Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14/01/2025, 05:40
General
-
Target
RFQ # PC25-1301.xlsx
-
Size
1.8MB
-
MD5
0792874afc518221f07574f95f43f5ef
-
SHA1
a4d7f0552e1fff852db8b27e1409bdbf4bc46244
-
SHA256
161e3b6200af955772e00be88646b3c6332faca2e9867eedd9c41cc5a1b62876
-
SHA512
67896688ea410a2af33d3936dbf913e6b1941f826dc40cbe1bf29f96a0b8dc4b1595f7d1e74738de2bc891006f3327616a7f607d0adc077d62ac4a380f3e1d5b
-
SSDEEP
49152:kTiDS2iZYJTg+uFfcdD+3GkdQFzhccnYmmAQd2:kmugO+6fV3GkdQdnhR
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\RFQ # PC25-1301.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5c17e681e3d4b54369fffcce56473bc75
SHA13fdf5ec2589fdcc2203fc56676edfd5232b6fcc0
SHA256f1575feb4bf7ccfc023879057dc5db9022be6c5678b3feead360c8f6e38d6e2c
SHA5126eb5392cc04c144bb43e8ded5aac478724df830ba5a758a05ba55cb4c5b1735623ac293c999a18edb2c105c2ea9125ccb939d1d5276011a89c32c33737f3f8fe
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB