Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/03/2023, 07:02

General

  • Target

    Numazu-cci.or.one

  • Size

    262KB

  • MD5

    02878832868b40b9c1716cb12611f833

  • SHA1

    17584fe2c61b9fe878182b90b399284c57d29390

  • SHA256

    14eda811a9b055878c2039d1d518b7cf0e23b26878deadbc87e73f9966767602

  • SHA512

    7018e5e6d0d00829936eacc91790834919e3b0e9a03bd50a25aaad7867891bac2ed7cae33ade19175a8d7ca5eb66b9ac9445754c05e85783d20293d81d9ffe94

  • SSDEEP

    3072:kNjcvQx377FjDDRX4UzUfxJ3mY2IsGllOb3HPWaBtOzUfxJ3mY2IsGllOb3HPWaT:kmvQp1DRXKXm5ZGa3vRXm5ZGa3vuVM

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\ONENOTE.EXE" "C:\Users\Admin\AppData\Local\Temp\Numazu-cci.or.one"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3748

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BL.bin

    Filesize

    88KB

    MD5

    9eae6f49a02d6eb9f75af7bbf4349808

    SHA1

    2caf7ddeb9fc1d6076558661ef69b9638cfd2e7b

    SHA256

    31fb4bf411dcd7fcb860bdb1db26859290b047b39b94638a7d4fd2a46d323e98

    SHA512

    37b45c58efd8c2bee66c30bca4a3777d5b6ba39e97d34baa8e7bc27fb083397d818a2708cbcf7d4704398fdfff4cbc17abff68b33294292413527702c1ad7eef

  • C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BM.bin

    Filesize

    75KB

    MD5

    f776dd0f1ae059fcf295ade6c5495080

    SHA1

    ed270bfe2edb7e571ba4acf4b4088aa2a111e57e

    SHA256

    2130a3bc8050310a7474be0b17a4ea8584e2105cb17316cb463d732665745749

    SHA512

    2558ab6465af8a782ad02295744cd2d554d03c1ee7aa1689f13e3507a0cec4e73b9f86d1ec9aef346b831ab58758285a8ceda63dc0f834e1378dfa0504490f65

  • C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\tmp\000000BN.bin

    Filesize

    567B

    MD5

    d055ce625528e448c61315eaaef5bb71

    SHA1

    029df4c872b1c154f32e7fe94f434547c3ba6192

    SHA256

    85bf1e672b4e86e9af0c7874681ec9620dfdc78e0335b83eef38c17d813b6705

    SHA512

    705b6b729e967fa946469571109aa892f5cb55a01c74d40ae02140d10cbf9b65dd5e511c06ebfe494e407742f8c6f4fbbe88664b78b37abfb2f19db1f66f4247

  • memory/3748-133-0x00007FFDE5A50000-0x00007FFDE5A60000-memory.dmp

    Filesize

    64KB

  • memory/3748-134-0x00007FFDE5A50000-0x00007FFDE5A60000-memory.dmp

    Filesize

    64KB

  • memory/3748-135-0x00007FFDE5A50000-0x00007FFDE5A60000-memory.dmp

    Filesize

    64KB

  • memory/3748-136-0x00007FFDE5A50000-0x00007FFDE5A60000-memory.dmp

    Filesize

    64KB

  • memory/3748-137-0x00007FFDE5A50000-0x00007FFDE5A60000-memory.dmp

    Filesize

    64KB

  • memory/3748-138-0x00007FFDE3610000-0x00007FFDE3620000-memory.dmp

    Filesize

    64KB

  • memory/3748-139-0x00007FFDE3610000-0x00007FFDE3620000-memory.dmp

    Filesize

    64KB