Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
61s -
max time network
64s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/06/2024, 21:30
Behavioral task
behavioral1
Sample
b4ebe05c82addf248ef9af985ee63335b043145feee4ba048f219592b81b8bbc.xlsm
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
b4ebe05c82addf248ef9af985ee63335b043145feee4ba048f219592b81b8bbc.xlsm
Resource
win10v2004-20240226-en
General
-
Target
b4ebe05c82addf248ef9af985ee63335b043145feee4ba048f219592b81b8bbc.xlsm
-
Size
92KB
-
MD5
f4dab2388c255ede2425fdddf093a325
-
SHA1
f052533f0e24b38a5267bdfa99789e675fc8f153
-
SHA256
b4ebe05c82addf248ef9af985ee63335b043145feee4ba048f219592b81b8bbc
-
SHA512
0487575ac0e162f439bf04f1881c0a2b29b482d965696082201348d84c44ee10ce1f9f8ff16c14da9796a1739b647dacc8b3286184c3656922703a2354c3038d
-
SSDEEP
1536:CguZCa6S5khUIvROPx4znOSjhLzVubGa/M1NIpPkUlB7583fjncFYIIGFa:CgugapkhlvRYxaPjpzVw/Ms8ULavLci
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3868 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3868 EXCEL.EXE 3868 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3868 EXCEL.EXE 3868 EXCEL.EXE 3868 EXCEL.EXE 3868 EXCEL.EXE 3868 EXCEL.EXE 3868 EXCEL.EXE 3868 EXCEL.EXE 3868 EXCEL.EXE 3868 EXCEL.EXE 3868 EXCEL.EXE 3868 EXCEL.EXE 3868 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\b4ebe05c82addf248ef9af985ee63335b043145feee4ba048f219592b81b8bbc.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3868
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4756 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:81⤵PID:3696