Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

ec4f09f82d...d3.exe

windows10-2004-x64

10

efd97b1038...ea4.js

windows10-2004-x64

3

emotet_exe...04.exe

windows10-2004-x64

10

emotet_exe...23.exe

windows10-2004-x64

10

eupdate.exe

windows10-2004-x64

7

f4f47c67be...3f.exe

windows10-2004-x64

10

fb5d110ced...9c.exe

windows10-2004-x64

6

fee15285c3...35.exe

windows10-2004-x64

10

file(1).exe

windows10-2004-x64

1

file.exe

windows10-2004-x64

7

gjMEi6eG.exe

windows10-2004-x64

10

good.exe

windows10-2004-x64

10

hyundai st...1).exe

windows10-2004-x64

10

hyundai st...10.exe

windows10-2004-x64

10

infected d...er.exe

windows10-2004-x64

10

inps_979.xls

windows10-2004-x64

1

jar.jar

windows10-2004-x64

10

june9.dll

windows10-2004-x64

10

mouse_2.exe

windows10-2004-x64

10

oof.exe

windows10-2004-x64

3

openme.exe

windows10-2004-x64

10

ou55sg33s_1.exe

windows10-2004-x64

10

senate.dll

windows10-2004-x64

10

starticon3.exe

windows10-2004-x64

10

str.dll

windows10-2004-x64

10

svchost.exe

windows10-2004-x64

10

update.exe

windows10-2004-x64

10

vir1.xlsx

windows10-2004-x64

1

wwf[1].exe

windows10-2004-x64

10

xNet.dll

windows10-2004-x64

1

전산 및...��.exe

windows10-2004-x64

10

전산 및...�1.exe

windows10-2004-x64

10

Resubmissions

01/03/2025, 18:58 UTC

250301-xmhhrayp15 10

01/03/2025, 18:55 UTC

250301-xkqrcaypx7 10

Analysis

  • max time kernel
    133s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2024, 19:31 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    inps_979.xls

  • Size

    228KB

  • MD5

    56fc044937a072471fdd8d63b874e04a

  • SHA1

    738552f8db33ac0271aa860775815f3d1b291980

  • SHA256

    59afe59cdbebf60434bd78270826ca9689c3765264dfcace312b89c606c0a962

  • SHA512

    dbaf2e36ec17d474c829d847705de796bea153b784c8e894d4ff7bebb3bfcdf01447d97f217d9303e0eed5aa9b39046b75b2581331be28771582af2ea48c960b

  • SSDEEP

    3072:bfMhNhd8o7Vym+BoOvuuUVZV/AHyhb3/7428JMPvjLJKHpEYC5ZNWehxleT0t:bfMhL70DBoOmf1FbAJMWEYC5Z3leA

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\inps_979.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4904

Network

  • flag-us
    DNS
    149.220.183.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    149.220.183.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    86.49.80.91.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.49.80.91.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    roaming.officeapps.live.com
    EXCEL.EXE
    Remote address:
    8.8.8.8:53
    Request
    roaming.officeapps.live.com
    IN A
    Response
    roaming.officeapps.live.com
    IN CNAME
    prod.roaming1.live.com.akadns.net
    prod.roaming1.live.com.akadns.net
    IN CNAME
    eur.roaming1.live.com.akadns.net
    eur.roaming1.live.com.akadns.net
    IN CNAME
    neu-azsc-000.roaming.officeapps.live.com
    neu-azsc-000.roaming.officeapps.live.com
    IN CNAME
    osiprod-neu-buff-azsc-000.northeurope.cloudapp.azure.com
    osiprod-neu-buff-azsc-000.northeurope.cloudapp.azure.com
    IN A
    52.109.76.243
  • flag-ie
    POST
    https://roaming.officeapps.live.com/rs/RoamingSoapService.svc
    EXCEL.EXE
    Remote address:
    52.109.76.243:443
    Request
    POST /rs/RoamingSoapService.svc HTTP/1.1
    Cache-Control: no-cache
    Connection: Keep-Alive
    Pragma: no-cache
    Content-Type: text/xml; charset=utf-8
    User-Agent: MS-WebServices/1.0
    SOAPAction: "http://tempuri.org/IRoamingSettingsService/GetConfig"
    Content-Length: 511
    Host: roaming.officeapps.live.com
    Response
    HTTP/1.1 200 OK
    Cache-Control: private
    Content-Type: text/xml; charset=utf-8
    Server: Microsoft-IIS/10.0
    X-OfficeFE: RoamingFE_IN_363
    X-OfficeVersion: 16.0.18315.30575
    X-OfficeCluster: neu-000.roaming.officeapps.live.com
    Content-Security-Policy-Report-Only: script-src 'nonce-rZcU5T/eLTNVCJsTkeBha5TrMYbBpMTQeKqIrPE8es5XuUctrClkeallm/A74bEXGYKXQvJty3inULu0Y1dbCA1cfk2M7DhUkeY8k0YNiVTW8/IPaDFPx2yWlXNshAcC8fH/U5fErKEjdh46WOrr44ovzeYDKtGPzPb5/uK9f54=' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https:; base-uri 'self'; object-src 'none'; require-trusted-types-for 'script'; report-uri https://csp.microsoft.com/report/OfficeIce-OfficeRoaming-Prod
    X-CorrelationId: 6fde8e9d-9fd3-401c-b838-4b354de383b1
    X-Powered-By: ASP.NET
    Date: Wed, 04 Dec 2024 19:33:55 GMT
    Content-Length: 654
  • flag-us
    DNS
    97.32.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.32.109.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    243.76.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    243.76.109.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    64.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    64.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    210.143.182.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    210.143.182.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.163.202.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.163.202.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    21.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    21.236.111.52.in-addr.arpa
    IN PTR
    Response
  • 52.109.76.243:443
    https://roaming.officeapps.live.com/rs/RoamingSoapService.svc
    tls, http
    EXCEL.EXE
    1.8kB
     8.2kB
     12
    11

