Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
47s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 21:35
Behavioral task
behavioral1
Sample
ca86b5bcb1ecf0b173fc3d4f688b6f5bac14853b356dddcae40147ec4a5ce3d8.xlsm
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ca86b5bcb1ecf0b173fc3d4f688b6f5bac14853b356dddcae40147ec4a5ce3d8.xlsm
Resource
win10v2004-20241007-en
General
-
Target
ca86b5bcb1ecf0b173fc3d4f688b6f5bac14853b356dddcae40147ec4a5ce3d8.xlsm
-
Size
92KB
-
MD5
d8e990bcccf184fba7dc670773877018
-
SHA1
ca8ffd7625a7c525ea387fc9aaf8e5d844606d00
-
SHA256
ca86b5bcb1ecf0b173fc3d4f688b6f5bac14853b356dddcae40147ec4a5ce3d8
-
SHA512
8fda62cd0d0cb892befdde89aa53ceda0f2837505dacb1350ce549cd1503e81d84ae277c2cb9f5807f35f8e28b901b9979c98e6e76b75888b2f6041cfd706b15
-
SSDEEP
1536:CguZCa6S5khUI/reXVgyilF4znOSjhLM+vGa/M1NIpPkUlB7583fjncFYIIRpFvG:Cgugapkhl/rIVjilFaPjpM+d/Ms8ULas
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 368 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 368 EXCEL.EXE 368 EXCEL.EXE 368 EXCEL.EXE 368 EXCEL.EXE 368 EXCEL.EXE 368 EXCEL.EXE 368 EXCEL.EXE 368 EXCEL.EXE 368 EXCEL.EXE 368 EXCEL.EXE 368 EXCEL.EXE 368 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ca86b5bcb1ecf0b173fc3d4f688b6f5bac14853b356dddcae40147ec4a5ce3d8.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:368
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize3KB
MD5851fb9b4a8c0a7e59befb45e3c61a798
SHA145659f01f182556bf14e71e230ce601ba1c609d5
SHA25608e2bc3ba59a65bbeff085cefd512d1571083d8565111eac8a5d6f39c2e9b924
SHA512cd1ed30f78c988069053cf2d857b247e329128d3ec5c4f53572f910f52fcd709cf36460ce2cf9a35bbc6905ed854369c43c21afab2e3b9338c4714c32ec3b18e