Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    112s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    11/07/2020, 07:24

General

  • Target

    figure.07.08.20.doc

  • Size

    134KB

  • MD5

    d830dff1af4844d03914d53c388902a6

  • SHA1

    d67e8ab969d141a527238cd6a369f90b0136d92d

  • SHA256

    ccf950c9869d1bf9882478bb2a8bbf9b65c21eb0e0c8d851c4bdda3232b40c11

  • SHA512

    ae6e0940b36883f94ec03746d22b596a0e4d3121f0adbf9c620b287aa2d8049dda49a3a82781a6ae0a434d2d1d52e2d4ef35fbe9012e407a570ec8c167f374b9

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of WriteProcessMemory 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\figure.07.08.20.doc"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1124
    • C:\Windows\system32\regsvr32.exe
      regsvr32 c:\programdata\26785.jpg
      2⤵
      • Process spawned unexpected child process
      • Suspicious behavior: GetForegroundWindowSpam
      PID:1112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1124-4-0x0000000007050000-0x0000000007250000-memory.dmp

    Filesize

    2.0MB