Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/09/2024, 22:53
Static task
static1
Behavioral task
behavioral1
Sample
Siparis_17.xls
Resource
win10-20240611-en
Behavioral task
behavioral2
Sample
Siparis_17.xls
Resource
win10v2004-20240802-en
General
-
Target
Siparis_17.xls
-
Size
116KB
-
MD5
9e3cc5eacda911d2da86fa35fc49a73e
-
SHA1
b3b61ae6eb61d9b713b6cfb3a2185bc07d23dfa5
-
SHA256
288eeeefb4798cc91a55f1bf73a81f961f96dc81439c3f0bce526a7597194888
-
SHA512
5363944c4039f0cf6c25e2144847f3f0d225188eeadedea3437ff69819a5a15b35d977ff0e351e0a08141a11a620102b2097e0e7e38125e4632f3c2a6ea6795b
-
SSDEEP
768:mNYYFFYYNU0AuAAJfffFd9sdfDf7cFFXx2Z2KJOyyyiMZ5u9XX0223f:mNYYFFYYbAuAAzd9sdfDfA80KJFY9XXk
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 440 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 440 EXCEL.EXE 440 EXCEL.EXE 440 EXCEL.EXE 440 EXCEL.EXE 440 EXCEL.EXE 440 EXCEL.EXE 440 EXCEL.EXE 440 EXCEL.EXE 440 EXCEL.EXE 440 EXCEL.EXE 440 EXCEL.EXE 440 EXCEL.EXE 440 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Siparis_17.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:440
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize2KB
MD5e9c3be61a8db468985756f10dc064f9d
SHA1e8d1f59e123b6d316a820728e8ed14831fae8475
SHA256d05905d79931a4f7b3b35bc12f4e404517eda5f74dd02fd78bd1799d2f5a09e0
SHA51259a16c3bd648d2d31cc920c0a7d4011c22b372d99073c0562c4656e630f79c873b33619202e3fa54ce50606a00d6a04017fff4e7619f161fe6d335daf501906a