Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
29/05/2024, 00:34
Behavioral task
behavioral1
Sample
{6B36E1AE-4918-4CFE-94F4-96EBF51C547F}.xlsm
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
{6B36E1AE-4918-4CFE-94F4-96EBF51C547F}.xlsm
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
{6B36E1AE-4918-4CFE-94F4-96EBF51C547F}.xlsm
Resource
win11-20240426-en
General
-
Target
{6B36E1AE-4918-4CFE-94F4-96EBF51C547F}.xlsm
-
Size
12.3MB
-
MD5
47aa6b9789f494aa367ce66b18ee7b63
-
SHA1
1263c11ce78d729b1615cb90bb9c064b21f88faf
-
SHA256
ffbaa037416730534e921edeb44c7417b0a1526c152c4195947ec67df7529976
-
SHA512
bbb2b9f943647ba030169dc7fb5b59e0e70c3c83d6280cb0d6a64705cb3e9da4a0d33945b8338df478c724115cdf1e9531ae2b31d961dc86715b601bba944b24
-
SSDEEP
196608:KJF6kRzt3hh2s53T0K/Cv6c6abFbNYu59iv0h7BYh+aj3aqJHyw/:Kl3yK/dabFbLU0M0araqJL
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3380 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3380 EXCEL.EXE 3380 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3380 EXCEL.EXE 3380 EXCEL.EXE 3380 EXCEL.EXE 3380 EXCEL.EXE 3380 EXCEL.EXE 3380 EXCEL.EXE 3380 EXCEL.EXE 3380 EXCEL.EXE 3380 EXCEL.EXE 3380 EXCEL.EXE 3380 EXCEL.EXE 3380 EXCEL.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3380 wrote to memory of 928 3380 EXCEL.EXE 76 PID 3380 wrote to memory of 928 3380 EXCEL.EXE 76
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\{6B36E1AE-4918-4CFE-94F4-96EBF51C547F}.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:928
-