Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
4Static
static
1UploadFile...14.doc
windows7-x64
4UploadFile...14.doc
windows10-2004-x64
1UploadFile...41.doc
windows7-x64
4UploadFile...41.doc
windows10-2004-x64
1UploadFile...42.doc
windows7-x64
4UploadFile...42.doc
windows10-2004-x64
1areweb/Adv...ol.vbs
windows7-x64
1areweb/Adv...ol.vbs
windows10-2004-x64
1areweb/Adv...dt.vbs
windows7-x64
1areweb/Adv...dt.vbs
windows10-2004-x64
1areweb/Art...Box.js
windows7-x64
1areweb/Art...Box.js
windows10-2004-x64
1areweb/Art...ple.js
windows7-x64
1areweb/Art...ple.js
windows10-2004-x64
1areweb/Art...ut.htm
windows7-x64
1areweb/Art...ut.htm
windows10-2004-x64
1areweb/Art...log.js
windows7-x64
1areweb/Art...log.js
windows10-2004-x64
1areweb/Art...lp.htm
windows7-x64
1areweb/Art...lp.htm
windows10-2004-x64
1areweb/Art...in.htm
windows7-x64
1areweb/Art...in.htm
windows10-2004-x64
1areweb/Art...op.htm
windows7-x64
1areweb/Art...op.htm
windows10-2004-x64
1areweb/Art...de.vbs
windows7-x64
1areweb/Art...de.vbs
windows10-2004-x64
1areweb/Art...tor.js
windows7-x64
1areweb/Art...tor.js
windows10-2004-x64
1areweb/Art...up.asp
windows7-x64
3areweb/Art...up.asp
windows10-2004-x64
3areweb/Art...ig.vbs
windows7-x64
1areweb/Art...ig.vbs
windows10-2004-x64
1Analysis
-
max time kernel
143s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2024, 13:54
Static task
static1
Behavioral task
behavioral1
Sample
UploadFiles/indentAttFile/2011010414440714.doc
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
UploadFiles/indentAttFile/2011010414440714.doc
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
UploadFiles/indentAttFile/2011010414458441.doc
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
UploadFiles/indentAttFile/2011010414458441.doc
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
UploadFiles/indentAttFile/2011010414523642.doc
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
UploadFiles/indentAttFile/2011010414523642.doc
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
areweb/Advisory/control.vbs
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
areweb/Advisory/control.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
areweb/Advisory/controllidt.vbs
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
areweb/Advisory/controllidt.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
areweb/ArtHtmlBox/ArtHtmlBox.js
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
areweb/ArtHtmlBox/ArtHtmlBox.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
areweb/ArtHtmlBox/ArtHtmlBox_simple.js
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
areweb/ArtHtmlBox/ArtHtmlBox_simple.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
areweb/ArtHtmlBox/Dialog/about.htm
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
areweb/ArtHtmlBox/Dialog/about.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
areweb/ArtHtmlBox/Dialog/dialog.js
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
areweb/ArtHtmlBox/Dialog/dialog.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
areweb/ArtHtmlBox/Dialog/help.htm
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
areweb/ArtHtmlBox/Dialog/help.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
areweb/ArtHtmlBox/Dialog/help/main.htm
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
areweb/ArtHtmlBox/Dialog/help/main.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
areweb/ArtHtmlBox/Dialog/help/top.htm
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
areweb/ArtHtmlBox/Dialog/help/top.htm
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
areweb/ArtHtmlBox/Include/DeCode.vbs
Resource
win7-20240220-en
Behavioral task
behavioral26
Sample
areweb/ArtHtmlBox/Include/DeCode.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
areweb/ArtHtmlBox/Include/Editor.js
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
areweb/ArtHtmlBox/Include/Editor.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
areweb/ArtHtmlBox/Include/Startup.asp
