Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    41s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    17/03/2023, 06:54

General

  • Target

    0EED61E7F62BD394DBE639CE16A07171.doc

  • Size

    42KB

  • MD5

    0eed61e7f62bd394dbe639ce16a07171

  • SHA1

    fe8fa37609361b07243c286d623620d3c2d1058d

  • SHA256

    fe6ae5bdfeb854bf903ab68598dc1a1cee90f92c3abe787380ac25d377444988

  • SHA512

    95f2d1bca9a936d6538e52cf3c6dcfbce59fad9de529f2102e83ff7c7b19f8d3d01cec68cb1f56126a5e1dc52ac5696f4ba86435ad1ad0aadd2bbbc13d2dcff6

  • SSDEEP

    768:uRsFrB7Fj0Tvp1tn0wdtgWE6ybArM7oEpK2m2eM5LsJ:uRG5mhdCWF3CoEX1bO

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0EED61E7F62BD394DBE639CE16A07171.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2016

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

    Filesize

    20KB

    MD5

    5ff37ae1b2fe3673a6fae07469cb5ce8

    SHA1

    1a6e0629f0e51c72df553a4e082cea294c9052db

    SHA256

    c6ccabfb0194e9358ef158945d6a8b5c66f76a6a069cfe1270b4dbe51985ca5f

    SHA512

    51319dd5f72dc85fc25ca2dd39cc50bfb57431d8e141ce49e738045cf6b47ef3d344bd6601b43b7992b496ba99164e86e30082dbd0b30791d12e2889987b7240

  • memory/2016-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2016-76-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB