Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

09/06/2023, 15:24

230609-ste9race24 8

09/06/2023, 15:24

230609-ss785sdd2z 1

Analysis

  • max time kernel
    41s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    09/06/2023, 15:24

General

  • Target

    a875d0ae637bfa5f0cb5cf732ffa877b877c3fb6acc200d5556e04ff976913f2.rtf

  • Size

    164KB

  • MD5

    a090eeb3593243868aee20648fc9cd50

  • SHA1

    9387c94cf3b7a06369521f7f3ba86aa63a92f117

  • SHA256

    a875d0ae637bfa5f0cb5cf732ffa877b877c3fb6acc200d5556e04ff976913f2

  • SHA512

    29ee40fdd43ba81269867117d3ab7dcd832363d0674ecbdaa51881f3410844aa930170c0ba233f2d81f2d6b96774ca3592b490042486acba71e19e116948d9ac

  • SSDEEP

    3072:L7UeO5Zf6C/uwfGdoHqYBNj140TMY7D0mfzB9GRB:L4eWZflGdoK61XTjf3Q

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 2 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\a875d0ae637bfa5f0cb5cf732ffa877b877c3fb6acc200d5556e04ff976913f2.rtf"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1384
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:432
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Launches Equation Editor
      PID:1528
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Launches Equation Editor
      PID:1240

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      47016fecf2405769feb9737506c2d755

      SHA1

      34629f0637bd1b183f78d1c4ef8ffa0acaf08f48

      SHA256

      50340ef9f4b2bf1ef06c877ec069288caf2a39982115dc64c6976c5f7e183187

      SHA512

      6c2e489da6e5a439237e2e1e894bf483ee9396642f7c241104bd2b70689b875a1edba2f765693efcede5993f22fd9b570948771ce399217960e3a0e7a33bdb5f

    • memory/1384-54-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1384-101-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB