Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    103s
  • max time network
    20s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    14/07/2020, 14:32

General

  • Target

    14e5fd44d43f96426d7499e41626560e.xls

  • Size

    515KB

  • MD5

    14e5fd44d43f96426d7499e41626560e

  • SHA1

    53c22aeecd280d71ff69d91ddaf967c36e449db9

  • SHA256

    df28f2ba0fd1e2a5acee743c36a04155abfb0229c743b180cb39403ded922772

  • SHA512

    41a060ecba5406e0dcef629c444016462f1f5d21e44fee462ef6c81ce014f34396293da6584863c6f801dd5f9e8db5420b96af0c3728cd0055905ddcc47f16c1

Score
6/10

Malware Config

Signatures

  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Process spawned suspicious child process 1 IoCs

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Suspicious use of WriteProcessMemory 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\14e5fd44d43f96426d7499e41626560e.xls
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • Suspicious behavior: AddClipboardFormatListener
    PID:1124
    • C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE
      "C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE" -x -s 1156
      2⤵
      • Process spawned suspicious child process
      • Suspicious use of WriteProcessMemory
      PID:1448
      • C:\Windows\system32\dwwin.exe
        C:\Windows\system32\dwwin.exe -x -s 1156
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        PID:1464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1464-2-0x0000000001DE0000-0x0000000001DF1000-memory.dmp

    Filesize

    68KB

  • memory/1464-4-0x00000000021B0000-0x00000000021C1000-memory.dmp

    Filesize

    68KB