Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

01/09/2023, 05:51

230901-gkbdnacg6t 5

01/09/2023, 05:47

230901-ghbawacg5y 5

Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    01/09/2023, 05:51

General

  • Target

    POTENTIALLY SUSPICIOUS SHIP DATE Aug 29 2023.msg

  • Size

    204KB

  • MD5

    379270fb269df472c2cf4a7f4e120244

  • SHA1

    0c87dd774f82e4f52a5c80b565ee2f0e97e109c6

  • SHA256

    1f47739cb2c5fab701bd783346bc0a1b9d9f862dd9bb5ed170df95296ede1d4f

  • SHA512

    87ce1904b6274822f181e49279d835da4ea684d250a0e7e978a5acf63880dffb9965cc135dd19a1cfbfe5e2e32137e9c8e0fc345c8836dc4a1132b7fe8b1981a

  • SSDEEP

    6144:ZtaTQWF2ok3u9mnPXHAriJdTf7l5iH2Kt4dl2x/E:ZgTQWF2ok3u9mnPXHoiJdTf7l5iHL

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 14 IoCs
  • Drops file in Windows directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\Admin\AppData\Local\Temp\POTENTIALLY SUSPICIOUS SHIP DATE Aug 29 2023.msg"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    PID:2992

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

    Filesize

    240KB

    MD5

    a4d34f5f3bf7de70171ca1bd1e5d2f12

    SHA1

    e39c616828301a7cff07822c12670881296bf463

    SHA256

    96219940092dc2e8326875122b34c88ee9c15cd1efba4ab1017afe54c4787097

    SHA512

    8be7edd1f7820cdbeb2ee01e55aada95b44a1625fba40014224b04713057552216c21ba6becd9cd0f58c9eccfaaa7b3e32f20b8825a90d60fb9934cb9321e478

  • C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

    Filesize

    240KB

    MD5

    a4d34f5f3bf7de70171ca1bd1e5d2f12

    SHA1

    e39c616828301a7cff07822c12670881296bf463

    SHA256

    96219940092dc2e8326875122b34c88ee9c15cd1efba4ab1017afe54c4787097

    SHA512

    8be7edd1f7820cdbeb2ee01e55aada95b44a1625fba40014224b04713057552216c21ba6becd9cd0f58c9eccfaaa7b3e32f20b8825a90d60fb9934cb9321e478

  • C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.inf

    Filesize

    1KB

    MD5

    48dd6cae43ce26b992c35799fcd76898

    SHA1

    8e600544df0250da7d634599ce6ee50da11c0355

    SHA256

    7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a

    SHA512

    c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31

  • memory/2992-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2992-1-0x00000000733CD000-0x00000000733D8000-memory.dmp

    Filesize

    44KB

  • memory/2992-124-0x00000000733CD000-0x00000000733D8000-memory.dmp

    Filesize

    44KB