Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    05/10/2023, 07:42

General

  • Target

    Atsakymas i paklausima del tvarkomu paskolu.docx

  • Size

    30KB

  • MD5

    0155dac7e6804d3b6b4a0ad013eb0c8a

  • SHA1

    68bfc493f4872a00ad79465c946bc83f792383f0

  • SHA256

    5aab69fea7e77f1eb4a4aa5ec4092ed44f3be4afda3d2d855b4e8c8328d264db

  • SHA512

    7e287e3afe8b04a0e19cb3d47c3ab77a9184f80abff5f5bf9d91b909604d87b79bba61262d086b591520124c338cf2a12af2944cb2b62fe5db241d4b6ed9d5fa

  • SSDEEP

    384:PkSldj0nN+8aPZjAwlbapm66v1KAjoxg9HFHxv7bfPBQk5eEH/VcafhrTu2qgWBX:zdj0nV2j5baopwgFp79e+ZTJZcfB

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Atsakymas i paklausima del tvarkomu paskolu.docx"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1572
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2788

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      bab9b81cd5dceedb3cd92d7574542480

      SHA1

      590258a3d22483058013936a4ea9f721dd7c5cb5

      SHA256

      6d2b2f69020582dcada256c0066a601a5ce1106edd8e1692e07d00f2861044ec

      SHA512

      601fb024dc223b0861d2e99386ced337198af83f12e9c2190b225d638d02c56ec9636a4c48e0ce2e5433e130bdc0b485c7f31d990233f62b4b8f4fcb6dfe5d9f

    • C:\Users\Admin\AppData\Local\Temp\Cab41B6.tmp

      Filesize

      61KB

      MD5

      f3441b8572aae8801c04f3060b550443

      SHA1

      4ef0a35436125d6821831ef36c28ffaf196cda15

      SHA256

      6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

      SHA512

      5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

    • C:\Users\Admin\AppData\Local\Temp\Tar4226.tmp

      Filesize

      163KB

      MD5

      9441737383d21192400eca82fda910ec

      SHA1

      725e0d606a4fc9ba44aa8ffde65bed15e65367e4

      SHA256

      bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

      SHA512

      7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

    • memory/1572-0-0x000000002F441000-0x000000002F442000-memory.dmp

      Filesize

      4KB

    • memory/1572-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1572-2-0x000000007136D000-0x0000000071378000-memory.dmp

      Filesize

      44KB

    • memory/1572-94-0x000000007136D000-0x0000000071378000-memory.dmp

      Filesize

      44KB