    HTTP Request

    POST https://roaming.officeapps.live.com/rs/RoamingSoapService.svc

    HTTP Response

    200
  • 8.8.8.8:53
    149.220.183.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    149.220.183.52.in-addr.arpa

  • 8.8.8.8:53
    86.49.80.91.in-addr.arpa
    dns
    70 B
     145 B
     1
    1

    DNS Request

    86.49.80.91.in-addr.arpa

  • 8.8.8.8:53
    roaming.officeapps.live.com
    dns
    EXCEL.EXE
    73 B
     248 B
     1
    1

    DNS Request

    roaming.officeapps.live.com

    DNS Response

    52.109.76.243

  • 8.8.8.8:53
    97.32.109.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    97.32.109.52.in-addr.arpa

  • 8.8.8.8:53
    243.76.109.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    243.76.109.52.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    64.159.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    64.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    210.143.182.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    210.143.182.52.in-addr.arpa

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    200.163.202.172.in-addr.arpa
    dns
    74 B
     160 B
     1
    1

    DNS Request

    200.163.202.172.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    21.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    21.236.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4904-2-0x00007FFA0D250000-0x00007FFA0D260000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4904-1-0x00007FFA0D250000-0x00007FFA0D260000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4904-3-0x00007FFA4D26D000-0x00007FFA4D26E000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4904-0-0x00007FFA0D250000-0x00007FFA0D260000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4904-6-0x00007FFA4D1D0000-0x00007FFA4D3C5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4904-7-0x00007FFA4D1D0000-0x00007FFA4D3C5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4904-5-0x00007FFA0D250000-0x00007FFA0D260000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4904-9-0x00007FFA4D1D0000-0x00007FFA4D3C5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4904-8-0x00007FFA0D250000-0x00007FFA0D260000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4904-4-0x00007FFA4D1D0000-0x00007FFA4D3C5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4904-11-0x00007FFA4D1D0000-0x00007FFA4D3C5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4904-12-0x00007FFA4D1D0000-0x00007FFA4D3C5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4904-13-0x00007FFA4D1D0000-0x00007FFA4D3C5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4904-10-0x00007FFA0B1F0000-0x00007FFA0B200000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4904-15-0x00007FFA4D1D0000-0x00007FFA4D3C5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4904-14-0x00007FFA4D1D0000-0x00007FFA4D3C5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4904-16-0x00007FFA0B1F0000-0x00007FFA0B200000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4904-17-0x00007FFA4D1D0000-0x00007FFA4D3C5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4904-19-0x00007FFA4D1D0000-0x00007FFA4D3C5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4904-21-0x00007FFA4D1D0000-0x00007FFA4D3C5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4904-20-0x00007FFA4D1D0000-0x00007FFA4D3C5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4904-18-0x00007FFA4D1D0000-0x00007FFA4D3C5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4904-31-0x00007FFA4D1D0000-0x00007FFA4D3C5000-memory.dmp

    Filesize

    2.0MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.