Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20/11/2024, 18:26
General
-
Target
842bb1e2c5a86de9cb98aa3a1c9df2795af436885f2ab1851fe88802d1c57346.xls
-
Size
126KB
-
MD5
56790f3c7a9e8b159eb7342765451fef
-
SHA1
a8c628bab71d9c8549ccf08d60bf0d038c6abe72
-
SHA256
842bb1e2c5a86de9cb98aa3a1c9df2795af436885f2ab1851fe88802d1c57346
-
SHA512
658e88e1a49e523b67fc49ee198187b0a2371e13131df420142eea318e1d4ad1074e7ad52cf1d34138769d832f7d269a5a8c88b6ebb78be768449682d108d677
-
SSDEEP
3072:EsKpbdrHYrMue8q7QPX+5xtekEdi8/dgj3Siz+3z4Icu6hlC0:7KpbdrHYrMue8q7QPX+5xtFEdi8/dgjd
Malware Config
Extracted
http://www.forensisbilisim.com/ankara/bplsmKfaKAwAyavNj/
https://www.faitmaison.uk/wp-admin/BZMoK/
http://www.fahriefe.com.tr/yargitaykararlari/aVg/
http://www.parapetyrs.cz/wp-content/uploads/UTnG7GKKkZf/
https://www.whow.fr/wp-includes/aZo78JmHBoEmW6fVQ/
http://www.drcno.sk/_sub/FcEgwPugDI7wr2/
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\842bb1e2c5a86de9cb98aa3a1c9df2795af436885f2ab1851fe88802d1c57346.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c4f2c31faa54d94c0d4a3873dbbb6cd3
SHA129e67beb77b8ba6267337904baa7a5d03f65fe27
SHA256c84fc3062d97086fc75df5c012d093b41977a0344f2bc98ee8d0662446411a5f
SHA5121f32579e8ef7374154731d0c0d3ca05753adc5c9d14a5d7b2eb1dc84141a991027f562da03772ac056c3dc9b111aed02617a88bbfc1189fc47eb5a60572962a2
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB