Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    112s
  • max time network
    51s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    30/10/2022, 08:37

General

  • Target

    b459325337c50de0e30d36df68b732b9884f40ca415ed047d9d4aa42e76a0a4f.doc

  • Size

    152KB

  • MD5

    93b1f362c613151318174a9040cfa320

  • SHA1

    36828fc0887185959f45686e494be75ece9a5f81

  • SHA256

    b459325337c50de0e30d36df68b732b9884f40ca415ed047d9d4aa42e76a0a4f

  • SHA512

    2f10cfac68febf7794086bfece37c2e07552ba1cb214a45b1c4dfd1b6565041810f945cba7d6cef11491226c1b636c906c225a68b5ab35b3565745ee395cb68b

  • SSDEEP

    3072:ctpWX413u5DsFQvg2HcSVDEL5EpKqZJZO2nw1j/cgrtx:cbWoRu5DMQ4EcN5OK2JznwZ0ytx

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\b459325337c50de0e30d36df68b732b9884f40ca415ed047d9d4aa42e76a0a4f.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1528

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1204-54-0x0000000072231000-0x0000000072234000-memory.dmp

      Filesize

      12KB

    • memory/1204-55-0x000000006FCB1000-0x000000006FCB3000-memory.dmp

      Filesize

      8KB

    • memory/1204-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1204-57-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

      Filesize

      8KB

    • memory/1204-58-0x0000000070C9D000-0x0000000070CA8000-memory.dmp

      Filesize

      44KB

    • memory/1204-59-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-60-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-61-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-62-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-63-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-64-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-65-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-66-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-67-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-68-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-69-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-70-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-71-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-72-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-73-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-74-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-75-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-76-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-77-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-78-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-80-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-79-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-82-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-81-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-85-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-86-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-84-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-83-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-89-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-90-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-88-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-87-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-92-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-91-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-95-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-94-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-93-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-97-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-96-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-98-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-99-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-100-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-103-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-104-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-102-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-101-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-107-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-108-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-106-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-105-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-110-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-109-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-113-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-114-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-112-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-111-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-115-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-116-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-117-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-118-0x00000000003DC000-0x00000000003E0000-memory.dmp

      Filesize

      16KB

    • memory/1204-156-0x0000000070C9D000-0x0000000070CA8000-memory.dmp

      Filesize

      44KB

    • memory/1204-160-0x0000000070C9D000-0x0000000070CA8000-memory.dmp

      Filesize

      44KB