Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
59s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
15/03/2023, 22:31
General
-
Target
YGO_1603.one
-
Size
130KB
-
MD5
da12437b78075441fd45d7164e5026d8
-
SHA1
db23cfd305341c51226f2d0faf597310157f2e42
-
SHA256
b753c666c74c62188ee8f87b964bc6a3bb347039a3a5f59176512b3a84e28334
-
SHA512
07e3ae4c773e45540f22c81004f31e87f812071bdf61e562c87b5967a86e5447ddecaab0cee7e95ee2028a14b7f12fb7313bd2b3d356a5b78ad0b43b218c0abb
-
SSDEEP
3072:PrfWMINYf3K19kzCnEEQvSMVnte8ZP1Y6J0cTgGv:d6nInM8TXJ5v
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 12 IoCs
-
Program crash 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Script User-Agent 12 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE"C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "C:\Users\Admin\AppData\Local\Temp\YGO_1603.one"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\OneNote\16.0\Exported\{795319D7-47E5-4B9B-A6F4-AA4699A49EA6}\NT\0\click.wsf"2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 476 -p 896 -ip 8961⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 896 -s 24801⤵
- Program crash
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD545282862aeb428ffb5d4986704a8f4d5
SHA1fa2b0a82f3ca6bc7c00704556c9494b303613972
SHA256af0c7d355bb6a495d038fd05217209054107d31aa6199c491b74ae3d24b11c7e
SHA512db6457af502f45665ce4cc6573c5746607d8ffc661f0dcb224beceed93886f6c6194561cacc0efa543f0b2f62db976742f42c6c8102c5b11b65329757110b1db
-
Filesize
48KB
MD5b7fc313714edd7866f4c76527282c2b5
SHA1c86217b46956933fae4a30483a63b33f34b8c503
SHA256b6d25f5eb52d5c24ef6c325bd25f18e413f3e23d20413a3693749275ba4b192c
SHA512038a73b7a69dd976c964f1538f5b4f7c6c64721e4f2f1a831815598faae84cac53305c03f5cea6e66acdc110a9a5117eee191345ea004b9576c752122f8d88f7
-
Filesize
567B
MD5d055ce625528e448c61315eaaef5bb71
SHA1029df4c872b1c154f32e7fe94f434547c3ba6192
SHA25685bf1e672b4e86e9af0c7874681ec9620dfdc78e0335b83eef38c17d813b6705
SHA512705b6b729e967fa946469571109aa892f5cb55a01c74d40ae02140d10cbf9b65dd5e511c06ebfe494e407742f8c6f4fbbe88664b78b37abfb2f19db1f66f4247
-
Filesize
61KB
MD545282862aeb428ffb5d4986704a8f4d5
SHA1fa2b0a82f3ca6bc7c00704556c9494b303613972
SHA256af0c7d355bb6a495d038fd05217209054107d31aa6199c491b74ae3d24b11c7e
SHA512db6457af502f45665ce4cc6573c5746607d8ffc661f0dcb224beceed93886f6c6194561cacc0efa543f0b2f62db976742f42c6c8102c5b11b65329757110b1db
-
Filesize
10B
MD57605968e79d0ca095ab1231486d2b814
SHA1a007b420d19ceefa840f0373e050e3b51a4ab480
SHA256493fda53120050f85836032324409be6c6484f90a0755ae0c6a673ba7626818b
SHA512769249da7ed6c6bf5671bbc2371a6453b433226ceb8c4c2aa3604000d66647bcec83dee1ab64c0262fa40f923d77e23bad2c47274d339effc51d904ce77072a6
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB