Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
1profession...os.exe
windows7-x64
1profession...os.exe
windows10-2004-x64
1profession...ap.exe
windows7-x64
7profession...ap.exe
windows10-2004-x64
7profession....0.exe
windows7-x64
1profession....0.exe
windows10-2004-x64
1profession...��.doc
windows7-x64
4profession...��.doc
windows10-2004-x64
1profession...��.doc
windows7-x64
4profession...��.doc
windows10-2004-x64
1profession...��.doc
windows7-x64
4profession...��.doc
windows10-2004-x64
1profession...��.doc
windows7-x64
4profession...��.doc
windows10-2004-x64
1profession...��.doc
windows7-x64
4profession...��.doc
windows10-2004-x64
1profession...��.doc
windows7-x64
4profession...��.doc
windows10-2004-x64
1profession...��.doc
windows7-x64
4profession...��.doc
windows10-2004-x64
1Analysis
-
max time kernel
107s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 05:09
Static task
static1
Behavioral task
behavioral1
Sample
professional/LanQos.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
professional/LanQos.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
professional/WinPcap.exe
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
professional/WinPcap.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
professional/ܹ/Sentinel Protection Installer 7.4.0.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
professional/ܹ/Sentinel Protection Installer 7.4.0.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
professional/ϵͳʹֲ.doc
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
professional/ϵͳʹֲ.doc
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
professional/ϵͳ.doc
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
professional/ϵͳ.doc
Resource
win10v2004-20220901-en
Behavioral task
behavioral11
Sample
professional/ϵͳܽ.doc
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
professional/ϵͳܽ.doc
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
professional/ϵͳ.doc
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
professional/ϵͳ.doc
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
professional/ϵͳۺ.doc
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
professional/ϵͳۺ.doc
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
professional/ϵͳ.doc
Resource
win7-20221111-en
Behavioral task
behavioral18
Sample
professional/ϵͳ.doc
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
professional/˾ԶЭ.doc
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
professional/˾ԶЭ.doc
Resource
win10v2004-20220901-en
General
-
Target
professional/ϵͳ.doc
-
Size
53KB
-
MD5
3765eec040986f41ffcc17f6ad407831
-
SHA1
746cfb1bb899cae8f0bf7338fb6a638d01e21615
-
SHA256
ff1d4caadc426d0f772ba7c8c5f0ddc8ce53fe1c65ddf8988de0bba7ff8f391d
-
SHA512
ef3d9082f408a429c4b3691d297948429124725505e0cf1779517c38135571d54acf0eac3d16ec46c1dd33f34504c9e9dba58f81f7a9915e7473115193e80a06
-
SSDEEP
768:IeeXg6+Rh75x/6PVJR1zrYaLnVRln/PJk5Rzii2uOy1lQ:IeeXg6ax/8rfnriPP1lQ
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4900 WINWORD.EXE 4900 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 4900 WINWORD.EXE 4900 WINWORD.EXE 4900 WINWORD.EXE 4900 WINWORD.EXE 4900 WINWORD.EXE 4900 WINWORD.EXE 4900 WINWORD.EXE 4900 WINWORD.EXE 4900 WINWORD.EXE 4900 WINWORD.EXE 4900 WINWORD.EXE 4900 WINWORD.EXE 4900 WINWORD.EXE 4900 WINWORD.EXE 4900 WINWORD.EXE 4900 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\professional\ϵͳ.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4900