Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/01/2025, 11:47

General

  • Target

    RFQ # PC25-1301_1.xlsx

  • Size

    1.8MB

  • MD5

    d3f593571da9b55237a49f9c23a12d9a

  • SHA1

    b3c9a6ca51802326e7de5a6854199fc369bc3b08

  • SHA256

    ff07908a590dec7673c510ec4d0043d8825a54039e35b7c28c299f95c55336c3

  • SHA512

    114950c12cc9fd0aa50544caed8fa0f710cc596c67ec90d3b5d2e1a72c18b5706b25ef3030949805be0e90bab31d6010fe6b0d1ab090e0651b0254482e113df8

  • SSDEEP

    49152:OwVliPFnflCwADoUpbmepmSTKrks1l4FWQCMsx7/:Ow4dflKxpaepmS2rksiWQJsx7/

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\RFQ # PC25-1301_1.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4000

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    7fe74f7c0e75fd56a32a53a7aca360e6

    SHA1

    1635a3323a492800d7838edf320c0459fd45974d

    SHA256

    ace707fc1b4673bb384ab9f943bf7891bf84b7c39903815c371b72b5926f81eb

    SHA512

    4f0417b0b2a3ce7e6b511fef6aa53dcacb61dcb048e2802fd8dd9278df04db5bf44d793350bf4322d87b71e604fe2184ea7dbc609fbb2a565e1386ad867c2ac6

  • memory/4000-9-0x00007FFAE7050000-0x00007FFAE7245000-memory.dmp

    Filesize

    2.0MB

  • memory/4000-12-0x00007FFAE7050000-0x00007FFAE7245000-memory.dmp

    Filesize

    2.0MB

  • memory/4000-4-0x00007FFAA70D0000-0x00007FFAA70E0000-memory.dmp

    Filesize

    64KB

  • memory/4000-2-0x00007FFAA70D0000-0x00007FFAA70E0000-memory.dmp

    Filesize

    64KB

  • memory/4000-3-0x00007FFAA70D0000-0x00007FFAA70E0000-memory.dmp

    Filesize

    64KB

  • memory/4000-8-0x00007FFAE7050000-0x00007FFAE7245000-memory.dmp

    Filesize

    2.0MB

  • memory/4000-6-0x00007FFAE7050000-0x00007FFAE7245000-memory.dmp

    Filesize

    2.0MB

  • memory/4000-7-0x00007FFAE7050000-0x00007FFAE7245000-memory.dmp

    Filesize

    2.0MB

  • memory/4000-0-0x00007FFAE70ED000-0x00007FFAE70EE000-memory.dmp

    Filesize

    4KB

  • memory/4000-10-0x00007FFAE7050000-0x00007FFAE7245000-memory.dmp

    Filesize

    2.0MB

  • memory/4000-5-0x00007FFAA70D0000-0x00007FFAA70E0000-memory.dmp

    Filesize

    64KB

  • memory/4000-13-0x00007FFAE7050000-0x00007FFAE7245000-memory.dmp

    Filesize

    2.0MB

  • memory/4000-14-0x00007FFAA4F20000-0x00007FFAA4F30000-memory.dmp

    Filesize

    64KB

  • memory/4000-11-0x00007FFAE7050000-0x00007FFAE7245000-memory.dmp

    Filesize

    2.0MB

  • memory/4000-15-0x00007FFAA4F20000-0x00007FFAA4F30000-memory.dmp

    Filesize

    64KB

  • memory/4000-28-0x00007FFAE7050000-0x00007FFAE7245000-memory.dmp

    Filesize

    2.0MB

  • memory/4000-27-0x00007FFAE70ED000-0x00007FFAE70EE000-memory.dmp

    Filesize

    4KB

  • memory/4000-29-0x00007FFAE7050000-0x00007FFAE7245000-memory.dmp

    Filesize

    2.0MB

  • memory/4000-1-0x00007FFAA70D0000-0x00007FFAA70E0000-memory.dmp

    Filesize

    64KB