Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    105s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    27/10/2022, 13:19

General

  • Target

    SecuriteInfo.com.Trojan.GenericKD.62782271.5004.30641.xlsx

  • Size

    631KB

  • MD5

    f0fed0bcc4b919af95a70f7a5e605224

  • SHA1

    4fd73fe3f12d348a03cef90e382966d0562073a3

  • SHA256

    2c05644ade42219257242af1c0299cda243750efac7f59310a07983a04576fd1

  • SHA512

    fdec034b005266902d64820daef469b8a992660ac62d880db36e016d9799927179c8afc12254ed1eb0fb25aaf872ac933486f5757308a9a98b696797d05fbf88

  • SSDEEP

    12288:JMr6aFArJBGuBuHab/rajrt+AzGHOsiACOhu4SQrJeKOCKSZe0C:iJFAFwuBuomdzYeHOhu4nJeBXSU0C

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.62782271.5004.30641.xlsx
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1128

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1128-54-0x000000002F8B1000-0x000000002F8B4000-memory.dmp

    Filesize

    12KB

  • memory/1128-55-0x0000000071AB1000-0x0000000071AB3000-memory.dmp

    Filesize

    8KB

  • memory/1128-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1128-57-0x0000000072A9D000-0x0000000072AA8000-memory.dmp

    Filesize

    44KB

  • memory/1128-58-0x00000000762E1000-0x00000000762E3000-memory.dmp

    Filesize

    8KB

  • memory/1128-59-0x0000000072A9D000-0x0000000072AA8000-memory.dmp

    Filesize

    44KB

  • memory/1128-60-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1128-61-0x0000000072A9D000-0x0000000072AA8000-memory.dmp

    Filesize

    44KB