Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 02:08
Static task
static1
Behavioral task
behavioral1
Sample
d472c895106cfebcb6eea8701416aed96b9770c256432ee7ee7a9b8a60a6d254.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d472c895106cfebcb6eea8701416aed96b9770c256432ee7ee7a9b8a60a6d254.xls
Resource
win10v2004-20240802-en
General
-
Target
d472c895106cfebcb6eea8701416aed96b9770c256432ee7ee7a9b8a60a6d254.xls
-
Size
939KB
-
MD5
15d90d6aa9eb2c890494884bdaff2e91
-
SHA1
d55134055fb68cab73e32d6ed70d936399484a3d
-
SHA256
d472c895106cfebcb6eea8701416aed96b9770c256432ee7ee7a9b8a60a6d254
-
SHA512
a4f10b41f37be48b3ddf83e6c0d133cd8ae8655c4a8fac3235be0dc961c5bf2e3e80d6b924b446ba44a07b7bbdbf99d87b308637332bbb050b4c51c25dab5c8e
-
SSDEEP
12288:xmzHJEjwWYSqD3DERnLRmF8Dl3PTKuG44G24rBedMPQr6eyCQSEB9:gcwHSqbARM8B3ugedV7Q
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2724 1572 mshta.exe 88 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1572 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1572 EXCEL.EXE 1572 EXCEL.EXE 1572 EXCEL.EXE 1572 EXCEL.EXE 1572 EXCEL.EXE 1572 EXCEL.EXE 1572 EXCEL.EXE 1572 EXCEL.EXE 1572 EXCEL.EXE 1572 EXCEL.EXE 1572 EXCEL.EXE 1572 EXCEL.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1572 wrote to memory of 2724 1572 EXCEL.EXE 93 PID 1572 wrote to memory of 2724 1572 EXCEL.EXE 93 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d472c895106cfebcb6eea8701416aed96b9770c256432ee7ee7a9b8a60a6d254.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\System32\mshta.exeC:\Windows\System32\mshta.exe -Embedding2⤵
- Process spawned unexpected child process
PID:2724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4072,i,1828333185976713750,7918646547767660928,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:81⤵PID:3856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD5b0bab78398ce2080d289fa21a7e001da
SHA1f3afa0f07c063d97c62610146b90301de6e56d21
SHA2568c56e7b43f2b40a0172e42c836420c4033bf3f778ace0ab718ab0ce8060c6f1f
SHA512127f4f37574396515239632c92dcb44b438c2df5644e402f8f9ccb72eb6732e7cc5955c8b49a4d326025d0d5afec0d5dcc361fee55faa93f38b9db559b1f6e8e