Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
49s -
max time network
64s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/06/2024, 21:37
Behavioral task
behavioral1
Sample
49016b4222ac3dd85890aa24c4b722f639dd14f25d93e012066c2f88caf3942f.xlsm
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
49016b4222ac3dd85890aa24c4b722f639dd14f25d93e012066c2f88caf3942f.xlsm
Resource
win10v2004-20240226-en
General
-
Target
49016b4222ac3dd85890aa24c4b722f639dd14f25d93e012066c2f88caf3942f.xlsm
-
Size
92KB
-
MD5
c6652b8862d24e1a02efe34412e562e5
-
SHA1
83886b92977bdd0ad3fa4b415912888e919f257c
-
SHA256
49016b4222ac3dd85890aa24c4b722f639dd14f25d93e012066c2f88caf3942f
-
SHA512
59eddb8078df0835895f9806416e3e1791702cf0d081095523b28e20ea1613736203f240634738861a0d1a63a5035daa5e75e75cf03c06ac3b5049fb103122fb
-
SSDEEP
1536:CguZCa6S5khUIbD4znOSjhLqxMUH9Ga/M1NIpPkUlB7583fjncFYIIYRFu:CgugapkhlvaPjpqxvD/Ms8ULavLcDO
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4832 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4832 EXCEL.EXE 4832 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4832 EXCEL.EXE 4832 EXCEL.EXE 4832 EXCEL.EXE 4832 EXCEL.EXE 4832 EXCEL.EXE 4832 EXCEL.EXE 4832 EXCEL.EXE 4832 EXCEL.EXE 4832 EXCEL.EXE 4832 EXCEL.EXE 4832 EXCEL.EXE 4832 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\49016b4222ac3dd85890aa24c4b722f639dd14f25d93e012066c2f88caf3942f.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4832
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3756 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵PID:1408