Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 03:57
Static task
static1
Behavioral task
behavioral1
Sample
zkzdy500.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
zkzdy500.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
准考证制作示例表(全部).xls
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
准考证制作示例表(全部).xls
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
模板/新云软件.url
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
模板/新云软件.url
Resource
win10v2004-20240611-en
General
-
Target
准考证制作示例表(全部).xls
-
Size
97KB
-
MD5
e9552aea19eb31c4cf489dac8b72fddc
-
SHA1
fd228896a2756e6070532eec329fcce62482a639
-
SHA256
df6098e22f200db2ff6b0289ead8e7fc50ce5242946bdd98765ad5abcc8153eb
-
SHA512
cad0aaa1c45bf5cefa8945b2562bf1bb07928b61d50d740a10edfdd66d2496fa375b328b2300d9329aa02d4ebb4016fe5c08acaec0fb428fb70afc6523dc869c
-
SSDEEP
1536:DkkkkS1Dcr9boA/zNBx4lDDKscZT+UMJydvhVvRNxzIWVeh/zBHjXHBrjfpTtRDt:QkbR/zNBx4lDDKsyT+lJyVxzPw
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3048 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 3048 EXCEL.EXE 3048 EXCEL.EXE 3048 EXCEL.EXE 3048 EXCEL.EXE 3048 EXCEL.EXE 3048 EXCEL.EXE 3048 EXCEL.EXE 3048 EXCEL.EXE 3048 EXCEL.EXE 3048 EXCEL.EXE 3048 EXCEL.EXE 3048 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\准考证制作示例表(全部).xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3048