Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

8

eicar-stan...nt.pdf

windows7-x64

3

eicar-stan...nt.pdf

windows10-2004-x64

3

eicar-stan...rt.pdf

windows7-x64

3

eicar-stan...rt.pdf

windows10-2004-x64

3

eicar-stan...om.com

windows7-x64

eicar-stan...om.com

windows10-2004-x64

eicar-stan...ho.xls

windows7-x64

10

eicar-stan...ho.xls

windows10-2004-x64

1

eicar-stan...o.xlsx

windows7-x64

10

eicar-stan...o.xlsx

windows10-2004-x64

1

eicar-stan...ho.xls

windows7-x64

10

eicar-stan...ho.xls

windows10-2004-x64

10

eicar-stan...o.xlsm

windows7-x64

10

eicar-stan...o.xlsm

windows10-2004-x64

10

eicar-stan...ox.xls

windows7-x64

3

eicar-stan...ox.xls

windows10-2004-x64

1

eicar-stan...x.xlsm

windows7-x64

3

eicar-stan...x.xlsm

windows10-2004-x64

1

eicar-stan...ho.xls

windows7-x64

10

eicar-stan...ho.xls

windows10-2004-x64

10

eicar-stan...o.xlsm

windows7-x64

10

eicar-stan...o.xlsm

windows10-2004-x64

10

eicar-stan...le.xls

windows7-x64

3

eicar-stan...le.xls

windows10-2004-x64

1

eicar-stan...e.xlsm

windows7-x64

3

eicar-stan...e.xlsm

windows10-2004-x64

1

eicar-stan...ox.pps

windows7-x64

3

eicar-stan...ox.pps

windows10-2004-x64

1

eicar-stan...x.pptm

windows7-x64

3

eicar-stan...x.pptm

windows10-2004-x64

1

eicar-stan...ho.pps

windows7-x64

10

eicar-stan...ho.pps

windows10-2004-x64

1

Analysis

  • max time kernel
    133s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2024, 20:40 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eicar-standard-antivirus-test-files/eicar-excel-macro-msgbox.xls

  • Size

    31KB

  • MD5

    2d4632e8119f62e9e1e54cc7359701d9

  • SHA1

    e8bb402cc5c3e1d685aad7178dbcea89567fcdf9

  • SHA256

    ec8afa9b698db880eef4b96994d0c6b3c2a6c3ef2f14525c2fc0e0e76f9a3454

  • SHA512

    4467fc6fa77f50737ef6bcad01237744cd6200fe3f974d5b6e66766dc691dfb448b2ca5435cdb7d8438fe24966e185d445799521d0e4c32b96ac5b6de64e7d18

  • SSDEEP

    768:lik3hOdsylKlgryzc4bNhZFGzE+cL2knAJ6OiCklmiBy2t946Ps:Uk3hOdsylKlgryzc4bNhZFGzE+cL2knf

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\eicar-standard-antivirus-test-files\eicar-excel-macro-msgbox.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4480

Network

  • flag-us
    DNS
    241.150.49.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.150.49.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.89.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.89.109.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    roaming.officeapps.live.com
    EXCEL.EXE
    Remote address:
    8.8.8.8:53
    Request
    roaming.officeapps.live.com
    IN A
    Response
    roaming.officeapps.live.com
    IN CNAME
    prod.roaming1.live.com.akadns.net
    prod.roaming1.live.com.akadns.net
    IN CNAME
    eur.roaming1.live.com.akadns.net
    eur.roaming1.live.com.akadns.net
    IN CNAME
    ukw-azsc-000.roaming.officeapps.live.com
    ukw-azsc-000.roaming.officeapps.live.com
    IN CNAME
    osiprod-ukw-buff-azsc-000.ukwest.cloudapp.azure.com
    osiprod-ukw-buff-azsc-000.ukwest.cloudapp.azure.com
    IN A
    52.109.32.7
  • flag-gb
    POST
    https://roaming.officeapps.live.com/rs/RoamingSoapService.svc
    EXCEL.EXE
    Remote address:
    52.109.32.7:443
    Request
    POST /rs/RoamingSoapService.svc HTTP/1.1
    Cache-Control: no-cache
    Connection: Keep-Alive
    Pragma: no-cache
    Content-Type: text/xml; charset=utf-8
    User-Agent: MS-WebServices/1.0
    SOAPAction: "http://tempuri.org/IRoamingSettingsService/GetConfig"
    Content-Length: 511
    Host: roaming.officeapps.live.com
    Response
    HTTP/1.1 200 OK
    Cache-Control: private
    Content-Type: text/xml; charset=utf-8
    Server: Microsoft-IIS/10.0
    X-OfficeFE: RoamingFE_IN_150
    X-OfficeVersion: 16.0.18315.30575
    X-OfficeCluster: ukw-000.roaming.officeapps.live.com
    Content-Security-Policy-Report-Only: script-src 'nonce-wnJIQlMzg6axWsr3o/38RSzxwws7jJK7dy9RThX17OebR8ZA7tk4JOvXX39EB/bYk4vvgyXl8WXb6YNK0GGWI312oYmZfIVwNszqDH7IzLAMWF1Yu0AzaPwgA/8pD92hcZq0Y97JnUXlra2tBfMHMjq7FezBMUXk6cw2k2I/PoA=' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https:; base-uri 'self'; object-src 'none'; require-trusted-types-for 'script'; report-uri https://csp.microsoft.com/report/OfficeIce-OfficeRoaming-Prod
    X-CorrelationId: 6b5251fe-2980-4866-9124-cf5979b6215f
    X-Powered-By: ASP.NET
    Date: Wed, 04 Dec 2024 20:40:56 GMT
    Content-Length: 654
  • flag-us
    DNS
    7.32.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    7.32.109.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    134.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    134.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    214.143.182.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    214.143.182.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.163.202.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.163.202.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    92.12.20.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    92.12.20.2.in-addr.arpa
    IN PTR
    Response
    92.12.20.2.in-addr.arpa
    IN PTR
    a2-20-12-92deploystaticakamaitechnologiescom
  • flag-us
    DNS
    48.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    48.229.111.52.in-addr.arpa
    IN PTR
    Response
  • 52.109.32.7:443
    https://roaming.officeapps.live.com/rs/RoamingSoapService.svc
    tls, http
    EXCEL.EXE
    1.8kB
     8.2kB
     12
    11

    HTTP Request

    POST https://roaming.officeapps.live.com/rs/RoamingSoapService.svc

    HTTP Response

    200
  • 8.8.8.8:53
    241.150.49.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    241.150.49.20.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    18.89.109.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    18.89.109.52.in-addr.arpa

  • 8.8.8.8:53
    roaming.officeapps.live.com
    dns
    EXCEL.EXE
    73 B
     243 B
     1
    1

    DNS Request

    roaming.officeapps.live.com

    DNS Response

    52.109.32.7

  • 8.8.8.8:53
    7.32.109.52.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    7.32.109.52.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    134.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    134.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    214.143.182.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    214.143.182.52.in-addr.arpa

  • 8.8.8.8:53
    200.163.202.172.in-addr.arpa
    dns
    74 B
     160 B
     1
    1

    DNS Request

    200.163.202.172.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    92.12.20.2.in-addr.arpa
    dns
    69 B
     131 B
     1
    1

    DNS Request

    92.12.20.2.in-addr.arpa

  • 8.8.8.8:53
    48.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    48.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
    Filesize

    1KB

    MD5

    5d7df8ff1cc6915c432707ffb2f21fc0

    SHA1

    7e8e0bd79bce5e0402e0677a0a762fc15f674912

    SHA256

    bcd2e6468aa38a6f688f7d94968114d458e1fe056900d976f9a40c6d7c427b1c

    SHA512

    561d9db4c58adf83eb86c1158a38cf20dd95b7df3342c4d73298988207d7fc85b5094c7450299dc1584933d621abdee75642ea325d05be23ec425b39ceadd20a

    Download Submit

  • memory/4480-5-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4480-27-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4480-4-0x00007FFED9230000-0x00007FFED9240000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4480-1-0x00007FFED9230000-0x00007FFED9240000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4480-6-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4480-9-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4480-11-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4480-10-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4480-13-0x00007FFED6A80000-0x00007FFED6A90000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4480-12-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4480-8-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4480-0-0x00007FFED9230000-0x00007FFED9240000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4480-3-0x00007FFF1924D000-0x00007FFF1924E000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4480-18-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4480-7-0x00007FFED9230000-0x00007FFED9240000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4480-19-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4480-20-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4480-16-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4480-15-0x00007FFED6A80000-0x00007FFED6A90000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4480-14-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4480-28-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4480-17-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4480-34-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4480-38-0x00007FFF191B0000-0x00007FFF193A5000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4480-2-0x00007FFED9230000-0x00007FFED9240000-memory.dmp

    Filesize

    64KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.