Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

Office Tool Plus.exe

windows7-x64

1

Office Tool Plus.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Office Tool Plus.exe

  • Size

    4.4MB

  • Sample

    230111-tb9lbadd72

  • MD5

    9cf2d306b7c36774c2bd88697015dd11

  • SHA1

    b02d8b7665c87fd0892db621812eecaf4d3b9d2f

  • SHA256

    3b202fe7631903ca7dce2c4c58b1ca5b2445af9e4bd7a5a2e65de20da48e05c0

  • SHA512

    227e54de2e1da5185461d82524acf3c1df4623032e323e1c499d3db720e1e1b5a27a3c1ddce7ca7118c0a1d85acb369ace8f491a6ca5ef510632a73b341224cd

  • SSDEEP

    49152:3Xb+SD18VMNODw600948jQkfZUi58oVKv4F6bXhv:b+c18VMiwAhjN1Go67

Score
8/10
discoverypersistence

Malware Config

Targets

    • Target

      Office Tool Plus.exe

    • Size

      4.4MB

    • MD5

      9cf2d306b7c36774c2bd88697015dd11

    • SHA1

      b02d8b7665c87fd0892db621812eecaf4d3b9d2f

    • SHA256

      3b202fe7631903ca7dce2c4c58b1ca5b2445af9e4bd7a5a2e65de20da48e05c0

    • SHA512

      227e54de2e1da5185461d82524acf3c1df4623032e323e1c499d3db720e1e1b5a27a3c1ddce7ca7118c0a1d85acb369ace8f491a6ca5ef510632a73b341224cd

    • SSDEEP

      49152:3Xb+SD18VMNODw600948jQkfZUi58oVKv4F6bXhv:b+c18VMiwAhjN1Go67

    Score
    8/10
    discoverypersistence

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks