Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    13/02/2024, 03:02

General

  • Target

    00b6503f15d4a7844287484c795e9c0a434bc5ec86f61f9b77ec55b2a08acfbe.doc

  • Size

    96KB

  • MD5

    fddf4a4b7149b0e2c7e06a5491ab2038

  • SHA1

    bd4e87fb205c47c08f79dfc83f9894314f258946

  • SHA256

    00b6503f15d4a7844287484c795e9c0a434bc5ec86f61f9b77ec55b2a08acfbe

  • SHA512

    ebf3448cf022a3f1cb491bb9eff86b075b76c3a0c7bbdc633de0b0e19d10f151bea84d990eb9a9d462f219c9318800d2679dd53bb45e4957d05ba2d7e4689458

  • SSDEEP

    1536:g71vMOlk/w+a9vPDEWhN74z+fIz14crhNlPDwk3MzQDs3lDsfehNNznhN8nDLjgE:M5GSA

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\00b6503f15d4a7844287484c795e9c0a434bc5ec86f61f9b77ec55b2a08acfbe.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2268
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2252

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      c4e6f5b83e1df21084a9143344a6cce2

      SHA1

      121536ff1c9a570fdde0b18c57ef905a2e9eed7e

      SHA256

      33523c7f7746c4dec405371967a253790a1ff667d3c90d4ed7668064c90d797e

      SHA512

      3295a166c2305b3339b38c11cfc04ad860dbb576bc393479133d61b55eb28e9ee29bcf71fe97c2a78cf3a4eaecb701b402acfc7f8c75296a8eba1bc78e1dfa92

    • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

      Filesize

      2B

      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    • memory/2268-0-0x000000002FCE1000-0x000000002FCE2000-memory.dmp

      Filesize

      4KB

    • memory/2268-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2268-2-0x0000000070F4D000-0x0000000070F58000-memory.dmp

      Filesize

      44KB

    • memory/2268-20-0x0000000070F4D000-0x0000000070F58000-memory.dmp

      Filesize

      44KB

    • memory/2268-35-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB