Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
46s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/06/2024, 21:40
Behavioral task
behavioral1
Sample
7ef3237bca29385583727ec01f76f35433f9bd66f3b0e098b87373a5b865d6f8.xlsm
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
7ef3237bca29385583727ec01f76f35433f9bd66f3b0e098b87373a5b865d6f8.xlsm
Resource
win10v2004-20240508-en
General
-
Target
7ef3237bca29385583727ec01f76f35433f9bd66f3b0e098b87373a5b865d6f8.xlsm
-
Size
92KB
-
MD5
4e52e26d76284d905e9918d6043fc57b
-
SHA1
472b20bd5fe02c2864db44f3889715e7c391af05
-
SHA256
7ef3237bca29385583727ec01f76f35433f9bd66f3b0e098b87373a5b865d6f8
-
SHA512
edf46080d98b668f3fe010e15207e6c7fc32c39cd17ea11a7ccbde215b036c00996634409c30efe812932e3fd3bce8f799ccc53dc625aecfc374a17bad624319
-
SSDEEP
1536:CguZCa6S5khUIkNrM1ZQ08B4znOSjhLM+vGa/M1NIpPkUlB7583fjncFYIIj2Flg:CgugapkhlkNg/IBaPjpM+d/Ms8ULavLR
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3888 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3888 EXCEL.EXE 3888 EXCEL.EXE 3888 EXCEL.EXE 3888 EXCEL.EXE 3888 EXCEL.EXE 3888 EXCEL.EXE 3888 EXCEL.EXE 3888 EXCEL.EXE 3888 EXCEL.EXE 3888 EXCEL.EXE 3888 EXCEL.EXE 3888 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\7ef3237bca29385583727ec01f76f35433f9bd66f3b0e098b87373a5b865d6f8.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3888