Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    46s
  • max time network
    52s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/08/2024, 02:45

General

  • Target

    6ab4d37d9d6731c1f1945d2dfcd63450ba79920a5b6ca4542c0c95d5d8899d22.xls

  • Size

    64KB

  • MD5

    ee6b26d24453826399ad46a8bbf4481e

  • SHA1

    a3e57d3c86e656082d39bedcf66161ebec0a20b1

  • SHA256

    6ab4d37d9d6731c1f1945d2dfcd63450ba79920a5b6ca4542c0c95d5d8899d22

  • SHA512

    625d0cd975a54b40d2388a7f55b2bb1b39bfe87a0e9bb5c6c2a3c3c12b5019eff6404a4f4bfcac252480f88255b99a5150179c37bbbd5a9986526feadb6ed055

  • SSDEEP

    1536:grxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAUPdbQ44Oh0C:grxEtjPOtioVjDGUU1qfDlaGGx+cL2Qd

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\6ab4d37d9d6731c1f1945d2dfcd63450ba79920a5b6ca4542c0c95d5d8899d22.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3452

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    e72fea9f48334f5c98c8965cfce82ac4

    SHA1

    6ba7f7ea0002a75df064e0a17be788885301f43a

    SHA256

    02d5bda0ee75581c4714b22d0b12c907348b79dd930556e0cea6ff5fd739c8b3

    SHA512

    3e96aaba941bb02fea73a68f534227b3d262de4aa8362082bb946b2de286edca2a17d7fa9d590e708412920c07aaedbf6523d51a146347dab19f9600cc247dad

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\LXEBKCNFK.exe

    Filesize

    30KB

    MD5

    de037033432a0987c112d8df7e3a91f6

    SHA1

    1e7d9460f05eb2a7e9c220fa07ae4cafe83bc877

    SHA256

    770b938122a1d507f97f6c731f4f00f30bdad44ef114fb15b69ec07172c55e66

    SHA512

    3d280671432f635e636e816ded5c1df0204f879406596de5a45554e0c5cbcb0473f185886eecdaf111c588bcf926fd8161b1cb08b3e0ab9c0e765fcf9e46fa8d

  • memory/3452-11-0x00007FFBB29D0000-0x00007FFBB2BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3452-8-0x00007FFBB29D0000-0x00007FFBB2BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3452-2-0x00007FFB72A50000-0x00007FFB72A60000-memory.dmp

    Filesize

    64KB

  • memory/3452-6-0x00007FFBB29D0000-0x00007FFBB2BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3452-9-0x00007FFBB29D0000-0x00007FFBB2BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3452-10-0x00007FFBB29D0000-0x00007FFBB2BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3452-13-0x00007FFBB29D0000-0x00007FFBB2BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3452-14-0x00007FFB700F0000-0x00007FFB70100000-memory.dmp

    Filesize

    64KB

  • memory/3452-12-0x00007FFBB29D0000-0x00007FFBB2BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3452-17-0x00007FFBB29D0000-0x00007FFBB2BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3452-3-0x00007FFB72A50000-0x00007FFB72A60000-memory.dmp

    Filesize

    64KB

  • memory/3452-0-0x00007FFB72A50000-0x00007FFB72A60000-memory.dmp

    Filesize

    64KB

  • memory/3452-15-0x00007FFB700F0000-0x00007FFB70100000-memory.dmp

    Filesize

    64KB

  • memory/3452-16-0x00007FFBB29D0000-0x00007FFBB2BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3452-18-0x00007FFBB29D0000-0x00007FFBB2BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3452-7-0x00007FFBB29D0000-0x00007FFBB2BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3452-1-0x00007FFB72A50000-0x00007FFB72A60000-memory.dmp

    Filesize

    64KB

  • memory/3452-38-0x00007FFBB29D0000-0x00007FFBB2BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3452-5-0x00007FFB72A50000-0x00007FFB72A60000-memory.dmp

    Filesize

    64KB

  • memory/3452-100-0x00007FFBB29D0000-0x00007FFBB2BC5000-memory.dmp

    Filesize

    2.0MB

  • memory/3452-4-0x00007FFBB2A6D000-0x00007FFBB2A6E000-memory.dmp

    Filesize

    4KB

  • memory/3452-106-0x00007FFBB29D0000-0x00007FFBB2BC5000-memory.dmp

    Filesize

    2.0MB