Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3Bootstrapper.exe
windows11-21h2-x64
10$TEMP/Bc.xll
windows11-21h2-x64
1$TEMP/Fat.xll
windows11-21h2-x64
1$TEMP/Maternity.xll
windows11-21h2-x64
1$TEMP/Pairs.xll
windows11-21h2-x64
1$TEMP/Picking.xll
windows11-21h2-x64
1FilenameDe...er.xll
windows11-21h2-x64
1FilenameDe...er.xll
windows11-21h2-x64
1FilenameDe...st.xll
windows11-21h2-x64
1FilenameDe...ce.xll
windows11-21h2-x64
1FilenameDe...sk.xll
windows11-21h2-x64
1FilenameDe...ee.xll
windows11-21h2-x64
1Analysis
-
max time kernel
133s -
max time network
129s -
platform
windows11-21h2_x64 -
resource
win11-20250313-en -
resource tags
arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system -
submitted
15/03/2025, 20:55
Static task
static1
Behavioral task
behavioral1
Sample
Bootstrapper.exe
Resource
win11-20250314-en
Behavioral task
behavioral2
Sample
$TEMP/Bc.xll
Resource
win11-20250313-en
Behavioral task
behavioral3
Sample
$TEMP/Fat.xll
Resource
win11-20250314-en
Behavioral task
behavioral4
Sample
$TEMP/Maternity.xll
Resource
win11-20250313-en
Behavioral task
behavioral5
Sample
$TEMP/Pairs.xll
Resource
win11-20250313-en
Behavioral task
behavioral6
Sample
$TEMP/Picking.xll
Resource
win11-20250314-en
Behavioral task
behavioral7
Sample
FilenameDesirable/Gather.xll
Resource
win11-20250313-en
Behavioral task
behavioral8
Sample
FilenameDesirable/Greater.xll
Resource
win11-20250313-en
Behavioral task
behavioral9
Sample
FilenameDesirable/Harvest.xll
Resource
win11-20250313-en
Behavioral task
behavioral10
Sample
FilenameDesirable/Hence.xll
Resource
win11-20250313-en
Behavioral task
behavioral11
Sample
FilenameDesirable/Mask.xll
Resource
win11-20250313-en
Behavioral task
behavioral12
Sample
FilenameDesirable/Subcommittee.xll
Resource
win11-20250314-en
General
-
Target
FilenameDesirable/Mask.xll
-
Size
51KB
-
MD5
63230584f42d7cb40c9741c18fe0d4be
-
SHA1
a7b89c752e59c7d610c39c42ecb7ae510aec56e6
-
SHA256
b4cdd291699df575c017a8b5f01f7e51f21abe9ab33a2dabd4cdee241d3ffa29
-
SHA512
d2f9237f003d9f38d8113d952c04b7a998a18ae34295b386509f3dd86b01a809ed1556a2f2b30bfa0c10e6464e8ec2d02a71cdc6db038e9e2d61c5df498f7de8
-
SSDEEP
1536:DhKHkaRPmTLBBOr3fBVPDUoo2LeRy7/xZL:DYka4f70PzSRID
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2984 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 2984 EXCEL.EXE 2984 EXCEL.EXE 2984 EXCEL.EXE 2984 EXCEL.EXE 2984 EXCEL.EXE 2984 EXCEL.EXE 2984 EXCEL.EXE 2984 EXCEL.EXE 2984 EXCEL.EXE 2984 EXCEL.EXE 2984 EXCEL.EXE 2984 EXCEL.EXE 2984 EXCEL.EXE 2984 EXCEL.EXE 2984 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\FilenameDesirable\Mask.xll"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2984