X-OfficeFE: RoamingFE_IN_159
X-OfficeVersion: 16.0.17711.30575
X-OfficeCluster: frc-000.roaming.officeapps.live.com
X-CorrelationId: f064f39b-9e67-4346-bee9-56f24b124096
X-Powered-By: ASP.NET
Date: Wed, 22 May 2024 14:52:34 GMT
Content-Length: 654
-
52.109.68.129:443https://roaming.officeapps.live.com/rs/RoamingSoapService.svctls, http
HTTP Request
POST https://roaming.officeapps.live.com/rs/RoamingSoapService.svcHTTP Response
200
-
8.8.8.8:53roaming.officeapps.live.comdns
DNS Request
roaming.officeapps.live.com
DNS Response
52.109.68.129
DNS Request
46.28.109.52.in-addr.arpa
DNS Request
71.159.190.20.in-addr.arpa
DNS Request
25.24.18.2.in-addr.arpa
DNS Request
35.197.79.40.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB