Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    115s
  • max time network
    185s
  • platform
    windows10-1703_x64
  • resource
    win10-20231020-en
  • resource tags

    arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
  • submitted
    29/10/2023, 16:57

General

  • Target

    RQF_Athens_plant_SV317653.rtf

  • Size

    189KB

  • MD5

    5441dcbe6b5d05ddb25e88ab953063d6

  • SHA1

    c1fa90f8178de83f232b6520e43b9dbd43241a07

  • SHA256

    247629d8098e23046e3cf340b224420b00e760f10fac40fc75af9ae4de995259

  • SHA512

    3b2e94f6cdeed8ae55ef7feed575c653c03e15ba4054998c861487f6316541b7b406e978454dfb1ad27604764eaaf3c1ad7e4beaad808f445dcc9ff99e652cfd

  • SSDEEP

    768:1wAbZSibMX9gRWj3pkScGvt9nncglN/oBxNmphK:1wAlR2kSF3n9oUphK

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\RQF_Athens_plant_SV317653.rtf" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4004

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4004-0-0x00007FF910BF0000-0x00007FF910C00000-memory.dmp

    Filesize

    64KB

  • memory/4004-1-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-2-0x00007FF910BF0000-0x00007FF910C00000-memory.dmp

    Filesize

    64KB

  • memory/4004-3-0x00007FF910BF0000-0x00007FF910C00000-memory.dmp

    Filesize

    64KB

  • memory/4004-5-0x00007FF910BF0000-0x00007FF910C00000-memory.dmp

    Filesize

    64KB

  • memory/4004-4-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-7-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-9-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-10-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-11-0x00007FF90D700000-0x00007FF90D710000-memory.dmp

    Filesize

    64KB

  • memory/4004-12-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-13-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-14-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-15-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-16-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-17-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-18-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-19-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-20-0x00007FF94E3B0000-0x00007FF94E45E000-memory.dmp

    Filesize

    696KB

  • memory/4004-21-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-22-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-23-0x00007FF90D700000-0x00007FF90D710000-memory.dmp

    Filesize

    64KB

  • memory/4004-24-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-29-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-27-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-31-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-204-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-205-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-206-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-207-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-208-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-283-0x00007FF94E3B0000-0x00007FF94E45E000-memory.dmp

    Filesize

    696KB

  • memory/4004-284-0x00007FF910BF0000-0x00007FF910C00000-memory.dmp

    Filesize

    64KB

  • memory/4004-282-0x00007FF910BF0000-0x00007FF910C00000-memory.dmp

    Filesize

    64KB

  • memory/4004-286-0x00007FF94E3B0000-0x00007FF94E45E000-memory.dmp

    Filesize

    696KB

  • memory/4004-285-0x00007FF910BF0000-0x00007FF910C00000-memory.dmp

    Filesize

    64KB

  • memory/4004-288-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-287-0x00007FF910BF0000-0x00007FF910C00000-memory.dmp

    Filesize

    64KB

  • memory/4004-289-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-290-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-291-0x00007FF950B60000-0x00007FF950D3B000-memory.dmp

    Filesize

    1.9MB

  • memory/4004-292-0x00007FF94E3B0000-0x00007FF94E45E000-memory.dmp

    Filesize

    696KB