Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2023, 22:58

General

  • Target

    0651024634a991ed5d6b50753cdea5ce.pps

  • Size

    201KB

  • MD5

    0651024634a991ed5d6b50753cdea5ce

  • SHA1

    344315f5b0a5fcc2a930dd89ff9115a20f7f3360

  • SHA256

    63eaf8c898eb1ad63510f2b25e2ef4f7e748f5faae5a164fd5112efaa7b50a0d

  • SHA512

    1616ac7f21cab3d541b5ade46156249ad2a962930a11c5860ba869ceb469671188deb50274bb036846d1fd254296278d94c808d88ec484d1e7d15b2ecfc96e96

  • SSDEEP

    6144:KiN4cam97+bnI6je37x/2xMH2DKTYZ2mMVpzM/lkp:KHcT8Ip37x/2xMH2DKTYZ2mMVpz2kp

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\AppData\Local\Temp\0651024634a991ed5d6b50753cdea5ce.pps" /ou ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1380
    • C:\Program Files\Microsoft Office\Root\Office16\Wordconv.exe
      "C:\Program Files\Microsoft Office\Root\Office16\Wordconv.exe" -Embedding
      2⤵
      • Process spawned unexpected child process
      PID:3512
  • C:\Program Files\Microsoft Office\Root\Office16\Wordconv.exe
    "C:\Program Files\Microsoft Office\Root\Office16\Wordconv.exe" -Embedding
    1⤵
      PID:4888

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1380-16-0x00007FF9A9020000-0x00007FF9A9030000-memory.dmp

      Filesize

      64KB

    • memory/1380-39-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/1380-7-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/1380-6-0x00007FF9AB0B0000-0x00007FF9AB0C0000-memory.dmp

      Filesize

      64KB

    • memory/1380-8-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/1380-11-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/1380-14-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/1380-18-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/1380-22-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/1380-23-0x00007FF9A9020000-0x00007FF9A9030000-memory.dmp

      Filesize

      64KB

    • memory/1380-21-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/1380-20-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/1380-19-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/1380-17-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/1380-57-0x00007FF9AB0B0000-0x00007FF9AB0C0000-memory.dmp

      Filesize

      64KB

    • memory/1380-58-0x00007FF9AB0B0000-0x00007FF9AB0C0000-memory.dmp

      Filesize

      64KB

    • memory/1380-15-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/1380-59-0x00007FF9AB0B0000-0x00007FF9AB0C0000-memory.dmp

      Filesize

      64KB

    • memory/1380-5-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/1380-60-0x00007FF9AB0B0000-0x00007FF9AB0C0000-memory.dmp

      Filesize

      64KB

    • memory/1380-9-0x00007FF9AB0B0000-0x00007FF9AB0C0000-memory.dmp

      Filesize

      64KB

    • memory/1380-12-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/1380-10-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/1380-13-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/1380-4-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/1380-3-0x00007FF9AB0B0000-0x00007FF9AB0C0000-memory.dmp

      Filesize

      64KB

    • memory/1380-2-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/1380-1-0x00007FF9AB0B0000-0x00007FF9AB0C0000-memory.dmp

      Filesize

      64KB

    • memory/1380-0-0x00007FF9AB0B0000-0x00007FF9AB0C0000-memory.dmp

      Filesize

      64KB

    • memory/1380-42-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/1380-46-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/1380-61-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/3512-50-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/3512-49-0x00007FF9E8950000-0x00007FF9E8C19000-memory.dmp

      Filesize

      2.8MB

    • memory/3512-48-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/4888-26-0x00007FF9E8950000-0x00007FF9E8C19000-memory.dmp

      Filesize

      2.8MB

    • memory/4888-28-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB

    • memory/4888-27-0x00007FF9AB0B0000-0x00007FF9AB0C0000-memory.dmp

      Filesize

      64KB

    • memory/4888-25-0x00007FF9EB030000-0x00007FF9EB225000-memory.dmp

      Filesize

      2.0MB