Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    104s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    01/07/2022, 06:52 UTC

General

  • Target

    954aea6dfdc84a1fc4ae0ec1aba073c2d25e84587348c7df8abd77dbfee0b0a1.docm

  • Size

    123KB

  • MD5

    e6cdf2ab43cec436a8e63c1bcebdc68f

  • SHA1

    4e5fede8de660098fd33beb4f65cf9af36fcf0d2

  • SHA256

    954aea6dfdc84a1fc4ae0ec1aba073c2d25e84587348c7df8abd77dbfee0b0a1

  • SHA512

    b41003a39eb45f1261fe8bb758c672e408e4aa65db84b9138ae5608be731246dc66795d74ba6f6e5f0866d8bd7ec37fb62825968798659ad649b1a5dca68074e

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\954aea6dfdc84a1fc4ae0ec1aba073c2d25e84587348c7df8abd77dbfee0b0a1.docm"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1624
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\0.7055475.jse"
      2⤵
      • Process spawned unexpected child process
      PID:1168
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:472

    Network

    • flag-us
      DNS
      hospital.payrahousingltd.com
      WScript.exe
      Remote address:
      8.8.8.8:53
      Request
      hospital.payrahousingltd.com
      IN A
      Response
    No results found
    • 8.8.8.8:53
      hospital.payrahousingltd.com
      dns
      WScript.exe
      74 B
      147 B
      1
      1

      DNS Request

      hospital.payrahousingltd.com

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\0.7055475.jse

      Filesize

      29KB

      MD5

      428bb5eb41277bf98dca217eb4fdcf6a

      SHA1

      d74c30a2be4279392f9f16b6ee5e2335372e3742

      SHA256

      ca3ffca140fbc0ad5a01150f8e84e48aa07cd1547146bd987a3672c394f701ec

      SHA512

      c7f373efd3b1dc6e82c19a7a70abb9d7da089f7f7c8d07d311b3d571f64b565cdac2dabd95c8c207519344db9e90bb770f7bac1cdf375eeaafe059385c3167ae

    • memory/472-98-0x000007FEFB6B1000-0x000007FEFB6B3000-memory.dmp

      Filesize

      8KB

    • memory/1624-76-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-80-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-65-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-63-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-62-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-61-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-60-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-59-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-66-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-67-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-69-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-68-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-71-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-70-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-72-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-74-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-73-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-79-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-54-0x0000000072251000-0x0000000072254000-memory.dmp

      Filesize

      12KB

    • memory/1624-77-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-64-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-78-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-75-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-81-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-82-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-84-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-83-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-86-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-85-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-87-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-88-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-90-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-89-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-91-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-92-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-93-0x00000000007D3000-0x00000000007D7000-memory.dmp

      Filesize

      16KB

    • memory/1624-58-0x0000000070CBD000-0x0000000070CC8000-memory.dmp

      Filesize

      44KB

    • memory/1624-57-0x0000000075C71000-0x0000000075C73000-memory.dmp

      Filesize

      8KB

    • memory/1624-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1624-55-0x000000006FCD1000-0x000000006FCD3000-memory.dmp

      Filesize

      8KB

    • memory/1624-99-0x0000000070CBD000-0x0000000070CC8000-memory.dmp

      Filesize

      44KB

    • memory/1624-100-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1624-101-0x0000000070CBD000-0x0000000070CC8000-memory.dmp

      Filesize

      44KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.