Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
101s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
03/09/2024, 19:22
General
-
Target
SecuriteInfo.com.Other.Malware-gen.18317.3179.xls
-
Size
209KB
-
MD5
5b28aea68f6bcfd8336c85b3722e2a1a
-
SHA1
823f8e5c8f994193202af76a22fd6e989f5b11cd
-
SHA256
06623c47be31158c77417823a17e5e1c203068da959bbaaa64743420371e9a81
-
SHA512
43b5476dc553a68c0be346bd4cb68b72e5974a971ffd0f4dfd46d3ee47cfca64b550da9596e6a1f485118dacd35cc25d579fb175fa044b9c022ccb9aa87d90e9
-
SSDEEP
6144:xYh2x8eIzSrXvjNC0tc5J68eKZI8DQyfaWlBjhb:xTx8eIzSrtofU8DZd
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Other.Malware-gen.18317.3179.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5c34d17d679afdae24bdea0099fbf19b5
SHA1c49187752d5c243cb9ff0c8fafc9599df36bc960
SHA2569f91d4f27384650e41e8fd8c188e27ebb48cb8de6c118f65597d0866e058f73a
SHA512e65a56f5fe22d485fe4a131e3fbc75ae0a4af9979175998a48a4918d6186cb97002ec9d7e924870810877d40300e844768f339013958021a40274c4dccaba189
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB