Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    101s
  • max time network
    37s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2023, 13:46

General

  • Target

    license/SmartSoft License.rtf

  • Size

    47KB

  • MD5

    5e67dc6960c38eb52ee29696e0051ebd

  • SHA1

    b0cf04c9513d2df58ffd35779d3631dc26c56fb2

  • SHA256

    bd4c2419e8f2c70eeef636de9bb823631257fae28b3f9e87ad20c13d1aed6a2e

  • SHA512

    a8fd6dd655b94f8c16f5f9d04c654a3f6f3c2c12b18657678b0406c30fede6f193ad8cb7f129e8e8b089f92b6d80bec26cce5eccbae8531e72c6bfb250eb3d06

  • SSDEEP

    768:1eJ2fB83aYlO5Btg98x5glIeQQYaRwPHPfWZkmYptP4nnhPcrdSAedP1LoPsovnr:1eJSmaYC1HwviYCAhS

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\license\SmartSoft License.rtf"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1716
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2600

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      7dce8a7a1f66e2893d6315b802c1dc35

      SHA1

      4a8bd8fda32a0b256d59d6b4083f01514131a1ef

      SHA256

      c95cb8f752000292f633dd3e5b3f7274be0ff5484f3c8dad47776a49aa060600

      SHA512

      53fe6e89b8c4c5c58f648bccab660436543b18e79b77376ba1c91459efccd2398a2953dd27ee646b3466c15dd0e346f5d57dabc9de68c717ae8e6e8de1af23d7

    • memory/1716-0-0x000000002FDA1000-0x000000002FDA2000-memory.dmp

      Filesize

      4KB

    • memory/1716-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1716-2-0x0000000070FED000-0x0000000070FF8000-memory.dmp

      Filesize

      44KB

    • memory/1716-11-0x0000000070FED000-0x0000000070FF8000-memory.dmp

      Filesize

      44KB

    • memory/1716-29-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1716-30-0x0000000070FED000-0x0000000070FF8000-memory.dmp

      Filesize

      44KB