Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    47s
  • max time network
    38s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/08/2024, 21:24

General

  • Target

    88e030b3aaf7aad1437ffacb537d1c88d1d6701e12c25bf77f4a8b73801f01fe.xlsm

  • Size

    92KB

  • MD5

    b6ea1b72e16748fc2baffffa90456d71

  • SHA1

    b8ae50e4de4d254f3342eaa6727e31b5bbb9c7af

  • SHA256

    88e030b3aaf7aad1437ffacb537d1c88d1d6701e12c25bf77f4a8b73801f01fe

  • SHA512

    de33008b093dee670c193d17ce85820c6e301e21dd0dc4daed782ce9a7ec222e9f2ded5ab7ebd8e84f170d83e9405d81d834f7e2528c587eb0ecfbd2157247c1

  • SSDEEP

    1536:CguZCa6S5khUI+iJEmu3q4a4znOSjhLM+vGa/M1NIpPkUlB7583fjncFYIIz5+F1:Cgugapkhlbhua4aaPjpM+d/Ms8ULavLY

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\88e030b3aaf7aad1437ffacb537d1c88d1d6701e12c25bf77f4a8b73801f01fe.xlsm"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2224

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    6f64fc141c37ba7ffe5a2dba9b8700c5

    SHA1

    1c375bfdeb04134f05fcb4610f0501e0eb5f8fbf

    SHA256

    d9c64cd6a723361c183bd26766eb9d0e87158e7ec090de554bd1911d5677f9d7

    SHA512

    1fe6d19b070b616608f5ce4f71e7987c728f89cb7f91e98732ca37f96ada290e4ce3c7090fb490e0c013be09f9a6d10cf4c690fa257cdfa7d5f8f8a4cfcc5611

  • memory/2224-10-0x00007FFCF2C70000-0x00007FFCF2E65000-memory.dmp

    Filesize

    2.0MB

  • memory/2224-11-0x00007FFCF2C70000-0x00007FFCF2E65000-memory.dmp

    Filesize

    2.0MB

  • memory/2224-5-0x00007FFCF2D0D000-0x00007FFCF2D0E000-memory.dmp

    Filesize

    4KB

  • memory/2224-0-0x00007FFCB2CF0000-0x00007FFCB2D00000-memory.dmp

    Filesize

    64KB

  • memory/2224-1-0x00007FFCB2CF0000-0x00007FFCB2D00000-memory.dmp

    Filesize

    64KB

  • memory/2224-9-0x00007FFCF2C70000-0x00007FFCF2E65000-memory.dmp

    Filesize

    2.0MB

  • memory/2224-8-0x00007FFCF2C70000-0x00007FFCF2E65000-memory.dmp

    Filesize

    2.0MB

  • memory/2224-7-0x00007FFCF2C70000-0x00007FFCF2E65000-memory.dmp

    Filesize

    2.0MB

  • memory/2224-4-0x00007FFCB2CF0000-0x00007FFCB2D00000-memory.dmp

    Filesize

    64KB

  • memory/2224-6-0x00007FFCF2C70000-0x00007FFCF2E65000-memory.dmp

    Filesize

    2.0MB

  • memory/2224-2-0x00007FFCB2CF0000-0x00007FFCB2D00000-memory.dmp

    Filesize

    64KB

  • memory/2224-13-0x00007FFCF2C70000-0x00007FFCF2E65000-memory.dmp

    Filesize

    2.0MB

  • memory/2224-12-0x00007FFCF2C70000-0x00007FFCF2E65000-memory.dmp

    Filesize

    2.0MB

  • memory/2224-14-0x00007FFCB0390000-0x00007FFCB03A0000-memory.dmp

    Filesize

    64KB

  • memory/2224-15-0x00007FFCB0390000-0x00007FFCB03A0000-memory.dmp

    Filesize

    64KB

  • memory/2224-66-0x00007FFCF2C70000-0x00007FFCF2E65000-memory.dmp

    Filesize

    2.0MB

  • memory/2224-3-0x00007FFCB2CF0000-0x00007FFCB2D00000-memory.dmp

    Filesize

    64KB

  • memory/2224-152-0x00007FFCF2C70000-0x00007FFCF2E65000-memory.dmp

    Filesize

    2.0MB

  • memory/2224-153-0x00007FFCF2C70000-0x00007FFCF2E65000-memory.dmp

    Filesize

    2.0MB