Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15/10/2024, 02:19
General
-
Target
001.赤湾停车场钢连桥-连桥柱锚栓（一~五区）-加工图0版-20240905(只加工22个��.xlsx
-
Size
47KB
-
MD5
9771389bc57978ea304b3c7be7454c06
-
SHA1
c3a1673b6531e2c3b5cbe243290ef94452ef5309
-
SHA256
98b91485a57c5dab66e341b6f00fd876578e041055874a92281479aeb3adf3b8
-
SHA512
7ef525b11fe447a09d4c112da981b2246dfbf690a15d54344369241967a1e14b9b2d48dac23911273a7ef3cad3c1b7bd9bd0ddf6f6a7479d0e3681702b52a65f
-
SSDEEP
768:EtV2Yf6H3JdHH02JD3PUb1ztZNuC8EIqoCk+W7hiOvQOQOJX8+/oybLCkLlD/hza:EtV2Yf6XJdn0WgxNuC86oCO/zp1nPVS1
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\001.赤湾停车场钢连桥-连桥柱锚栓（一~五区）-加工图0版-20240905(只加工22个��.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB