Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    71s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07/09/2022, 13:59

General

  • Target

    baddoc.doc

  • Size

    1.5MB

  • MD5

    0c4540f659d3942a28f158bce7be1143

  • SHA1

    d1cc0f861f162dfbf9df1493fe861d02b80483f6

  • SHA256

    37e259d6564071807b7b4266ed1dd8bf2059f3e7f438b8487dd0149e5e0487ec

  • SHA512

    9b611fe0d00cc08bfa72cb7723af64f29b58e4db68d32ca07effa8e90fb7c8fd46a3a48b8b00d1e1dba09b4514bfb3c447ea59da5b4ac90797728cffa03313b0

  • SSDEEP

    24576:WcuQXAlhOOZQ3XkaL17MlNuoQPc2V5TBDR4AtPe1LFGZ2KaO+79Gh8B:z53ClNADSDB7A8B

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\baddoc.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1752
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Roaming\Microsoft\Windows\yandex.exe
      2⤵
      • Process spawned unexpected child process
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:468
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\yandex.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\yandex.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:1524
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Microsoft Word Documents.docx"
      2⤵
        PID:1652

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\WINHTTP.dll

      Filesize

      690KB

      MD5

      dfaa28a53310a43031e406ff927a6866

      SHA1

      c694e99f8690114c77a6099856d61a3cd4cd814d

      SHA256

      4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573

      SHA512

      9a3a958481264b8c3730c018828a498fd1ed8b594df71dff4ad946938ad82d8ebde741e4080d15555c1933bed414500d935491e866c8d445947e1b37877f2f9b

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\yandex.exe

      Filesize

      361KB

      MD5

      89928e2b55c9ee0c021fcb2f1acf3ac0

      SHA1

      96810e911124a1ffaf717bc1c06d8dea07d69bf6

      SHA256

      9c0291f1a68009dde56a66d6856eeff15ecbc5bd89460399238b59408d972e0c

      SHA512

      ca334377cb5e8edaea91c30216fc71c0d393f096f42be97d828d217e4d6bdd6fe7bc61542571226518dbf218f1478136863dc0509d8de5986ee7fd355313ae83

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\yandex.exe

      Filesize

      361KB

      MD5

      89928e2b55c9ee0c021fcb2f1acf3ac0

      SHA1

      96810e911124a1ffaf717bc1c06d8dea07d69bf6

      SHA256

      9c0291f1a68009dde56a66d6856eeff15ecbc5bd89460399238b59408d972e0c

      SHA512

      ca334377cb5e8edaea91c30216fc71c0d393f096f42be97d828d217e4d6bdd6fe7bc61542571226518dbf218f1478136863dc0509d8de5986ee7fd355313ae83

    • \Users\Admin\AppData\Roaming\Microsoft\Windows\WINHTTP.dll

      Filesize

      690KB

      MD5

      dfaa28a53310a43031e406ff927a6866

      SHA1

      c694e99f8690114c77a6099856d61a3cd4cd814d

      SHA256

      4a5e9ab0e65e08ceb2adb2d150abb620684e98d79483b6c9f786c56c95fea573

      SHA512

      9a3a958481264b8c3730c018828a498fd1ed8b594df71dff4ad946938ad82d8ebde741e4080d15555c1933bed414500d935491e866c8d445947e1b37877f2f9b

    • \Users\Admin\AppData\Roaming\Microsoft\Windows\yandex.exe

      Filesize

      361KB

      MD5

      89928e2b55c9ee0c021fcb2f1acf3ac0

      SHA1

      96810e911124a1ffaf717bc1c06d8dea07d69bf6

      SHA256

      9c0291f1a68009dde56a66d6856eeff15ecbc5bd89460399238b59408d972e0c

      SHA512

      ca334377cb5e8edaea91c30216fc71c0d393f096f42be97d828d217e4d6bdd6fe7bc61542571226518dbf218f1478136863dc0509d8de5986ee7fd355313ae83

    • memory/1524-88-0x000000006AC70000-0x000000006AD29000-memory.dmp

      Filesize

      740KB

    • memory/1524-83-0x000000006AC70000-0x000000006AD29000-memory.dmp

      Filesize

      740KB

    • memory/1752-62-0x00000000007AC000-0x00000000007B0000-memory.dmp

      Filesize

      16KB

    • memory/1752-63-0x00000000007AC000-0x00000000007B0000-memory.dmp

      Filesize

      16KB

    • memory/1752-66-0x00000000007AC000-0x00000000007B0000-memory.dmp

      Filesize

      16KB

    • memory/1752-67-0x00000000007AC000-0x00000000007B0000-memory.dmp

      Filesize

      16KB

    • memory/1752-68-0x00000000007AC000-0x00000000007B0000-memory.dmp

      Filesize

      16KB

    • memory/1752-69-0x00000000007AC000-0x00000000007B0000-memory.dmp

      Filesize

      16KB

    • memory/1752-70-0x00000000007AC000-0x00000000007B0000-memory.dmp

      Filesize

      16KB

    • memory/1752-71-0x00000000007AC000-0x00000000007B0000-memory.dmp

      Filesize

      16KB

    • memory/1752-72-0x00000000007AC000-0x00000000007B0000-memory.dmp

      Filesize

      16KB

    • memory/1752-73-0x00000000007AC000-0x00000000007B0000-memory.dmp

      Filesize

      16KB

    • memory/1752-74-0x00000000007AC000-0x00000000007B0000-memory.dmp

      Filesize

      16KB

    • memory/1752-65-0x00000000007AC000-0x00000000007B0000-memory.dmp

      Filesize

      16KB

    • memory/1752-64-0x00000000007AC000-0x00000000007B0000-memory.dmp

      Filesize

      16KB

    • memory/1752-54-0x0000000072C71000-0x0000000072C74000-memory.dmp

      Filesize

      12KB

    • memory/1752-61-0x00000000007AC000-0x00000000007B0000-memory.dmp

      Filesize

      16KB

    • memory/1752-60-0x00000000007AC000-0x00000000007B0000-memory.dmp

      Filesize

      16KB

    • memory/1752-59-0x00000000007AC000-0x00000000007B0000-memory.dmp

      Filesize

      16KB

    • memory/1752-58-0x00000000716DD000-0x00000000716E8000-memory.dmp

      Filesize

      44KB

    • memory/1752-57-0x0000000076261000-0x0000000076263000-memory.dmp

      Filesize

      8KB

    • memory/1752-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1752-87-0x00000000716DD000-0x00000000716E8000-memory.dmp

      Filesize

      44KB

    • memory/1752-55-0x00000000706F1000-0x00000000706F3000-memory.dmp

      Filesize

      8KB