Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
134s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
11/07/2020, 07:17
Static task
static1
Behavioral task
behavioral1
Sample
docs-07.20.doc
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
docs-07.20.doc
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
docs-07.20.doc
-
Size
147KB
-
MD5
7dd79ba56b7ec464e9b515d900f3f569
-
SHA1
6c2bf5092ce30405ee4b7a349d9fe533045c6b4a
-
SHA256
ca822b28a868bb52c0e59bf09093cf38dedb0a09c82718d3979980f13c02d1b9
-
SHA512
b0974074f16bd77a59d4d36faa671998eb245d43e4ac966a4eeea53840b03385cdba5ec5780829fcd85d4360743c4429e1d55d2aeae3cbb52786ea8ff9afe494
Score
10/10
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 19 IoCs
pid Process 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE 2804 WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2804 WINWORD.EXE 2804 WINWORD.EXE -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 1488 2804 regsvr32.exe 65 -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2804 wrote to memory of 1488 2804 WINWORD.EXE 72 PID 2804 wrote to memory of 1488 2804 WINWORD.EXE 72 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\docs-07.20.doc" /o ""1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of WriteProcessMemory
- Checks processor information in registry
- Enumerates system info in registry
PID:2804 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" kG.tmp2⤵
- Process spawned unexpected child process
PID:1488
-