Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
13s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
04/03/2021, 20:07
Static task
static1
Behavioral task
behavioral1
Sample
OfficeDocument.exe
Resource
win7v20201028
0 signatures
0 seconds
General
-
Target
OfficeDocument.exe
-
Size
279KB
-
MD5
b04e5c4ad1bc75a4a0cd5686e869acdb
-
SHA1
8a8fadeb752362fb265baa83f690bc4250556d33
-
SHA256
0e735a5773b8aa36e2a596ea6e468d75038db7dd644236b4eb745b66762f4ebf
-
SHA512
c06212a009af916a8dd707eca6d1e24cf28ce6b8726b51663562cbf1598138aef5d02b13c3ba2ad5c56940ddb47558224d6d7aa752347e0321267791e7141cfa
Malware Config
Extracted
Family
buer
C2
grandbanking-api.com
Signatures
-
Buer Loader 1 IoCs
Detects Buer loader in memory or disk.
resource yara_rule behavioral1/memory/1276-5-0x0000000040000000-0x0000000040009000-memory.dmp buer -
Loads dropped DLL 1 IoCs
pid Process 324 OfficeDocument.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 324 set thread context of 1276 324 OfficeDocument.exe 29 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 324 OfficeDocument.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 324 wrote to memory of 1276 324 OfficeDocument.exe 29 PID 324 wrote to memory of 1276 324 OfficeDocument.exe 29 PID 324 wrote to memory of 1276 324 OfficeDocument.exe 29 PID 324 wrote to memory of 1276 324 OfficeDocument.exe 29 PID 324 wrote to memory of 1276 324 OfficeDocument.exe 29 PID 324 wrote to memory of 1276 324 OfficeDocument.exe 29 PID 324 wrote to memory of 1276 324 OfficeDocument.exe 29 PID 324 wrote to memory of 1276 324 OfficeDocument.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\OfficeDocument.exe"C:\Users\Admin\AppData\Local\Temp\OfficeDocument.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Users\Admin\AppData\Local\Temp\OfficeDocument.exe"C:\Users\Admin\AppData\Local\Temp\OfficeDocument.exe"2⤵PID:1276
-