Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3release_resources.iso
windows7-x64
3release_resources.iso
windows10-2004-x64
3out.iso
windows7-x64
1out.iso
windows10-2004-x64
1Setup.exe
windows7-x64
5Setup.exe
windows10-2004-x64
10accusal.xlsx
windows7-x64
1accusal.xlsx
windows10-2004-x64
1roc.png
windows7-x64
3roc.png
windows10-2004-x64
3tak_deco_lib.dll
windows7-x64
1tak_deco_lib.dll
windows10-2004-x64
1Analysis
-
max time kernel
139s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2024, 23:54
Static task
static1
Behavioral task
behavioral1
Sample
release_resources.iso
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
release_resources.iso
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
out.iso
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
out.iso
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Setup.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Setup.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
accusal.xlsx
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
accusal.xlsx
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
roc.png
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
roc.png
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
tak_deco_lib.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
tak_deco_lib.dll
Resource
win10v2004-20240709-en
General
-
Target
accusal.xlsx
-
Size
38KB
-
MD5
4315e3ae033987f8c73f068bf69367a9
-
SHA1
948550adb9ef2790f4bf50f8fd8613aedff8b499
-
SHA256
bc6343ad3ddd6abc92797920a214c3ea4eb90b2df3e8604fee2b517be928d22f
-
SHA512
d5dee8955708c677fe0639db3b271f66d6a3caf37255ce6d83b86afdde0cd142849e30f47ba7151acc4b01f07eed2ee15b8ef8a90bb951b518b85572c04d5510
-
SSDEEP
768:nEEDwGCk5d47qHnSkz7stpY0Q2qmdVgh5f0R9NW9X3Z:rsCdM9UMme1dOh5fEw9nZ
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4648 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 4648 EXCEL.EXE 4648 EXCEL.EXE 4648 EXCEL.EXE 4648 EXCEL.EXE 4648 EXCEL.EXE 4648 EXCEL.EXE 4648 EXCEL.EXE 4648 EXCEL.EXE 4648 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\accusal.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4648