Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
36s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
11/07/2020, 07:23
Static task
static1
Behavioral task
behavioral1
Sample
statistica,07.08.20.doc
Resource
win7v200430
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
statistica,07.08.20.doc
Resource
win10
0 signatures
0 seconds
General
-
Target
statistica,07.08.20.doc
-
Size
134KB
-
MD5
e5a90bc8ee5cf5f57620fd0afcbbe9ab
-
SHA1
5cdaf6674a983440a4dd62a13750286a62279e1b
-
SHA256
51e234ae15e4d96c2077f57a5544aab335d75f7a301442c102eaf63351b48151
-
SHA512
b2c9e9b0d383bef435931d1bb9992f36e94fa87ab8c6878c47124004514787a7d2dce96befae63c2b9120c56cccd3492a6fb585506b38391c04392c551735ed2
Score
10/10
Malware Config
Signatures
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1864 regsvr32.exe -
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1520 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 1520 WINWORD.EXE 1520 WINWORD.EXE 1520 WINWORD.EXE 1520 WINWORD.EXE 1520 WINWORD.EXE 1520 WINWORD.EXE 1520 WINWORD.EXE 1520 WINWORD.EXE 1520 WINWORD.EXE 1520 WINWORD.EXE 1520 WINWORD.EXE 1520 WINWORD.EXE 1520 WINWORD.EXE 1520 WINWORD.EXE 1520 WINWORD.EXE 1520 WINWORD.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process 1864 1520 regsvr32.exe 23 -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1520 wrote to memory of 1864 1520 WINWORD.EXE 26 PID 1520 wrote to memory of 1864 1520 WINWORD.EXE 26 PID 1520 wrote to memory of 1864 1520 WINWORD.EXE 26 PID 1520 wrote to memory of 1864 1520 WINWORD.EXE 26 PID 1520 wrote to memory of 1864 1520 WINWORD.EXE 26
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\statistica,07.08.20.doc"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\system32\regsvr32.exeregsvr32 c:\programdata\64974.jpg2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Process spawned unexpected child process
PID:1864
-