Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
3Setup_Pswrd_1234.rar
windows11-21h2-x64
3Help/en-US...ts.rtf
windows11-21h2-x64
1Help/nvcpl/nv3d.chm
windows11-21h2-x64
1Help/nvcpl...ra.chm
windows11-21h2-x64
1Help/nvcpl...hs.chm
windows11-21h2-x64
1Help/nvcpl...ht.chm
windows11-21h2-x64
1Help/nvcpl...sy.chm
windows11-21h2-x64
1Help/nvcpl...an.chm
windows11-21h2-x64
1Help/nvcpl...eu.chm
windows11-21h2-x64
1Help/nvcpl...ll.chm
windows11-21h2-x64
1Help/nvcpl...ng.chm
windows11-21h2-x64
1Help/nvcpl...sm.chm
windows11-21h2-x64
1Help/nvcpl...sn.chm
windows11-21h2-x64
1Help/nvcpl...in.chm
windows11-21h2-x64
1Help/nvcpl...ra.chm
windows11-21h2-x64
1Help/nvcpl...eb.chm
windows11-21h2-x64
1Help/nvcpl...un.chm
windows11-21h2-x64
1Help/nvcpl...ta.chm
windows11-21h2-x64
1Help/nvcpl...pn.chm
windows11-21h2-x64
1Help/nvcpl...or.chm
windows11-21h2-x64
1Help/nvcpl...ld.chm
windows11-21h2-x64
1Help/nvcpl...or.chm
windows11-21h2-x64
1Help/nvcpl...lk.chm
windows11-21h2-x64
1Help/nvcpl...tb.chm
windows11-21h2-x64
1Help/nvcpl...tg.chm
windows11-21h2-x64
1Help/nvcpl...us.chm
windows11-21h2-x64
1Help/nvcpl...ky.chm
windows11-21h2-x64
1Help/nvcpl...lv.chm
windows11-21h2-x64
1Help/nvcpl...ve.chm
windows11-21h2-x64
1Help/nvcpl...ha.chm
windows11-21h2-x64
1Help/nvcpl...rk.chm
windows11-21h2-x64
1Help/nvcpl/nvcpl.chm
windows11-21h2-x64
1Resubmissions
20/02/2024, 16:33
240220-t2xz7sbd71 3Analysis
-
max time kernel
102s -
max time network
146s -
platform
windows11-21h2_x64 -
resource
win11-20240214-en -
resource tags
arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system -
submitted
20/02/2024, 16:33
Static task
static1
Behavioral task
behavioral1
Sample
Setup_Pswrd_1234.rar
Resource
win11-20240214-en
Behavioral task
behavioral2
Sample
Help/en-US/credits.rtf
Resource
win11-20240214-en
Behavioral task
behavioral3
Sample
Help/nvcpl/nv3d.chm
Resource
win11-20240214-en
Behavioral task
behavioral4
Sample
Help/nvcpl/nv3dara.chm
Resource
win11-20240214-en
Behavioral task
behavioral5
Sample
Help/nvcpl/nv3dchs.chm
Resource
win11-20240214-en
Behavioral task
behavioral6
Sample
Help/nvcpl/nv3dcht.chm
Resource
win11-20240214-en
Behavioral task
behavioral7
Sample
Help/nvcpl/nv3dcsy.chm
Resource
win11-20240214-en
Behavioral task
behavioral8
Sample
Help/nvcpl/nv3ddan.chm
Resource
win11-20240214-en
Behavioral task
behavioral9
Sample
Help/nvcpl/nv3ddeu.chm
Resource
win11-20240214-en
Behavioral task
behavioral10
Sample
Help/nvcpl/nv3dell.chm
Resource
win11-20240214-en
Behavioral task
behavioral11
Sample
Help/nvcpl/nv3deng.chm
Resource
win11-20240214-en
Behavioral task
behavioral12
Sample
Help/nvcpl/nv3desm.chm
Resource
win11-20240214-en
Behavioral task
behavioral13
Sample
Help/nvcpl/nv3desn.chm
Resource
win11-20240214-en
Behavioral task
behavioral14
Sample
Help/nvcpl/nv3dfin.chm
Resource
win11-20240214-en
Behavioral task
behavioral15
Sample
Help/nvcpl/nv3dfra.chm
Resource
win11-20240214-en
Behavioral task
behavioral16
Sample
Help/nvcpl/nv3dheb.chm
Resource
win11-20240214-en
Behavioral task
behavioral17
Sample
Help/nvcpl/nv3dhun.chm
Resource
win11-20240214-en
Behavioral task
behavioral18
Sample
Help/nvcpl/nv3dita.chm
Resource
win11-20240214-en
Behavioral task
behavioral19
Sample
Help/nvcpl/nv3djpn.chm
Resource
win11-20240214-en
Behavioral task
behavioral20
Sample
Help/nvcpl/nv3dkor.chm
Resource
win11-20240214-en
Behavioral task
behavioral21
Sample
Help/nvcpl/nv3dnld.chm
Resource
win11-20240214-en
Behavioral task
behavioral22
Sample
Help/nvcpl/nv3dnor.chm
Resource
win11-20240214-en
Behavioral task
behavioral23
Sample
Help/nvcpl/nv3dplk.chm
Resource
win11-20240214-en
Behavioral task
behavioral24
Sample
Help/nvcpl/nv3dptb.chm
Resource
win11-20240214-en
Behavioral task
behavioral25
Sample
Help/nvcpl/nv3dptg.chm
Resource
win11-20240214-en
Behavioral task
behavioral26
Sample
Help/nvcpl/nv3drus.chm
Resource
win11-20240214-en
Behavioral task
behavioral27
Sample
Help/nvcpl/nv3dsky.chm
Resource
win11-20240214-en
Behavioral task
behavioral28
Sample
Help/nvcpl/nv3dslv.chm
Resource
win11-20240214-en
Behavioral task
behavioral29
Sample
Help/nvcpl/nv3dsve.chm
Resource
win11-20240214-en
Behavioral task
behavioral30
Sample
Help/nvcpl/nv3dtha.chm
Resource
win11-20240214-en
Behavioral task
behavioral31
Sample
Help/nvcpl/nv3dtrk.chm
Resource
win11-20240214-en
Behavioral task
behavioral32
Sample
Help/nvcpl/nvcpl.chm
Resource
win11-20240214-en
General
-
Target
Help/en-US/credits.rtf
-
Size
710KB
-
MD5
05b931430fd173bd22900dbaa8bbff10
-
SHA1
af5176ee28dba4777e4ba3bd9351e5acb402b9f3
-
SHA256
3ce703c36dfc6282c22991519309b921ae8f5b2653561ff3f9c1617dc2d6674e
-
SHA512
e3fbecb7637bdcbf6045140dfd3359529d223e42ff8b03c1883b8011d9dde307f36e7cf1a4b56baa76e052314baf89a03e1f6036e9a443160db394ddd45fe55e
-
SSDEEP
6144:HMgRS450MZ1cMa0C6byUnw1ZD63iT/r7Dd0ypdUSKi8Sl:HMgs4CMZ1cMa0C6B2DY0T7Ddd/USKi86
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1492 WINWORD.EXE 1492 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1492 WINWORD.EXE 1492 WINWORD.EXE 1492 WINWORD.EXE 1492 WINWORD.EXE 1492 WINWORD.EXE 1492 WINWORD.EXE 1492 WINWORD.EXE 1492 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Help\en-US\credits.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1492