Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    107s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    12/02/2024, 06:01

General

  • Target

    Application#37.docm

  • Size

    79KB

  • MD5

    5a53fcaae49b293fb475009b089289d2

  • SHA1

    43d00e702689a60108206055e7448a114b018da0

  • SHA256

    72f6526ae5d46195d9105ccb43d074a15dc7a775e577ca42b3b06964aad4c8ec

  • SHA512

    9ed406f3bf2a2d97b21b36142220b3bf84f9e51cc7ec883d7c910b7fc8c9eb52d20687f5a96670a8cff8da683a0c7efdb6fdd04cce38be39cebee20a4f099beb

  • SSDEEP

    1536:3rqu+lO2Oq6qKSJBKixVjYWdp4RvikgWUNXRIDBXceQ23B5X8Qr37L6:3ryuq6qtK1v5g3NXRI/Q23Xxr37L6

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Application#37.docm"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3032
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:940

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      1d1f596501ce4067df2d9b8e26a6f5b9

      SHA1

      13632d0c43653815ce4dfcb49d5125d03e4c02c0

      SHA256

      1f1e255b5931fa1bcb4985ac702e199478c6b7b00a8219402e86ea8832c2ac29

      SHA512

      1ae3e3ae700d5fb0cef76c371125229cb802d0e5b4d9f9fa49bd07314bec75fdefc6d391cd160db0a10e8309b2d0aeff913ca6cfa824f47d3b26bd10e4d1af74

    • memory/3032-0-0x000000002FB61000-0x000000002FB62000-memory.dmp

      Filesize

      4KB

    • memory/3032-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/3032-2-0x000000007174D000-0x0000000071758000-memory.dmp

      Filesize

      44KB

    • memory/3032-5-0x000000007174D000-0x0000000071758000-memory.dmp

      Filesize

      44KB

    • memory/3032-26-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/3032-27-0x000000007174D000-0x0000000071758000-memory.dmp

      Filesize

      44KB