Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

IoC/00496083.xls

windows7-x64

3

IoC/00496083.xls

windows10-2004-x64

1

IoC/680589798891.xls

windows7-x64

3

IoC/680589798891.xls

windows10-2004-x64

1

Consignmen...df.exe

windows7-x64

10

Consignmen...df.exe

windows10-2004-x64

10

DHL SHIPME...PD.exe

windows7-x64

10

DHL SHIPME...PD.exe

windows10-2004-x64

10

EZ0496.exe

windows7-x64

10

EZ0496.exe

windows10-2004-x64

10

IoC/I05517...55.xls

windows7-x64

3

IoC/I05517...55.xls

windows10-2004-x64

1

IoC/I79540...11.xls

windows7-x64

3

IoC/I79540...11.xls

windows10-2004-x64

1

New Order ...22.exe

windows7-x64

10

New Order ...22.exe

windows10-2004-x64

10

$PLUGINSDIR/Math.dll

windows7-x64

3

$PLUGINSDIR/Math.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Windows.Sy...ns.dll

windows10-2004-x64

3

systeminfo.exe

windows10-2004-x64

3

wecutil.exe

windows10-2004-x64

3

New order ...22.exe

windows7-x64

10

New order ...22.exe

windows10-2004-x64

10

PO_#YBIC38...py.exe

windows7-x64

3

PO_#YBIC38...py.exe

windows10-2004-x64

3

Payment Ad...2).exe

windows7-x64

10

Payment Ad...2).exe

windows10-2004-x64

10

IoC/XSG8996380.xls

windows7-x64

3

IoC/XSG8996380.xls

windows10-2004-x64

1

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/12/2024, 21:57 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    IoC/I055170_06975755.xls

  • Size

    94KB

  • MD5

    44bbbdac3334b73c0f8773202d36cc60

  • SHA1

    26fdaa1de7ea45d1f1b6b2ce5f86ee6e030f308f

  • SHA256

    ef92e23f3ab74a0babcbd3bb96cedc7883bda95b3dab7b42c0d363ed4b18f535

  • SHA512

    56ba1da3d1ade5dbfc41a151a75f65ac4ebbc645dd0ed4bce68b76ca00250a0f08167c71a9e391541a086aedc61498b1f7f0cee4ba4cc5bfe524905381860046

  • SSDEEP

    1536:UsQlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0MokRElmW8bthBHOnMgQvUbwmq:UhlYkEIuPm3fNRZmbaoFhZhR0cixIHm5

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\IoC\I055170_06975755.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2840

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    roaming.officeapps.live.com
    EXCEL.EXE
    Remote address:
    8.8.8.8:53
    Request
    roaming.officeapps.live.com
    IN A
    Response
    roaming.officeapps.live.com
    IN CNAME
    prod.roaming1.live.com.akadns.net
    prod.roaming1.live.com.akadns.net
    IN CNAME
    eur.roaming1.live.com.akadns.net
    eur.roaming1.live.com.akadns.net
    IN CNAME
    neu-azsc-000.roaming.officeapps.live.com
    neu-azsc-000.roaming.officeapps.live.com
    IN CNAME
    osiprod-neu-buff-azsc-000.northeurope.cloudapp.azure.com
    osiprod-neu-buff-azsc-000.northeurope.cloudapp.azure.com
    IN A
    52.109.76.243
  • flag-ie
    POST
    https://roaming.officeapps.live.com/rs/RoamingSoapService.svc
    EXCEL.EXE
    Remote address:
    52.109.76.243:443
    Request
    POST /rs/RoamingSoapService.svc HTTP/1.1
    Cache-Control: no-cache
    Connection: Keep-Alive
    Pragma: no-cache
    Content-Type: text/xml; charset=utf-8
    User-Agent: MS-WebServices/1.0
    SOAPAction: "http://tempuri.org/IRoamingSettingsService/GetConfig"
    Content-Length: 511
    Host: roaming.officeapps.live.com
    Response
    HTTP/1.1 200 OK
    Cache-Control: private
    Content-Type: text/xml; charset=utf-8
    Server: Microsoft-IIS/10.0
    X-OfficeFE: RoamingFE_IN_408
    X-OfficeVersion: 16.0.18416.30575
    X-OfficeCluster: neu-000.roaming.officeapps.live.com
    Content-Security-Policy-Report-Only: script-src 'nonce-SulgWRu5hFIlO/2TpYPIYiCBfJMmqz7OAR8UBoebFJlBu/VsJx7OCfsN5GxI4cmVtGe3VHLUp66s0VP7biDAFhdpuHSs0oeMhiFUD/UYKC6/p2d4nMTg00lc5EVdRW7ukEnI9cF4yvCsWeiD1XeHDwhbn0wRpnd0Drd/2+q0pjM=' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https:; base-uri 'self'; object-src 'none'; require-trusted-types-for 'script'; report-uri https://csp.microsoft.com/report/OfficeIce-OfficeRoaming-Prod
    X-CorrelationId: 328b8290-f259-4faf-b9e4-f8a167807ff7
    X-Powered-By: ASP.NET
    Date: Mon, 23 Dec 2024 21:58:03 GMT
    Content-Length: 654
  • flag-us
    DNS
    77.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    77.190.18.2.in-addr.arpa
    IN PTR
    Response
    77.190.18.2.in-addr.arpa
    IN PTR
    a2-18-190-77deploystaticakamaitechnologiescom
  • flag-us
    DNS
    243.76.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    243.76.109.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    93.65.42.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    93.65.42.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.163.202.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.163.202.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.42.69.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.42.69.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    220.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    220.190.18.2.in-addr.arpa
    IN PTR
    Response
    220.190.18.2.in-addr.arpa
    IN PTR
    a2-18-190-220deploystaticakamaitechnologiescom
  • flag-us
    DNS
    81.144.22.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    81.144.22.2.in-addr.arpa
    IN PTR
    Response
    81.144.22.2.in-addr.arpa
    IN PTR
    a2-22-144-81deploystaticakamaitechnologiescom
  • 52.109.76.243:443
    https://roaming.officeapps.live.com/rs/RoamingSoapService.svc
    tls, http
    EXCEL.EXE
    1.8kB
     8.2kB
     12
    11

    HTTP Request

    POST https://roaming.officeapps.live.com/rs/RoamingSoapService.svc

    HTTP Response

    200
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    roaming.officeapps.live.com
    dns
    EXCEL.EXE
    73 B
     248 B
     1
    1

    DNS Request

    roaming.officeapps.live.com

    DNS Response

    52.109.76.243

  • 8.8.8.8:53
    77.190.18.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    77.190.18.2.in-addr.arpa

  • 8.8.8.8:53
    243.76.109.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    243.76.109.52.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    93.65.42.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    93.65.42.20.in-addr.arpa

  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    200.163.202.172.in-addr.arpa
    dns
    74 B
     160 B
     1
    1

    DNS Request

    200.163.202.172.in-addr.arpa

  • 8.8.8.8:53
    241.42.69.40.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    241.42.69.40.in-addr.arpa

  • 8.8.8.8:53
    220.190.18.2.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    220.190.18.2.in-addr.arpa

  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    81.144.22.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    81.144.22.2.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
    Filesize

    1KB

    MD5

    5c182267e03d733185f0438bc37fd333

    SHA1

    03c9d97a8bc07ee4510774aae7f238455398bf1b

    SHA256

    2a897285294b575713fd6cbf2636ecb1eea2f33395aa4af0fd166d7f45f69d3f

    SHA512

    4605ee00f70cc7030550eba7eb05694680d935881d3b6f8bb169828158a4f3f08c11f47e419c8f2fd38d0f6dcfefc53ae2b7dd7f53012b8b3a6984e5c4db1e8d

    Download Submit

  • memory/2840-19-0x00007FF978A10000-0x00007FF978C05000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2840-46-0x00007FF978AAD000-0x00007FF978AAE000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2840-10-0x00007FF978A10000-0x00007FF978C05000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2840-8-0x00007FF978A10000-0x00007FF978C05000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2840-16-0x00007FF978A10000-0x00007FF978C05000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2840-15-0x00007FF9362D0000-0x00007FF9362E0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2840-14-0x00007FF978A10000-0x00007FF978C05000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2840-13-0x00007FF978A10000-0x00007FF978C05000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2840-20-0x00007FF978A10000-0x00007FF978C05000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2840-21-0x00007FF978A10000-0x00007FF978C05000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2840-22-0x00007FF9362D0000-0x00007FF9362E0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2840-2-0x00007FF938A90000-0x00007FF938AA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2840-4-0x00007FF938A90000-0x00007FF938AA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2840-18-0x00007FF978A10000-0x00007FF978C05000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2840-6-0x00007FF978A10000-0x00007FF978C05000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2840-11-0x00007FF978A10000-0x00007FF978C05000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2840-9-0x00007FF978A10000-0x00007FF978C05000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2840-7-0x00007FF978A10000-0x00007FF978C05000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2840-12-0x00007FF978A10000-0x00007FF978C05000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2840-3-0x00007FF938A90000-0x00007FF938AA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2840-1-0x00007FF938A90000-0x00007FF938AA0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2840-0-0x00007FF978AAD000-0x00007FF978AAE000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2840-17-0x00007FF978A10000-0x00007FF978C05000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2840-47-0x00007FF978A10000-0x00007FF978C05000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2840-48-0x00007FF978A10000-0x00007FF978C05000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/2840-5-0x00007FF938A90000-0x00007FF938AA0000-memory.dmp

    Filesize

    64KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.