Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    103s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/02/2023, 18:50

General

  • Target

    P.O 2302000006.doc__.rtf

  • Size

    1.8MB

  • MD5

    82a740e8bca6d24877f7cbf263fddaa1

  • SHA1

    536496c4017a95cfff0226ef1212a8c01862baad

  • SHA256

    672a9e0f2f6fa25d2d748d0d8f44b65962a4be004df05cfd361835d892bd533a

  • SHA512

    dd608170c741cc1db9794594cc44b38116e9ffcb8c89b50eaaa560eab9b75c6f5abdfe245d4ce201fb32df47552ada0d7df9eaa6818f1e98a38cbabffacb6f24

  • SSDEEP

    24576:thwCRRlW5IQUzYsbteMGfkfzhF1ee8la65bmYS3O7kCMNYc1JBStYG8TOl97JkXk:u

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\P.O 2302000006.doc__.rtf" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4828

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4828-132-0x00007FFC88D70000-0x00007FFC88D80000-memory.dmp

    Filesize

    64KB

  • memory/4828-133-0x00007FFC88D70000-0x00007FFC88D80000-memory.dmp

    Filesize

    64KB

  • memory/4828-134-0x00007FFC88D70000-0x00007FFC88D80000-memory.dmp

    Filesize

    64KB

  • memory/4828-135-0x00007FFC88D70000-0x00007FFC88D80000-memory.dmp

    Filesize

    64KB

  • memory/4828-136-0x00007FFC88D70000-0x00007FFC88D80000-memory.dmp

    Filesize

    64KB

  • memory/4828-137-0x00007FFC86960000-0x00007FFC86970000-memory.dmp

    Filesize

    64KB

  • memory/4828-138-0x00007FFC86960000-0x00007FFC86970000-memory.dmp

    Filesize

    64KB

  • memory/4828-140-0x00007FFC88D70000-0x00007FFC88D80000-memory.dmp

    Filesize

    64KB

  • memory/4828-141-0x00007FFC88D70000-0x00007FFC88D80000-memory.dmp

    Filesize

    64KB

  • memory/4828-142-0x00007FFC88D70000-0x00007FFC88D80000-memory.dmp

    Filesize

    64KB

  • memory/4828-143-0x00007FFC88D70000-0x00007FFC88D80000-memory.dmp

    Filesize

    64KB