Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

20/02/2024, 16:33

240220-t2xz7sbd71 3

Analysis

  • max time kernel
    102s
  • max time network
    146s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240214-en
  • resource tags

    arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    20/02/2024, 16:33

General

  • Target

    Help/en-US/credits.rtf

  • Size

    710KB

  • MD5

    05b931430fd173bd22900dbaa8bbff10

  • SHA1

    af5176ee28dba4777e4ba3bd9351e5acb402b9f3

  • SHA256

    3ce703c36dfc6282c22991519309b921ae8f5b2653561ff3f9c1617dc2d6674e

  • SHA512

    e3fbecb7637bdcbf6045140dfd3359529d223e42ff8b03c1883b8011d9dde307f36e7cf1a4b56baa76e052314baf89a03e1f6036e9a443160db394ddd45fe55e

  • SSDEEP

    6144:HMgRS450MZ1cMa0C6byUnw1ZD63iT/r7Dd0ypdUSKi8Sl:HMgs4CMZ1cMa0C6B2DY0T7Ddd/USKi86

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Help\en-US\credits.rtf" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1492

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1492-0-0x00007FFF21950000-0x00007FFF21960000-memory.dmp

    Filesize

    64KB

  • memory/1492-1-0x00007FFF21950000-0x00007FFF21960000-memory.dmp

    Filesize

    64KB

  • memory/1492-3-0x00007FFF618C0000-0x00007FFF61AC9000-memory.dmp

    Filesize

    2.0MB

  • memory/1492-4-0x00007FFF618C0000-0x00007FFF61AC9000-memory.dmp

    Filesize

    2.0MB

  • memory/1492-2-0x00007FFF21950000-0x00007FFF21960000-memory.dmp

    Filesize

    64KB

  • memory/1492-5-0x00007FFF21950000-0x00007FFF21960000-memory.dmp

    Filesize

    64KB

  • memory/1492-6-0x00007FFF618C0000-0x00007FFF61AC9000-memory.dmp

    Filesize

    2.0MB

  • memory/1492-7-0x00007FFF618C0000-0x00007FFF61AC9000-memory.dmp

    Filesize

    2.0MB

  • memory/1492-9-0x00007FFF618C0000-0x00007FFF61AC9000-memory.dmp

    Filesize

    2.0MB

  • memory/1492-8-0x00007FFF21950000-0x00007FFF21960000-memory.dmp

    Filesize

    64KB

  • memory/1492-10-0x00007FFF1F690000-0x00007FFF1F6A0000-memory.dmp

    Filesize

    64KB

  • memory/1492-11-0x00007FFF618C0000-0x00007FFF61AC9000-memory.dmp

    Filesize

    2.0MB

  • memory/1492-12-0x00007FFF618C0000-0x00007FFF61AC9000-memory.dmp

    Filesize

    2.0MB

  • memory/1492-14-0x00007FFF1F690000-0x00007FFF1F6A0000-memory.dmp

    Filesize

    64KB

  • memory/1492-13-0x00007FFF618C0000-0x00007FFF61AC9000-memory.dmp

    Filesize

    2.0MB

  • memory/1492-15-0x00007FFF618C0000-0x00007FFF61AC9000-memory.dmp

    Filesize

    2.0MB

  • memory/1492-16-0x00007FFF618C0000-0x00007FFF61AC9000-memory.dmp

    Filesize

    2.0MB

  • memory/1492-17-0x00007FFF618C0000-0x00007FFF61AC9000-memory.dmp

    Filesize

    2.0MB

  • memory/1492-18-0x00007FFF618C0000-0x00007FFF61AC9000-memory.dmp

    Filesize

    2.0MB

  • memory/1492-19-0x00007FFF618C0000-0x00007FFF61AC9000-memory.dmp

    Filesize

    2.0MB

  • memory/1492-20-0x00007FFF618C0000-0x00007FFF61AC9000-memory.dmp

    Filesize

    2.0MB

  • memory/1492-21-0x00007FFF618C0000-0x00007FFF61AC9000-memory.dmp

    Filesize

    2.0MB

  • memory/1492-22-0x00007FFF610C0000-0x00007FFF6117D000-memory.dmp

    Filesize

    756KB

  • memory/1492-24-0x00007FFF618C0000-0x00007FFF61AC9000-memory.dmp

    Filesize

    2.0MB

  • memory/1492-29-0x00007FFF618C0000-0x00007FFF61AC9000-memory.dmp

    Filesize

    2.0MB

  • memory/1492-30-0x00007FFF618C0000-0x00007FFF61AC9000-memory.dmp

    Filesize

    2.0MB

  • memory/1492-31-0x00007FFF618C0000-0x00007FFF61AC9000-memory.dmp

    Filesize

    2.0MB

  • memory/1492-54-0x00007FFF21950000-0x00007FFF21960000-memory.dmp

    Filesize

    64KB

  • memory/1492-55-0x00007FFF21950000-0x00007FFF21960000-memory.dmp

    Filesize

    64KB

  • memory/1492-56-0x00007FFF21950000-0x00007FFF21960000-memory.dmp

    Filesize

    64KB

  • memory/1492-57-0x00007FFF21950000-0x00007FFF21960000-memory.dmp

    Filesize

    64KB

  • memory/1492-58-0x00007FFF618C0000-0x00007FFF61AC9000-memory.dmp

    Filesize

    2.0MB

  • memory/1492-59-0x00007FFF610C0000-0x00007FFF6117D000-memory.dmp

    Filesize

    756KB