Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    162s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    30/01/2022, 16:07

General

  • Target

    1cb726eab6f36af73e6b0ed97223d8f063f8209d2c25bed39f010b4043b2b8a1.doc

  • Size

    426KB

  • MD5

    b3f8eee133ae385d9c7655aae033ca3e

  • SHA1

    d5186e2c17ef6a86aea3020e3bf7799af2e719b8

  • SHA256

    1cb726eab6f36af73e6b0ed97223d8f063f8209d2c25bed39f010b4043b2b8a1

  • SHA512

    256c3fe106171cfb6eba63913f7ce1d89b15c579647d839706d59f4dc47bbc22aa17b33aef35edc5f3dce9dc6f101c3848d74661d217378b73761adbfc9b06e3

Score
10/10

Malware Config

Signatures

  • CrimsonRAT Main Payload 3 IoCs
  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1cb726eab6f36af73e6b0ed97223d8f063f8209d2c25bed39f010b4043b2b8a1.doc"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1700
    • C:\ProgramData\DeIA-WIR\ulhtagnias.exe
      C:\ProgramData\DeIA-WIR\ulhtagnias.exe
      2⤵
      • Executes dropped EXE
      PID:1784

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1700-66-0x0000000000430000-0x00000000004F0000-memory.dmp

    Filesize

    768KB

  • memory/1700-65-0x0000000000430000-0x00000000004F0000-memory.dmp

    Filesize

    768KB

  • memory/1700-59-0x0000000000430000-0x00000000004F0000-memory.dmp

    Filesize

    768KB

  • memory/1700-61-0x0000000005710000-0x000000000635A000-memory.dmp

    Filesize

    12.3MB

  • memory/1700-62-0x0000000000430000-0x00000000004F0000-memory.dmp

    Filesize

    768KB

  • memory/1700-63-0x0000000000430000-0x00000000004F0000-memory.dmp

    Filesize

    768KB

  • memory/1700-64-0x0000000000430000-0x00000000004F0000-memory.dmp

    Filesize

    768KB

  • memory/1700-55-0x0000000072811000-0x0000000072814000-memory.dmp

    Filesize

    12KB

  • memory/1700-67-0x0000000000430000-0x00000000004F0000-memory.dmp

    Filesize

    768KB

  • memory/1700-60-0x0000000000430000-0x00000000004F0000-memory.dmp

    Filesize

    768KB

  • memory/1700-68-0x0000000000430000-0x00000000004F0000-memory.dmp

    Filesize

    768KB

  • memory/1700-72-0x0000000000430000-0x00000000004F0000-memory.dmp

    Filesize

    768KB

  • memory/1700-73-0x0000000000430000-0x00000000004F0000-memory.dmp

    Filesize

    768KB

  • memory/1700-58-0x0000000075F91000-0x0000000075F93000-memory.dmp

    Filesize

    8KB

  • memory/1700-57-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1700-56-0x0000000070291000-0x0000000070293000-memory.dmp

    Filesize

    8KB

  • memory/1784-81-0x0000000000810000-0x0000000000812000-memory.dmp

    Filesize

    8KB

  • memory/1784-80-0x000007FEF2840000-0x000007FEF38D6000-memory.dmp

    Filesize

    16.6MB

  • memory/1784-82-0x0000000000816000-0x0000000000835000-memory.dmp

    Filesize

    124KB