Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
18s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
09/07/2020, 15:07
General
-
Target
525e790f37cf273bde111e74f58d80647a0dba23ed706550a162d7fc49a97997(1).doc
-
Size
147KB
-
MD5
0b486db36068513a35aff302398ac452
-
SHA1
35b3dbd4ee63b8f17f94905a7470fe1dec7ab14d
-
SHA256
525e790f37cf273bde111e74f58d80647a0dba23ed706550a162d7fc49a97997
-
SHA512
51e2ebdebf9faa3a78a6f28eabb0a3d6abe43add7b9b9e890165166e1fb6bed432ee50f1891f6e3c5eeb92bc5e0ef6157671f1b68a1a7d7a9fa1350496b71367
Score
10/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Suspicious use of WriteProcessMemory 5 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\525e790f37cf273bde111e74f58d80647a0dba23ed706550a162d7fc49a97997(1).doc"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" ww.tmp2⤵
- Process spawned unexpected child process
- Suspicious behavior: GetForegroundWindowSpam
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
-
Filesize
16KB