Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
48s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 21:43
Behavioral task
behavioral1
Sample
7eac72d65b6bdb3fe5a0e4e7620b31111ed0e2e8c6413949c8466f1a5871b7e2.xlsm
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
7eac72d65b6bdb3fe5a0e4e7620b31111ed0e2e8c6413949c8466f1a5871b7e2.xlsm
Resource
win10v2004-20241007-en
General
-
Target
7eac72d65b6bdb3fe5a0e4e7620b31111ed0e2e8c6413949c8466f1a5871b7e2.xlsm
-
Size
92KB
-
MD5
9a51386cbd66617674e01c5438228376
-
SHA1
dbef74f18f941a4c1f993d3ca1754b9bb1e1cb3a
-
SHA256
7eac72d65b6bdb3fe5a0e4e7620b31111ed0e2e8c6413949c8466f1a5871b7e2
-
SHA512
a70bf8654317b91ba2bfaec75bff260eabf8c254319cd225aaf0ea6d57acd48f74b25f7666e4dd8b6e26c7b754085248e0ae32ad844aeb52fceb3b766794970a
-
SSDEEP
1536:CguZCa6S5khUIF6+3ot4znOSjhLM+vGa/M1NIpPkUlB7583fjncFYIIaeZFG:CgugapkhlsWotaPjpM+d/Ms8ULavLc5
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 748 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 748 EXCEL.EXE 748 EXCEL.EXE 748 EXCEL.EXE 748 EXCEL.EXE 748 EXCEL.EXE 748 EXCEL.EXE 748 EXCEL.EXE 748 EXCEL.EXE 748 EXCEL.EXE 748 EXCEL.EXE 748 EXCEL.EXE 748 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\7eac72d65b6bdb3fe5a0e4e7620b31111ed0e2e8c6413949c8466f1a5871b7e2.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:748
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize686B
MD50cbe45817debedac224da0b4e6aa90d6
SHA14f4b9bced62aa33e663fbe27e83009a989dcbb27
SHA256968fee990b8838f1a8c505ad5d98325b8840062385ed6953e780e8bf99e25a84
SHA512c7e1235a50cb6112b003846285f5caf9102d875f30f494417d963e2999e8c442cd67d353e2d9ec615a3fa278f1adf2ec86fba1450eb62da5d2de4cd0626831ec