Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
36s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/09/2024, 22:02
Behavioral task
behavioral1
Sample
3d2a081981951720387fcb3ff6e5292ecf3b7257f9de8597257dae2a3fa5713d.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3d2a081981951720387fcb3ff6e5292ecf3b7257f9de8597257dae2a3fa5713d.xls
Resource
win10v2004-20240802-en
General
-
Target
3d2a081981951720387fcb3ff6e5292ecf3b7257f9de8597257dae2a3fa5713d.xls
-
Size
189KB
-
MD5
b6a52d089775c780a21a347b7db79671
-
SHA1
bb2aea4a8da0d8cf4a4b6e9f6db9b242715b3f51
-
SHA256
3d2a081981951720387fcb3ff6e5292ecf3b7257f9de8597257dae2a3fa5713d
-
SHA512
3bbf899b4a6914351a0eb477acaa68d0987485b9720b00081afeb020c7c8dbe990d7301b228924ea63f0fbb08e2c2e6d1218186cd247a609a517f6e6d6891392
-
SSDEEP
3072:MJe6O9qbVNcryn4c5tmDV0Ak3hOdsylKlgxopeiBNhZFGzE+cL4LglnA+3o6BVqs:oe6O9GVNcrynbtmDVbk3hOdsylKlgxoc
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1480 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1480 EXCEL.EXE 1480 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1480 EXCEL.EXE 1480 EXCEL.EXE 1480 EXCEL.EXE 1480 EXCEL.EXE 1480 EXCEL.EXE 1480 EXCEL.EXE 1480 EXCEL.EXE 1480 EXCEL.EXE 1480 EXCEL.EXE 1480 EXCEL.EXE 1480 EXCEL.EXE 1480 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\3d2a081981951720387fcb3ff6e5292ecf3b7257f9de8597257dae2a3fa5713d.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1480
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD54c6226e0805ee7128ea8e5c489454ef0
SHA1e1233632d1a9207cabc9d647238878131c300489
SHA2565c07471942de0d36463fa9ad00a9d76d3344436f2b733cdbdc22a4f9b6b3b406
SHA512c89d116ed7f47f46015d521da7facb9b44db46e44a91f093283301cebfcd9011e5df5173a9f06214797984f453dd594ff9dd25ef6cccef47e82dc3f1df8d1ad7