Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    129s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250313-en
  • resource tags

    arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15/03/2025, 20:55

General

  • Target

    FilenameDesirable/Mask.xll

  • Size

    51KB

  • MD5

    63230584f42d7cb40c9741c18fe0d4be

  • SHA1

    a7b89c752e59c7d610c39c42ecb7ae510aec56e6

  • SHA256

    b4cdd291699df575c017a8b5f01f7e51f21abe9ab33a2dabd4cdee241d3ffa29

  • SHA512

    d2f9237f003d9f38d8113d952c04b7a998a18ae34295b386509f3dd86b01a809ed1556a2f2b30bfa0c10e6464e8ec2d02a71cdc6db038e9e2d61c5df498f7de8

  • SSDEEP

    1536:DhKHkaRPmTLBBOr3fBVPDUoo2LeRy7/xZL:DYka4f70PzSRID

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\FilenameDesirable\Mask.xll"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2984

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2984-0-0x00007FFA92270000-0x00007FFA92280000-memory.dmp

    Filesize

    64KB

  • memory/2984-2-0x00007FFA92270000-0x00007FFA92280000-memory.dmp

    Filesize

    64KB

  • memory/2984-3-0x00007FFAD2283000-0x00007FFAD2284000-memory.dmp

    Filesize

    4KB

  • memory/2984-1-0x00007FFA92270000-0x00007FFA92280000-memory.dmp

    Filesize

    64KB

  • memory/2984-5-0x00007FFA92270000-0x00007FFA92280000-memory.dmp

    Filesize

    64KB

  • memory/2984-6-0x00007FFAD21E0000-0x00007FFAD23E9000-memory.dmp

    Filesize

    2.0MB

  • memory/2984-4-0x00007FFAD21E0000-0x00007FFAD23E9000-memory.dmp

    Filesize

    2.0MB

  • memory/2984-7-0x00007FFA92270000-0x00007FFA92280000-memory.dmp

    Filesize

    64KB

  • memory/2984-10-0x00007FFAD21E0000-0x00007FFAD23E9000-memory.dmp

    Filesize

    2.0MB

  • memory/2984-9-0x00007FFAD21E0000-0x00007FFAD23E9000-memory.dmp

    Filesize

    2.0MB

  • memory/2984-11-0x00007FFAD21E0000-0x00007FFAD23E9000-memory.dmp

    Filesize

    2.0MB

  • memory/2984-12-0x00007FFA8F7F0000-0x00007FFA8F800000-memory.dmp

    Filesize

    64KB

  • memory/2984-8-0x00007FFAD21E0000-0x00007FFAD23E9000-memory.dmp

    Filesize

    2.0MB

  • memory/2984-13-0x00007FFA8F7F0000-0x00007FFA8F800000-memory.dmp

    Filesize

    64KB

  • memory/2984-15-0x00007FFAD21E0000-0x00007FFAD23E9000-memory.dmp

    Filesize

    2.0MB

  • memory/2984-16-0x00007FFAD21E0000-0x00007FFAD23E9000-memory.dmp

    Filesize

    2.0MB

  • memory/2984-17-0x00007FFAD21E0000-0x00007FFAD23E9000-memory.dmp

    Filesize

    2.0MB