Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    104s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    01/07/2022, 06:52

General

  • Target

    954aea6dfdc84a1fc4ae0ec1aba073c2d25e84587348c7df8abd77dbfee0b0a1.docm

  • Size

    123KB

  • MD5

    e6cdf2ab43cec436a8e63c1bcebdc68f

  • SHA1

    4e5fede8de660098fd33beb4f65cf9af36fcf0d2

  • SHA256

    954aea6dfdc84a1fc4ae0ec1aba073c2d25e84587348c7df8abd77dbfee0b0a1

  • SHA512

    b41003a39eb45f1261fe8bb758c672e408e4aa65db84b9138ae5608be731246dc66795d74ba6f6e5f0866d8bd7ec37fb62825968798659ad649b1a5dca68074e

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\954aea6dfdc84a1fc4ae0ec1aba073c2d25e84587348c7df8abd77dbfee0b0a1.docm"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1624
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\0.7055475.jse"
      2⤵
      • Process spawned unexpected child process
      PID:1168
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:472

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\0.7055475.jse

      Filesize

      29KB

      MD5

      428bb5eb41277bf98dca217eb4fdcf6a

      SHA1

      d74c30a2be4279392f9f16b6ee5e2335372e3742

      SHA256

      ca3ffca140fbc0ad5a01150f8e84e48aa07cd1547146bd987a3672c394f701ec

      SHA512

      c7f373efd3b1dc6e82c19a7a70abb9d7da089f7f7c8d07d311b3d571f64b565cdac2dabd95c8c207519344db9e90bb770f7bac1cdf375eeaafe059385c3167ae

    • memory/472-98-0x000007FEFB6B1000-0x000007FEFB6B3000-memory.dmp

      Filesize

      8KB

    • memory/1624-76-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-80-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-65-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-63-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-62-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-61-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-60-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-59-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-66-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-67-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-69-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-68-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-71-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-70-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-72-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-74-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-73-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-79-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-54-0x0000000072251000-0x0000000072254000-memory.dmp

      Filesize

      12KB

    • memory/1624-77-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-64-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-78-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-75-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-81-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-82-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-84-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-83-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-86-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-85-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-87-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-88-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-90-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-89-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-91-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-92-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-93-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-58-0x0000000070CBD000-0x0000000070CC8000-memory.dmp

      Filesize

      44KB

    • memory/1624-57-0x0000000075C71000-0x0000000075C73000-memory.dmp

      Filesize

      8KB

    • memory/1624-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1624-55-0x000000006FCD1000-0x000000006FCD3000-memory.dmp

      Filesize

      8KB

    • memory/1624-99-0x0000000070CBD000-0x0000000070CC8000-memory.dmp

      Filesize

      44KB

    • memory/1624-100-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1624-101-0x0000000070CBD000-0x0000000070CC8000-memory.dmp

      Filesize

      44KB