Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    111s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    29/10/2022, 06:00

General

  • Target

    6192b87a032cd70ef066afce058dc03bb4f4dd5cfbe731cb6d478b5cf3525507.doc

  • Size

    43KB

  • MD5

    73b7754d64f6601eb7e3443830c0d470

  • SHA1

    a28cc4624951e69d0da67be003559eab960d712c

  • SHA256

    6192b87a032cd70ef066afce058dc03bb4f4dd5cfbe731cb6d478b5cf3525507

  • SHA512

    f351b7d72e485655d46abbfad9d2d8a7a5c502b49f0a8960e015e323d055de0d9c12afb9987f001eaf47bb0dede228c0b4c2d00a0557a345005a7189c2d241e0

  • SSDEEP

    768:nmK7NqUO2M+6pA+BkSfKVedEx3U7xJrRU5M:mKRa2D+B0eDrq5

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\6192b87a032cd70ef066afce058dc03bb4f4dd5cfbe731cb6d478b5cf3525507.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2008

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1056-61-0x00000000006B3000-0x00000000006B7000-memory.dmp

      Filesize

      16KB

    • memory/1056-55-0x0000000070861000-0x0000000070863000-memory.dmp

      Filesize

      8KB

    • memory/1056-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1056-57-0x000000007184D000-0x0000000071858000-memory.dmp

      Filesize

      44KB

    • memory/1056-58-0x0000000075A71000-0x0000000075A73000-memory.dmp

      Filesize

      8KB

    • memory/1056-59-0x00000000006B3000-0x00000000006B7000-memory.dmp

      Filesize

      16KB

    • memory/1056-54-0x0000000072DE1000-0x0000000072DE4000-memory.dmp

      Filesize

      12KB

    • memory/1056-60-0x00000000006B3000-0x00000000006B7000-memory.dmp

      Filesize

      16KB

    • memory/1056-62-0x000000007184D000-0x0000000071858000-memory.dmp

      Filesize

      44KB

    • memory/1056-65-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1056-66-0x000000007184D000-0x0000000071858000-memory.dmp

      Filesize

      44KB

    • memory/2008-64-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp

      Filesize

      8KB