Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
12s -
max time network
21s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01/07/2024, 05:17
Behavioral task
behavioral1
Sample
2d480c7b696975ed15cabc3709953ff3368ac88cdfcf66abd1841b1e8adbdceb.xls
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2d480c7b696975ed15cabc3709953ff3368ac88cdfcf66abd1841b1e8adbdceb.xls
Resource
win10v2004-20240508-en
General
-
Target
2d480c7b696975ed15cabc3709953ff3368ac88cdfcf66abd1841b1e8adbdceb.xls
-
Size
1.0MB
-
MD5
8c545dd587fa71f85835f947e6d85b14
-
SHA1
995f48353255ab855f43fa73cfac360a5e88fedf
-
SHA256
2d480c7b696975ed15cabc3709953ff3368ac88cdfcf66abd1841b1e8adbdceb
-
SHA512
1f1dd436b8432f1f6b839eaa260ad724bbc21478680d094fc000af9794e3b0f606c9250c1d94f77c684d89be1d82cd204c5c488ccca703eb9ddb86c178795b6f
-
SSDEEP
12288:nDMduhqCSBkbYJ3KeJ5ZSbJMo4iW9HA5BuXvKB/FU/9v4RQ3l16WGZHHv7iMnCdn:DMm+sYJ3KaT8IiBO1vIQVoWGVYD
Malware Config
Signatures
-
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 832 5068 DW20.EXE 80 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dwwin.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dwwin.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dwwin.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dwwin.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwwin.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 5068 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5068 EXCEL.EXE 5068 EXCEL.EXE 5068 EXCEL.EXE 5068 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5068 EXCEL.EXE 5068 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 5068 EXCEL.EXE 5068 EXCEL.EXE 5068 EXCEL.EXE 5068 EXCEL.EXE 5068 EXCEL.EXE 5068 EXCEL.EXE 5068 EXCEL.EXE 5068 EXCEL.EXE 5068 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 5068 wrote to memory of 832 5068 EXCEL.EXE 82 PID 5068 wrote to memory of 832 5068 EXCEL.EXE 82 PID 832 wrote to memory of 4316 832 DW20.EXE 83 PID 832 wrote to memory of 4316 832 DW20.EXE 83
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\2d480c7b696975ed15cabc3709953ff3368ac88cdfcf66abd1841b1e8adbdceb.xls"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 43882⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 43883⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:4316
-
-