Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
46s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 15:32
Static task
static1
Behavioral task
behavioral1
Sample
New Text Document.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
Trojan;MSIL.FormBook.AFO!MTB.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Пароли Chrome.csv
Resource
win10v2004-20240426-en
General
-
Target
Пароли Chrome.csv
-
Size
1KB
-
MD5
64f50afb35dd16ee46f187015cee84ce
-
SHA1
24f2fae82f8df4feda6f509641eee26ad1629fc6
-
SHA256
c2d389870de77426a31a8c478e0fddcbbea7a3733b453806317914e6f946ea91
-
SHA512
cb1f85b38cbed9ce1824b0bd6fb562619bf8a2498692e1b9d87a6f179c866f4c85ebf66dd9b29481fd2beb66a8598b8cc700ff5abbf66048cea05f45ced4dfa5
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5064 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 5064 EXCEL.EXE 5064 EXCEL.EXE 5064 EXCEL.EXE 5064 EXCEL.EXE 5064 EXCEL.EXE 5064 EXCEL.EXE 5064 EXCEL.EXE 5064 EXCEL.EXE 5064 EXCEL.EXE 5064 EXCEL.EXE 5064 EXCEL.EXE 5064 EXCEL.EXE 5064 EXCEL.EXE 5064 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Пароли Chrome.csv"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5064