Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    138s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2024, 03:57

General

  • Target

    准考证制作示例表(全部).xls

  • Size

    97KB

  • MD5

    e9552aea19eb31c4cf489dac8b72fddc

  • SHA1

    fd228896a2756e6070532eec329fcce62482a639

  • SHA256

    df6098e22f200db2ff6b0289ead8e7fc50ce5242946bdd98765ad5abcc8153eb

  • SHA512

    cad0aaa1c45bf5cefa8945b2562bf1bb07928b61d50d740a10edfdd66d2496fa375b328b2300d9329aa02d4ebb4016fe5c08acaec0fb428fb70afc6523dc869c

  • SSDEEP

    1536:DkkkkS1Dcr9boA/zNBx4lDDKscZT+UMJydvhVvRNxzIWVeh/zBHjXHBrjfpTtRDt:QkbR/zNBx4lDDKsyT+lJyVxzPw

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\准考证制作示例表(全部).xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3048

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3048-1-0x00007FFB9E1F0000-0x00007FFB9E200000-memory.dmp

    Filesize

    64KB

  • memory/3048-0-0x00007FFB9E1F0000-0x00007FFB9E200000-memory.dmp

    Filesize

    64KB

  • memory/3048-3-0x00007FFB9E1F0000-0x00007FFB9E200000-memory.dmp

    Filesize

    64KB

  • memory/3048-2-0x00007FFB9E1F0000-0x00007FFB9E200000-memory.dmp

    Filesize

    64KB

  • memory/3048-4-0x00007FFBDE20D000-0x00007FFBDE20E000-memory.dmp

    Filesize

    4KB

  • memory/3048-5-0x00007FFB9E1F0000-0x00007FFB9E200000-memory.dmp

    Filesize

    64KB

  • memory/3048-7-0x00007FFBDE170000-0x00007FFBDE365000-memory.dmp

    Filesize

    2.0MB

  • memory/3048-6-0x00007FFBDE170000-0x00007FFBDE365000-memory.dmp

    Filesize

    2.0MB

  • memory/3048-8-0x00007FFBDE170000-0x00007FFBDE365000-memory.dmp

    Filesize

    2.0MB

  • memory/3048-10-0x00007FFBDE170000-0x00007FFBDE365000-memory.dmp

    Filesize

    2.0MB

  • memory/3048-9-0x00007FFB9BD00000-0x00007FFB9BD10000-memory.dmp

    Filesize

    64KB

  • memory/3048-12-0x00007FFBDE170000-0x00007FFBDE365000-memory.dmp

    Filesize

    2.0MB

  • memory/3048-13-0x00007FFB9BD00000-0x00007FFB9BD10000-memory.dmp

    Filesize

    64KB

  • memory/3048-11-0x00007FFBDE170000-0x00007FFBDE365000-memory.dmp

    Filesize

    2.0MB

  • memory/3048-15-0x00007FFBDE170000-0x00007FFBDE365000-memory.dmp

    Filesize

    2.0MB

  • memory/3048-16-0x00007FFBDE170000-0x00007FFBDE365000-memory.dmp

    Filesize

    2.0MB

  • memory/3048-18-0x00007FFBDE170000-0x00007FFBDE365000-memory.dmp

    Filesize

    2.0MB

  • memory/3048-17-0x00007FFBDE170000-0x00007FFBDE365000-memory.dmp

    Filesize

    2.0MB

  • memory/3048-14-0x00007FFBDE170000-0x00007FFBDE365000-memory.dmp

    Filesize

    2.0MB

  • memory/3048-32-0x00007FFBDE170000-0x00007FFBDE365000-memory.dmp

    Filesize

    2.0MB

  • memory/3048-39-0x00007FFB9E1F0000-0x00007FFB9E200000-memory.dmp

    Filesize

    64KB

  • memory/3048-40-0x00007FFB9E1F0000-0x00007FFB9E200000-memory.dmp

    Filesize

    64KB

  • memory/3048-42-0x00007FFB9E1F0000-0x00007FFB9E200000-memory.dmp

    Filesize

    64KB

  • memory/3048-41-0x00007FFB9E1F0000-0x00007FFB9E200000-memory.dmp

    Filesize

    64KB

  • memory/3048-43-0x00007FFBDE170000-0x00007FFBDE365000-memory.dmp

    Filesize

    2.0MB