Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2024, 03:18
Static task
static1
Behavioral task
behavioral1
Sample
d42ff478f1996a591e02f59a41edda8aee486e9523c14bce04be51cb457cc6e6.xls
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
d42ff478f1996a591e02f59a41edda8aee486e9523c14bce04be51cb457cc6e6.xls
Resource
win10v2004-20241007-en
General
-
Target
d42ff478f1996a591e02f59a41edda8aee486e9523c14bce04be51cb457cc6e6.xls
-
Size
1.1MB
-
MD5
9b8d94907c2db1b8ae9ebf84b2099c16
-
SHA1
d543e02897263288f2b2a65d7070757d99fed8ff
-
SHA256
d42ff478f1996a591e02f59a41edda8aee486e9523c14bce04be51cb457cc6e6
-
SHA512
cc8d24cee7a41c7cc2ddab9cd5d7ae6b245dcd90fee8b5de1d4001dae83e7c43d3cbd474bc1c4f89fa9ec903d26de680630d8b064328f07b3a04cf827182a972
-
SSDEEP
24576:1yaZxvseowaDI9eqvBw2LyifZSScF1LelExbgwCcH0p1O4uGqdzkxTm:1T0DIRvBwCv0xF1L3MwCA4uIx
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 1684 1600 mshta.exe 82 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1600 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1600 EXCEL.EXE 1600 EXCEL.EXE 1600 EXCEL.EXE 1600 EXCEL.EXE 1600 EXCEL.EXE 1600 EXCEL.EXE 1600 EXCEL.EXE 1600 EXCEL.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1600 wrote to memory of 1684 1600 EXCEL.EXE 91 PID 1600 wrote to memory of 1684 1600 EXCEL.EXE 91 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d42ff478f1996a591e02f59a41edda8aee486e9523c14bce04be51cb457cc6e6.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Windows\System32\mshta.exeC:\Windows\System32\mshta.exe -Embedding2⤵
- Process spawned unexpected child process
PID:1684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize671B
MD5652160e558bac663b09f7924b1fcdc57
SHA1d6807936ca4d80d28f13eb2bb6ca7bd93a4c7da5
SHA256163635b1fbaccf70f5421b5761446e05c5ca809bc67a60bfbb872ff2fe891595
SHA512cabf6596ddd0e336f1714988b23b61f51a53a154b2dbbcff40d16dc5e6b8070b0b9d72183b9445b30beaffcba62bd93f71b839c720dcc014965c3476b53b2731