Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    100s
  • max time network
    51s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2022, 22:57

General

  • Target

    9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223.exe

  • Size

    139KB

  • MD5

    6a5b3756d94eb031d2d0f17d8aa770c2

  • SHA1

    ea01889c4f7b08847290646a05fed16be7de3ec0

  • SHA256

    9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223

  • SHA512

    43b30a67043b3471848b9958d72b495848ac6e5a3b28ac9d5b7455b5e3ce35508d7f5b28dbdc3b06f63122aae749a39defa8b3bc9ce9fd3b7b4c87c1f219628e

  • SSDEEP

    3072:6mi+/dgy5Ef8doutaZZYCajVJ4pcUiqbHBchQfi:6tSEf+oSaR6PKcTcBchQf

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 6 IoCs
  • Drops file in System32 directory 11 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223.exe
    "C:\Users\Admin\AppData\Local\Temp\9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\Temp\_$Cf\9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223 .doc"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2044
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:1084
      • C:\Windows\Temp\_$Cf\osk.exe
        "C:\Windows\Temp\_$Cf\osk.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1964
        • C:\Windows\SysWOW64\WINWORD.EXE
          "C:\Windows\system32\WINWORD.EXE"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:596
          • C:\Windows\SysWOW64\WINWORD.EXE
            "C:\Windows\system32\WINWORD.EXE"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:700

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\Com\ctfmoon.exe

      Filesize

      74KB

      MD5

      862a96836fe55f230039047fc1897b6f

      SHA1

      56a56c039d90714cefe7d2e7bb02e13c2b04764c

      SHA256

      0044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21

      SHA512

      d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574

    • C:\Windows\SysWOW64\WINWORD.EXE

      Filesize

      74KB

      MD5

      862a96836fe55f230039047fc1897b6f

      SHA1

      56a56c039d90714cefe7d2e7bb02e13c2b04764c

      SHA256

      0044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21

      SHA512

      d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574

    • C:\Windows\SysWOW64\WINWORD.EXE

      Filesize

      74KB

      MD5

      862a96836fe55f230039047fc1897b6f

      SHA1

      56a56c039d90714cefe7d2e7bb02e13c2b04764c

      SHA256

      0044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21

      SHA512

      d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574

    • C:\Windows\SysWOW64\WINWORD.exe

      Filesize

      74KB

      MD5

      862a96836fe55f230039047fc1897b6f

      SHA1

      56a56c039d90714cefe7d2e7bb02e13c2b04764c

      SHA256

      0044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21

      SHA512

      d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574

    • C:\Windows\Temp\_$Cf\9d29526dc58a2a2fd8a8a2769ca6a4ebd6861abbecb2d8d50745f0563cce5223 .doc

      Filesize

      118KB

      MD5

      4e9b69cecff4ca8e53137add4071ad5b

      SHA1

      51ba5a8ec1125ad1a726121a0977f3980e740cab

      SHA256

      9fbf56cd714f26aeba25c9896e1d668c28465b806e0dd298dbea4429098f5931

      SHA512

      e47c7f8333f958fef019bc56a3663e0879e1509b82c06d71243cb5d41032bdb462da6962848f9137e4cbeaa6bc84ad37377a7da053f0b1786f35576d52b38b70

    • C:\Windows\Temp\_$Cf\osk.exe

      Filesize

      74KB

      MD5

      862a96836fe55f230039047fc1897b6f

      SHA1

      56a56c039d90714cefe7d2e7bb02e13c2b04764c

      SHA256

      0044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21

      SHA512

      d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574

    • C:\Windows\Temp\_$Cf\osk.exe

      Filesize

      74KB

      MD5

      862a96836fe55f230039047fc1897b6f

      SHA1

      56a56c039d90714cefe7d2e7bb02e13c2b04764c

      SHA256

      0044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21

      SHA512

      d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574

    • \Windows\SysWOW64\WINWORD.EXE

      Filesize

      74KB

      MD5

      862a96836fe55f230039047fc1897b6f

      SHA1

      56a56c039d90714cefe7d2e7bb02e13c2b04764c

      SHA256

      0044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21

      SHA512

      d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574

    • \Windows\SysWOW64\WINWORD.EXE

      Filesize

      74KB

      MD5

      862a96836fe55f230039047fc1897b6f

      SHA1

      56a56c039d90714cefe7d2e7bb02e13c2b04764c

      SHA256

      0044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21

      SHA512

      d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574

    • \Windows\SysWOW64\WINWORD.EXE

      Filesize

      74KB

      MD5

      862a96836fe55f230039047fc1897b6f

      SHA1

      56a56c039d90714cefe7d2e7bb02e13c2b04764c

      SHA256

      0044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21

      SHA512

      d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574

    • \Windows\SysWOW64\WINWORD.EXE

      Filesize

      74KB

      MD5

      862a96836fe55f230039047fc1897b6f

      SHA1

      56a56c039d90714cefe7d2e7bb02e13c2b04764c

      SHA256

      0044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21

      SHA512

      d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574

    • \Windows\Temp\_$Cf\osk.exe

      Filesize

      74KB

      MD5

      862a96836fe55f230039047fc1897b6f

      SHA1

      56a56c039d90714cefe7d2e7bb02e13c2b04764c

      SHA256

      0044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21

      SHA512

      d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574

    • \Windows\Temp\_$Cf\osk.exe

      Filesize

      74KB

      MD5

      862a96836fe55f230039047fc1897b6f

      SHA1

      56a56c039d90714cefe7d2e7bb02e13c2b04764c

      SHA256

      0044b6448afbf8cce1057d5226b4baf27708656d9245f06dc9408956ced0cb21

      SHA512

      d6e77acb572339746797cfb9fd62b90fbcef4590f47eba5db538e97f7535326266b8146e120983d35a0978298083ffae90714ce119ef9c456b428374d288d574

    • memory/596-85-0x0000000011000000-0x000000001102F000-memory.dmp

      Filesize

      188KB

    • memory/700-88-0x0000000011000000-0x000000001102F000-memory.dmp

      Filesize

      188KB

    • memory/1084-94-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

      Filesize

      8KB

    • memory/1204-57-0x0000000011000000-0x000000001102F000-memory.dmp

      Filesize

      188KB

    • memory/1204-67-0x0000000011000000-0x000000001102F000-memory.dmp

      Filesize

      188KB

    • memory/1204-56-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

      Filesize

      8KB

    • memory/1964-75-0x0000000011000000-0x000000001102F000-memory.dmp

      Filesize

      188KB

    • memory/2044-68-0x0000000072231000-0x0000000072234000-memory.dmp

      Filesize

      12KB

    • memory/2044-92-0x0000000070C9D000-0x0000000070CA8000-memory.dmp

      Filesize

      44KB

    • memory/2044-91-0x0000000070C9D000-0x0000000070CA8000-memory.dmp

      Filesize

      44KB

    • memory/2044-89-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2044-74-0x000000006FCB1000-0x000000006FCB3000-memory.dmp

      Filesize

      8KB

    • memory/2044-95-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2044-96-0x0000000070C9D000-0x0000000070CA8000-memory.dmp

      Filesize

      44KB