Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 21:54
Behavioral task
behavioral1
Sample
d97ff91ce5945eaeefee4f018f5e1536651128bdc1852e8f0f29b819e0905ac9.xls
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
d97ff91ce5945eaeefee4f018f5e1536651128bdc1852e8f0f29b819e0905ac9.xls
Resource
win10v2004-20240802-en
General
-
Target
d97ff91ce5945eaeefee4f018f5e1536651128bdc1852e8f0f29b819e0905ac9.xls
-
Size
193KB
-
MD5
5397d5f6742ecf8037af59340234266c
-
SHA1
6661d29b46b3555f9b3493aa9cfc7999c4926ab7
-
SHA256
d97ff91ce5945eaeefee4f018f5e1536651128bdc1852e8f0f29b819e0905ac9
-
SHA512
a665a90283afee71140b5de8cb7ac33a1c530c98e576decd6a69a45486bd418163bebc5dc8ef6425b17170541f090945b3ef7af4a7abcdff80d8830daae9d59e
-
SSDEEP
6144:/J7xEtjPOtioVjDGUU1qfDlavx+WYIxA7mZcwd:o6wd
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2532 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2532 EXCEL.EXE 2532 EXCEL.EXE 2532 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2532 wrote to memory of 3048 2532 EXCEL.EXE 30 PID 2532 wrote to memory of 3048 2532 EXCEL.EXE 30 PID 2532 wrote to memory of 3048 2532 EXCEL.EXE 30 PID 2532 wrote to memory of 3048 2532 EXCEL.EXE 30
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\d97ff91ce5945eaeefee4f018f5e1536651128bdc1852e8f0f29b819e0905ac9.xls1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:3048
-