Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07/03/2024, 13:25

General

  • Target

    9d99436688195bc9463d87aa6befa8b25a6a0ae982eb4b06c39b1416eac09155.doc

  • Size

    63KB

  • MD5

    45e5222372c79a597eadfa0080baa2dc

  • SHA1

    6c0b1f81e70898fe0647ef18d8995835a3d644cc

  • SHA256

    9d99436688195bc9463d87aa6befa8b25a6a0ae982eb4b06c39b1416eac09155

  • SHA512

    5be46962aa06b3e10262859e9f7d6258c85af99ed175db0a7292933fefc59a65f72bdec2a234eaf33edc03f7b1d4aa38041f62acc2a048548ba5e91738a94b06

  • SSDEEP

    768:A8ZkPHxy0BdW2tKtZCHlkTL5yhSsU/RJbNiYb:r0BdhtKtMHlcL5njNT

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\9d99436688195bc9463d87aa6befa8b25a6a0ae982eb4b06c39b1416eac09155.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1812
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2148

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      384e08c74528e541f51ff4d6d6a8e595

      SHA1

      9cc451461f922b1e9088e48c0b4773493af46c67

      SHA256

      78a51b9f3919cd3e35b17e635fbb8097ecb24ad14680e683c77f46454ac2466f

      SHA512

      8cf20cfddcaf517075fa61fef1cc8936f95f95573709102554127aa2fc77fa332c35891830d3c6e3234a5b50d0a163c7799d4e82dbb0212a7cf3c2a58fa11984

    • memory/1812-0-0x000000002F8B1000-0x000000002F8B2000-memory.dmp

      Filesize

      4KB

    • memory/1812-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1812-2-0x000000007104D000-0x0000000071058000-memory.dmp

      Filesize

      44KB

    • memory/1812-11-0x000000007104D000-0x0000000071058000-memory.dmp

      Filesize

      44KB

    • memory/1812-26-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB