Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
60s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
11/07/2020, 07:17
General
-
Target
contratto di propriet.07.20.doc
-
Size
147KB
-
MD5
2cf9a57324fd4fe06e23a155dea5a2db
-
SHA1
47acf7215247e7c2e9f75e4f30918d0758bee906
-
SHA256
1d298c323e5103aa4872d5b31f84db2e91dd13c6d3378813d222cdcf98bfb05a
-
SHA512
4217c135854131f7cfe6974fa62559dae2c75b76e3423ec118628abe51248b3e267a4852cdeee7790e68fc82871e00efc1b471db3fb734cdf1e59f1dc9d1cb1c
Score
10/10
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Suspicious use of WriteProcessMemory 5 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\contratto di propriet.07.20.doc"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" Qo.tmp2⤵
- Process spawned unexpected child process
- Suspicious behavior: GetForegroundWindowSpam
-