Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
136s -
platform
windows10_x64 -
resource
win10 -
submitted
11/07/2020, 07:17
General
-
Target
contratto di propriet.07.20.doc
-
Size
147KB
-
MD5
2cf9a57324fd4fe06e23a155dea5a2db
-
SHA1
47acf7215247e7c2e9f75e4f30918d0758bee906
-
SHA256
1d298c323e5103aa4872d5b31f84db2e91dd13c6d3378813d222cdcf98bfb05a
-
SHA512
4217c135854131f7cfe6974fa62559dae2c75b76e3423ec118628abe51248b3e267a4852cdeee7790e68fc82871e00efc1b471db3fb734cdf1e59f1dc9d1cb1c
Score
10/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 19 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\contratto di propriet.07.20.doc" /o ""1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" Qo.tmp2⤵
- Process spawned unexpected child process
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
-
Filesize
76KB
-
Filesize
76KB
-
Filesize
20KB