Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
76s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
15/02/2023, 17:03
Static task
static1
Behavioral task
behavioral1
Sample
Document_ZL31(Feb15).one
Resource
win7-20220812-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
Document_ZL31(Feb15).one
Resource
win10v2004-20221111-en
0 signatures
150 seconds
General
-
Target
Document_ZL31(Feb15).one
-
Size
129KB
-
MD5
c6013183eb14798ea0434e4db9f6989c
-
SHA1
1cd52aa713903d2f0cfb5498e39e05db79886534
-
SHA256
39eda8acf32415da1ae7533d87267c4937c46f8c763d37d5f805d4d000dc9e10
-
SHA512
49cffef0e8453a7a2179ba46a0cf39572a53b8a6e1209d10ae1829f17831fb671ce290c54bac8ccae1a0f88b051d38cd8188bbee3ddc1d4ea8b2f0934595dd49
-
SSDEEP
1536:ozgcmpNnhf6YlHU1L8nApPXUSRm2epN9YfJwL18MX6K81y1G/GcNNj2i0WiwfEm8:x1lg8QPXTRqQK751GBzj23t
Score
7/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Screen Clipper and Launcher.lnk ONENOTE.EXE -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BUSINESS.ONE ONENOTE.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\DESIGNER.ONE ONENOTE.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\PLANNERS.ONE ONENOTE.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ACADEMIC.ONE ONENOTE.EXE File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\BLANK.ONE ONENOTE.EXE -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log ONENOTE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" ONENOTE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" ONENOTE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel ONENOTE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" ONENOTE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote ONENOTE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" ONENOTE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar ONENOTE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" ONENOTE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\MenuExt ONENOTE.EXE -
Modifies registry class 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2E1511D-502D-4BD0-8B3A-8A89A05CDCAE}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" ONENOTE.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F2A7EE29-8BF6-4A6D-83F1-098E366C709C}\1.0\ = "Microsoft OneNote 12.0 Object Library" ONENOTE.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F2A7EE29-8BF6-4A6D-83F1-098E366C709C}\1.0\0\win32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\ONENOTE.EXE\\2" ONENOTE.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EA692EE-BB50-4E3C-AEF0-356D91732725}\1.0\ = "Microsoft OneNote 14.0 Object Library" ONENOTE.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0EA692EE-BB50-4E3C-AEF0-356D91732725}\1.0\0\win32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\ONENOTE.EXE\\3" ONENOTE.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E2E1511D-502D-4BD0-8B3A-8A89A05CDCAE}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" ONENOTE.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1528 ONENOTE.EXE 1528 ONENOTE.EXE -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 1036 ONENOTEM.EXE Token: SeIncBasePriorityPrivilege 1036 ONENOTEM.EXE Token: 33 1528 ONENOTE.EXE Token: SeIncBasePriorityPrivilege 1528 ONENOTE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1036 ONENOTEM.EXE -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1036 ONENOTEM.EXE -
Suspicious use of SetWindowsHookEx 11 IoCs
pid Process 1528 ONENOTE.EXE 1528 ONENOTE.EXE 1528 ONENOTE.EXE 1528 ONENOTE.EXE 1528 ONENOTE.EXE 1528 ONENOTE.EXE 1528 ONENOTE.EXE 1528 ONENOTE.EXE 1528 ONENOTE.EXE 1528 ONENOTE.EXE 1528 ONENOTE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1528 wrote to memory of 1036 1528 ONENOTE.EXE 30 PID 1528 wrote to memory of 1036 1528 ONENOTE.EXE 30 PID 1528 wrote to memory of 1036 1528 ONENOTE.EXE 30 PID 1528 wrote to memory of 1036 1528 ONENOTE.EXE 30
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE"C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE" "C:\Users\Admin\AppData\Local\Temp\Document_ZL31(Feb15).one"1⤵
- Drops startup file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE/tsr2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1036
-