Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230824-en -
resource tags
arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2023, 14:45
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Exploit.CVE-2017-11882.123.7565.25820.doc
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Exploit.CVE-2017-11882.123.7565.25820.doc
Resource
win10v2004-20230824-en
General
-
Target
SecuriteInfo.com.Exploit.CVE-2017-11882.123.7565.25820.doc
-
Size
966KB
-
MD5
3eee111e40809e5239a3fff891eef791
-
SHA1
9d18eb872463810228ec748831c4df3998661e07
-
SHA256
e12dd5ec8d02967d4034c689ac7a05fa7eef1f6513fcd99d6a10ebb0bb8e6788
-
SHA512
41e8e633e9c475fcc3258848b3ef447aad930b00fe6a8f7697ef26bc63d8379d6528457ecd5efb37940df0cc6c5e5d23799649b056b0ad8d2827146426911c84
-
SSDEEP
24576:HHzgj81VWgVf+Yw4y0rX+6auOUfC3QVIanV9RRYE:HTp/i
Malware Config
Signatures
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 848 WINWORD.EXE 848 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 21 IoCs
pid Process 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE 848 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Exploit.CVE-2017-11882.123.7565.25820.doc" /o ""1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:848