Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
47s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/06/2024, 22:13
Behavioral task
behavioral1
Sample
446214a9045ff3e4e3f0825537247b6384b8f5155fc4d14c381487b04a147f26.xlsm
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
446214a9045ff3e4e3f0825537247b6384b8f5155fc4d14c381487b04a147f26.xlsm
Resource
win10v2004-20240508-en
General
-
Target
446214a9045ff3e4e3f0825537247b6384b8f5155fc4d14c381487b04a147f26.xlsm
-
Size
92KB
-
MD5
f686af2141c96213082eb725a2000a93
-
SHA1
b42b8dba1125c10f16ab8d24eebb0c437a292420
-
SHA256
446214a9045ff3e4e3f0825537247b6384b8f5155fc4d14c381487b04a147f26
-
SHA512
16c5d11311af231f6da1d24c6d1040d28def5614265cf49f1da57412e5e37ab08fe5557e079d59dd229c8a6bc79a8cac6680f74d2bc2614f06fee4d19e610487
-
SSDEEP
1536:CguZCa6S5khUItZ0WJqe0W4znOSjhLM+vGa/M1NIpPkUlB7583fjncFYIIvSFc:CgugapkhlPXEeXaPjpM+d/Ms8ULavLck
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2652 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2652 EXCEL.EXE 2652 EXCEL.EXE 2652 EXCEL.EXE 2652 EXCEL.EXE 2652 EXCEL.EXE 2652 EXCEL.EXE 2652 EXCEL.EXE 2652 EXCEL.EXE 2652 EXCEL.EXE 2652 EXCEL.EXE 2652 EXCEL.EXE 2652 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\446214a9045ff3e4e3f0825537247b6384b8f5155fc4d14c381487b04a147f26.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2652