Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
47s -
max time network
38s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/08/2024, 21:24
Behavioral task
behavioral1
Sample
88e030b3aaf7aad1437ffacb537d1c88d1d6701e12c25bf77f4a8b73801f01fe.xlsm
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
88e030b3aaf7aad1437ffacb537d1c88d1d6701e12c25bf77f4a8b73801f01fe.xlsm
Resource
win10v2004-20240802-en
General
-
Target
88e030b3aaf7aad1437ffacb537d1c88d1d6701e12c25bf77f4a8b73801f01fe.xlsm
-
Size
92KB
-
MD5
b6ea1b72e16748fc2baffffa90456d71
-
SHA1
b8ae50e4de4d254f3342eaa6727e31b5bbb9c7af
-
SHA256
88e030b3aaf7aad1437ffacb537d1c88d1d6701e12c25bf77f4a8b73801f01fe
-
SHA512
de33008b093dee670c193d17ce85820c6e301e21dd0dc4daed782ce9a7ec222e9f2ded5ab7ebd8e84f170d83e9405d81d834f7e2528c587eb0ecfbd2157247c1
-
SSDEEP
1536:CguZCa6S5khUI+iJEmu3q4a4znOSjhLM+vGa/M1NIpPkUlB7583fjncFYIIz5+F1:Cgugapkhlbhua4aaPjpM+d/Ms8ULavLY
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2224 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 2224 EXCEL.EXE 2224 EXCEL.EXE 2224 EXCEL.EXE 2224 EXCEL.EXE 2224 EXCEL.EXE 2224 EXCEL.EXE 2224 EXCEL.EXE 2224 EXCEL.EXE 2224 EXCEL.EXE 2224 EXCEL.EXE 2224 EXCEL.EXE 2224 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\88e030b3aaf7aad1437ffacb537d1c88d1d6701e12c25bf77f4a8b73801f01fe.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2224
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD56f64fc141c37ba7ffe5a2dba9b8700c5
SHA11c375bfdeb04134f05fcb4610f0501e0eb5f8fbf
SHA256d9c64cd6a723361c183bd26766eb9d0e87158e7ec090de554bd1911d5677f9d7
SHA5121fe6d19b070b616608f5ce4f71e7987c728f89cb7f91e98732ca37f96ada290e4ce3c7090fb490e0c013be09f9a6d10cf4c690fa257cdfa7d5f8f8a4cfcc5611