Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29/12/2023, 22:58

General

  • Target

    0651024634a991ed5d6b50753cdea5ce.pps

  • Size

    201KB

  • MD5

    0651024634a991ed5d6b50753cdea5ce

  • SHA1

    344315f5b0a5fcc2a930dd89ff9115a20f7f3360

  • SHA256

    63eaf8c898eb1ad63510f2b25e2ef4f7e748f5faae5a164fd5112efaa7b50a0d

  • SHA512

    1616ac7f21cab3d541b5ade46156249ad2a962930a11c5860ba869ceb469671188deb50274bb036846d1fd254296278d94c808d88ec484d1e7d15b2ecfc96e96

  • SSDEEP

    6144:KiN4cam97+bnI6je37x/2xMH2DKTYZ2mMVpzM/lkp:KHcT8Ip37x/2xMH2DKTYZ2mMVpz2kp

Score
1/10

Malware Config

Signatures

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" /s "C:\Users\Admin\AppData\Local\Temp\0651024634a991ed5d6b50753cdea5ce.pps"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of WriteProcessMemory
    PID:2252
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1728
    • C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe
      "C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe" -Embedding
      1⤵
        PID:2816

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2252-0-0x000000002D141000-0x000000002D142000-memory.dmp

        Filesize

        4KB

      • memory/2252-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

      • memory/2252-2-0x000000007205D000-0x0000000072068000-memory.dmp

        Filesize

        44KB

      • memory/2252-9-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

        Filesize

        64KB

      • memory/2252-11-0x000000007205D000-0x0000000072068000-memory.dmp

        Filesize

        44KB

      • memory/2816-6-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB