Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29/12/2023, 19:23

General

  • Target

    0199459fc1005591eb55d40eaa15c09c.doc

  • Size

    35KB

  • MD5

    0199459fc1005591eb55d40eaa15c09c

  • SHA1

    adde9ea7028f7ec3ff8818c51afb754f77a517d7

  • SHA256

    71d1c282e1d5dda186dc9d47e1b69db04d2d45566e22e8ebaf54c6eb93eac5b9

  • SHA512

    f2e76048d482f1d55256048516a9d98df2a0afd260f2b1aba50be4301836aa4b80e18bc3a04057484bde176a1ca6524d06b4be81435c5ef69506db961a5d3d11

  • SSDEEP

    384:QFBHvflHnbkam/ZMx1lz5vWD+WMjYSAltHE0:QLXurslvq+pE

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0199459fc1005591eb55d40eaa15c09c.doc"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2892
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1956

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Microsoft Office\Office14\Destrib.dll

      Filesize

      12KB

      MD5

      ba28584b982e1090f60ac3cdbfde98b0

      SHA1

      927705b93a6e8430b72585b9057f99da5e3ecfad

      SHA256

      6eed42d9159eeb970a1b546b92017d98ab4cdcddcc030709738b526806434747

      SHA512

      3d70fbbea1071c80898bff5ce7804a38bd8887c829e4f815f84eb18d00216685d26c092be4e7080538326cf89f1f6a496e7fd2362f90c8de3dd7d5d4310f7f70

    • C:\Program Files (x86)\Microsoft Office\Office14\Destrib.dll

      Filesize

      12KB

      MD5

      471816c50a9911f5e974427d059ed17b

      SHA1

      bf4bbd322d18318052b248ee9f98675b6e3312c4

      SHA256

      c6a4713746362e8f9efc339caa18a22aff71530598e35829f6ff3c6c2f081c88

      SHA512

      fc3f6953fd346482877ff9b85020a1856ef6c27b53674f12265f42cdd859e7eeb783150ba88819a7f74f36d170e78aca8bb91a9309ecf1bd3f9ca3200dcf56d8

    • C:\Program Files (x86)\Microsoft Office\Office14\~$estrib.dll

      Filesize

      162B

      MD5

      d90395e299a6b1e96b95c1b3f42ad6d1

      SHA1

      209dde7e6e2ccd04d4129730f80c96fcfa64fe69

      SHA256

      8f88b15c4eedb66f5983e1ef1172af383066e8ac0e2d2d62e64e8da879076a5e

      SHA512

      bb98e2c3dac9987fdaa792774d441346bc11ab8e53e8ced377aa7a644e35d6ea35dd7fcff7ede6992728f52256a9a58edba304dfdf26e7b22d5168c80a1e4d1a

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{47A16312-32AF-44AE-8D35-9EBC22CFA1FF}.tmp

      Filesize

      1024B

      MD5

      5d4d94ee7e06bbb0af9584119797b23a

      SHA1

      dbb111419c704f116efa8e72471dd83e86e49677

      SHA256

      4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1

      SHA512

      95f83ae84cafcced5eaf504546725c34d5f9710e5ca2d11761486970f2fbeccb25f9cf50bbfc272bd75e1a66a18b7783f09e1c1454afda519624bc2bb2f28ba4

    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\Destrib.dll (3).LNK

      Filesize

      1KB

      MD5

      af5478684a2daaed1acff1ec6d6f1bae

      SHA1

      28d9aa2ae986f9e29064b87733be9b3b6f586b78

      SHA256

      01e82d26d5f006863536c9d600524b1e00111d3fe3cb438db3d409c147a9507e

      SHA512

      303c35795373892f473436634123a49056095dd4c353e677f6c8a9e322bb6d64d3705af9a3db09dc6a385f682fd3df4d70f895805351498c6f5cdf5910cbfd46

    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

      Filesize

      198B

      MD5

      6135cef71d64ea0195196cba44565521

      SHA1

      1a03dceed836511cd45efe21edcbd6979bcdf756

      SHA256

      9f74ad28a0edb3e5247199a92dc9999349618031e3fce2d8b47d5db2c6a335ed

      SHA512

      df3c31b3cd897c264915be18dd652723588c35c2db663085a11ae19d1fcce908e332f66cbe24cf6d96497f188e252c7204f931f2e7934fd7d9322f2aa41ad06b

    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

      Filesize

      232B

      MD5

      66437c4a6d6f59e18e2d6a9da862e95c

      SHA1

      6bc517431b96ea50e0396372f1103fea62da7143

      SHA256

      67125753af7ddf0170ab9eb30d94fbfd7cee5ae4ff7ccaa0b2b74dcd44b3a755

      SHA512

      bae373dbc360fda1033c3828882d7e6e0fdb91b701a3a6848a3b5f69cfabff9d41a6542b16e13f057605e49eae93b488eb19714ef70be70197e8c1e8a61a45d4

    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

      Filesize

      266B

      MD5

      0380a60f2c48521c0fbc5eaed79ce2d8

      SHA1

      250fb9e031a1c8a0622118f56ee623e4bf1ac0e2

      SHA256

      419242758e5e94c9354cdb68dc9d39725d59ad26be5eaf2c05afa6a9f59ef8cf

      SHA512

      8369c4d827057f0c456dc340526d7ef17142bdebf95be34aa26fa7e2560484728748287bc6fd8d621de18751a181765ab106b6f23b5d2bb8c3a87090ae27d686

    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

      Filesize

      156B

      MD5

      977aba9aeba2a040328367eae667785e

      SHA1

      2e0723bf2ea2aff8639b6dc6451753fe5872df62

      SHA256

      6b5c986802da9343e6b6c0f254513841f5b9672e7058e2f2c43c052c06c1bc23

      SHA512

      9e6c9f5b0b5bbafb107fbf7deecf8744997a58e8c92cac427be7d6d2da561cfe16b753f6f4b66f137b45c1dcf7440ff4aac258006dd65f82fa68f096c2898d5e

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      26KB

      MD5

      25ed56ea8faaeb7a7eca5878ee45cd36

      SHA1

      a6f0984cf36e73390aba18bdab7bd73991ea131c

      SHA256

      b20bcea33a83e44f3fc5763ea4bbcb028a6f7268662868f0afb527af72637a00

      SHA512

      ff6af151f06f81120509b0dc97d2333738cf9160992e10838ba9bea4afe4fc539198ec47a81a63c2513ff1c1e27ef176811fab4e56204980c537866fd348ff29

    • memory/2892-0-0x000000002F6E1000-0x000000002F6E2000-memory.dmp

      Filesize

      4KB

    • memory/2892-17-0x00000000049A0000-0x0000000004AA0000-memory.dmp

      Filesize

      1024KB

    • memory/2892-11-0x00000000049A0000-0x0000000004AA0000-memory.dmp

      Filesize

      1024KB

    • memory/2892-2-0x000000007175D000-0x0000000071768000-memory.dmp

      Filesize

      44KB

    • memory/2892-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2892-171-0x000000007175D000-0x0000000071768000-memory.dmp

      Filesize

      44KB

    • memory/2892-172-0x00000000049A0000-0x0000000004AA0000-memory.dmp

      Filesize

      1024KB

    • memory/2892-180-0x00000000049A0000-0x0000000004AA0000-memory.dmp

      Filesize

      1024KB

    • memory/2892-194-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB