Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
09/03/2023, 13:27
230309-qqgx3ace75 1009/03/2023, 08:02
230309-jxggjsbc56 809/03/2023, 07:55
230309-jskcmsab7t 10Analysis
-
max time kernel
52s -
max time network
63s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
09/03/2023, 08:02
General
-
Target
2023-03-09_1641.doc
-
Size
528.4MB
-
MD5
2497f00196794d6011c1f95d659fb948
-
SHA1
c9d0caba43352645f7aee4242350c938a0b4bf4e
-
SHA256
66b9053b5c63bac17c1ab5fd3f0e385a6c1fd579b0d05ba86aacd3bea54c558a
-
SHA512
faf794202164330cbaffb01447df2567aa090728f73db5fb2bbba050094b4332c3172fe35438fa76d9adea17b793bef1686baf06f76a9002b95c41b1c65c9e7e
-
SSDEEP
6144:E9fcsHgsTGbWqjWQ6e7t/5MIUAWuVfzmSsWnpoWgXEyV/FF:2fPPGBWQ6CBMIUreiSXgXtF
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Script User-Agent 8 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2023-03-09_1641.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB