Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 12:40

General

  • Target

    112358759ec2493c3d16e044075085f9382d700c9e104bdb788315bd53c8cc17.doc

  • Size

    63KB

  • MD5

    948b970eb8c0e062cce03ee0eca168ac

  • SHA1

    679e9cb786c2a831ed4cc7887d7fa8c04870c2f0

  • SHA256

    112358759ec2493c3d16e044075085f9382d700c9e104bdb788315bd53c8cc17

  • SHA512

    2ad9ecd5b4388390558da1ebdf4dad934b9a3d197d0d2cc56546966adfe37b07b371e467d511c24a1510049f7423c0b6378bac70b843310bcdeebf7e50e3e6fe

  • SSDEEP

    384:xGiCMeP0A8WnycWodCmMyv/V7QX5Lf77Y2uC4O03o3+JnA+XNPfqIpX0jrT6xt63:xjCHsA9so9v9QX1Q2uVOCouu+Xdf7kn

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\112358759ec2493c3d16e044075085f9382d700c9e104bdb788315bd53c8cc17.doc"
    1⤵
    • Deletes itself
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:956
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1508

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/956-70-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/956-71-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/956-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/956-57-0x0000000075931000-0x0000000075933000-memory.dmp

      Filesize

      8KB

    • memory/956-58-0x00000000715ED000-0x00000000715F8000-memory.dmp

      Filesize

      44KB

    • memory/956-86-0x00000000715ED000-0x00000000715F8000-memory.dmp

      Filesize

      44KB

    • memory/956-85-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/956-61-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/956-62-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/956-63-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/956-64-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/956-66-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/956-65-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/956-67-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/956-68-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/956-69-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/956-55-0x0000000070601000-0x0000000070603000-memory.dmp

      Filesize

      8KB

    • memory/956-72-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/956-54-0x0000000072B81000-0x0000000072B84000-memory.dmp

      Filesize

      12KB

    • memory/956-73-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/956-74-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/956-75-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/956-76-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/956-77-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/956-78-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/956-79-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/956-80-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/956-81-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/956-82-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/956-83-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/956-84-0x00000000004D4000-0x00000000004F5000-memory.dmp

      Filesize

      132KB

    • memory/1508-60-0x000007FEFC091000-0x000007FEFC093000-memory.dmp

      Filesize

      8KB