Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    46s
  • max time network
    55s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/06/2024, 21:55

General

  • Target

    1380f16dbe7bfd83d43dfa587e13464b49d09f059d70518e2f25346c506ea46a.xlsm

  • Size

    25KB

  • MD5

    33619ba305f5e0fcb6ba652145f24770

  • SHA1

    dcabe0df00e2dd522da797f5edb3766d67c83ae5

  • SHA256

    1380f16dbe7bfd83d43dfa587e13464b49d09f059d70518e2f25346c506ea46a

  • SHA512

    974b4ac496f493e814ef031ad1cf84e22eb6ef9118865b74186e567328f1ef96c76fc3b572d63004e910b618db77b209c10f5e2a6f3aac03c442c7ff2b0d8bea

  • SSDEEP

    384:0qeQi+mqMC9wD8CWS+GiNEu7ZrcIUeT7+ung8wnkiXWm2aMF+ioYRdQmXdJY:01QJnwD8CRHEfT7cxhMbdQubY

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\1380f16dbe7bfd83d43dfa587e13464b49d09f059d70518e2f25346c506ea46a.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4048

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4048-0-0x00007FF9B36B0000-0x00007FF9B36C0000-memory.dmp

    Filesize

    64KB

  • memory/4048-2-0x00007FF9B36B0000-0x00007FF9B36C0000-memory.dmp

    Filesize

    64KB

  • memory/4048-1-0x00007FF9B36B0000-0x00007FF9B36C0000-memory.dmp

    Filesize

    64KB

  • memory/4048-3-0x00007FF9B36B0000-0x00007FF9B36C0000-memory.dmp

    Filesize

    64KB

  • memory/4048-4-0x00007FF9B36B0000-0x00007FF9B36C0000-memory.dmp

    Filesize

    64KB

  • memory/4048-5-0x00007FF9F36CD000-0x00007FF9F36CE000-memory.dmp

    Filesize

    4KB

  • memory/4048-9-0x00007FF9F3630000-0x00007FF9F3825000-memory.dmp

    Filesize

    2.0MB

  • memory/4048-8-0x00007FF9F3630000-0x00007FF9F3825000-memory.dmp

    Filesize

    2.0MB

  • memory/4048-7-0x00007FF9F3630000-0x00007FF9F3825000-memory.dmp

    Filesize

    2.0MB

  • memory/4048-6-0x00007FF9F3630000-0x00007FF9F3825000-memory.dmp

    Filesize

    2.0MB

  • memory/4048-10-0x00007FF9B0E30000-0x00007FF9B0E40000-memory.dmp

    Filesize

    64KB

  • memory/4048-11-0x00007FF9F3630000-0x00007FF9F3825000-memory.dmp

    Filesize

    2.0MB

  • memory/4048-13-0x00007FF9F3630000-0x00007FF9F3825000-memory.dmp

    Filesize

    2.0MB

  • memory/4048-12-0x00007FF9F3630000-0x00007FF9F3825000-memory.dmp

    Filesize

    2.0MB

  • memory/4048-15-0x00007FF9F3630000-0x00007FF9F3825000-memory.dmp

    Filesize

    2.0MB

  • memory/4048-14-0x00007FF9B0E30000-0x00007FF9B0E40000-memory.dmp

    Filesize

    64KB

  • memory/4048-60-0x00007FF9F3630000-0x00007FF9F3825000-memory.dmp

    Filesize

    2.0MB

  • memory/4048-125-0x00007FF9F3630000-0x00007FF9F3825000-memory.dmp

    Filesize

    2.0MB

  • memory/4048-126-0x00007FF9F3630000-0x00007FF9F3825000-memory.dmp

    Filesize

    2.0MB