Resource
win7-20240220-en
Behavioral task
behavioral30
Sample
areweb/ArtHtmlBox/Include/Startup.asp
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
areweb/ArtHtmlBox/Include/config.vbs
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
areweb/ArtHtmlBox/Include/config.vbs
Resource
win10v2004-20240226-en
General
-
Target
UploadFiles/indentAttFile/2011010414458441.doc
-
Size
69KB
-
MD5
d59c40cb0d61775131806c246a9fddf7
-
SHA1
eef6a74ff26fce4ea6aaf89f0e6f8088d0bb8b06
-
SHA256
2906184d642ef37fb2f7a26cd63fa9549788f57d0b9449781b8095fa0c2c3cce
-
SHA512
a939a574edb6fb53c45b17178a4d89d5071ee6b2c3cf111f2a80f50a2ef0ece378f639f685da77d3948891c1424d88346e482136bd5bedfaff04097945fb5e75
-
SSDEEP
384:wL0ohCL+YkTAyHjTkgDXKvTyAjoLkOVh6ffRUDLaUlBfLuQBbxnUAFYo7aAyIyvy:ZoS9kTL8ZYXF4vK/XKqjdYOs5n
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4976 WINWORD.EXE 4976 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 4976 WINWORD.EXE 4976 WINWORD.EXE 4976 WINWORD.EXE 4976 WINWORD.EXE 4976 WINWORD.EXE 4976 WINWORD.EXE 4976 WINWORD.EXE 4976 WINWORD.EXE 4976 WINWORD.EXE 4976 WINWORD.EXE 4976 WINWORD.EXE 4976 WINWORD.EXE 4976 WINWORD.EXE 4976 WINWORD.EXE 4976 WINWORD.EXE 4976 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\UploadFiles\indentAttFile\2011010414458441.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4976
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
758B
MD59b6dfc7ae54090d251e8733d23099a50
SHA11e7dcadcab92e99c6cf49a6dd80317223f24cc16
SHA256c43ebe43063ecc22ffabd59aaf34d4ffcacd1da434fefd7a102c16e9275ba22c
SHA5121db6aa25a0c721ac3789d8b8ee445c65ae29dbbc00eed1615a98d7753902bda4ae07a42cf5eaa7e7cd8ec043fcc1efb6a2fe6cc99ed93cb0ba690a46c79a9519
-
Filesize
534B
MD55956f79632c0624a94d97ace099fbf0b
SHA15e6b0d10f8eb0e19388a7c3eebd7bef2e0174cec
SHA256b9499025a58c04f6a9ac92e80424ad7f558ad78ffea265e987dc5b7c5d599030
SHA512eb712dd01cbe45b9953a5e8ce9cc61003ac4454f348f607772cef19990054e3b2b929e5c797b5605c3834495af9e6288d108b17ae4fd3961be1c30a80b3bce0a
-
Filesize
490B
MD5aabf1cb5344c29c354ff84e2c7ec2134
SHA13cee7ef56dba817406bb65d549a52cf9fb6282af
SHA2564cbcb7f763d387d021efe2f2b73e1e0121c15ac1093bce11eefa44eef2411af3
SHA512ca7e8469ae8dd796615dc180ad1bd30ac61ffdb8884d8acec3f8b45cfe8d674447c29cc7d0790b82a882aa3dae9cf67d5c60c3cb439fab9f65575811adaf2b05
-
Filesize
564B
MD5374ad37fb66a683bf71b07c85d49d6b5
SHA1ff4b75e99020b10563def797f41a1407259f138c
SHA256f5adde09ab867056525d0fa3157b1e1b160db9e2f71b654a5082a117bb0e2b5f
SHA512be97aec459c4c4628ebed7fb65c69c81a647c035503a5db2332ece7114cfd698a594794952de4a50b4b9333f6d4462f6017df18e720f522333bac73b2fada6f0
-
Filesize
490B
MD5b872a712ea4dc00375ee3ba17ecb4229
SHA16d13a441b67c2bd029e29eb803610e59d73f46b2
SHA256a12aa10eb0e66ed38b12d4f709cf4ff45e57736647b6f00fe2660ea9912c3dab
SHA51241523197576321980006658b568dca8830d8d14326909f11626f7f8eec8585eb4b59ddf709c77ab2be15b71f46a1446b2f316f5b497015718960839e885ff1ab
-
Filesize
506B
MD5d700c0e109fc41cbccb2e195aa2daf01
SHA12a192b3521535d8df943bad4ee04d5bc13500395
SHA256074cde8ed9ad45493cd24f90087c6b03c01808874a87fe0174b8f77cb53dcc68
SHA512c379fb901805f92dbf0912e6d9bd66ced2659ac21fdc78265fe2f78325eab505ffad8434493b626e38ebb99faf3c2c5e0e5ca0260c194924d61458b3bd79e198
-
Filesize
778B
MD57ebac7677d00f1bf34f59c223907a799
SHA1f3fa962561d1d1bd7fc58a0a68c98204636cf6b2
SHA256df0406c366458200e663741c36b76516cac2edebc3bd2ad939f72e3b5e7714d8
SHA512a0ad9648b3f0b0e30358393feda1196dd21e2a3cc46d41133e09edc0148a685f922abbc1c5b337bf5b942b8c31e93979a53aafa96064eec5f5ba49478a5c8d04
-
Filesize
696B
MD54c4f14234641dc8d88744839eebbf39e
SHA1a2b97844e0b9e28254af0cbc884c472f20046420
SHA256ee6cae41c5e71a48bb83d579d00db2b615fb1710f037914606671e4dd44cb2df
SHA512bb3463753b855b9578ef5e083b418aaa816b0b686c69835b13826bbca9600363fffbface12b9433aaf84258ea79c921a38aa21539c1c05d47c9c8d92a817cd6a
-
Filesize
402B
MD5368c3e7eed5031ca748a913b675c41e7
SHA195c22aeab4bd57d22706da092457f97c96c482a8
SHA2569f9a9152cad10b863b7e585b5e50a05c271dd73fbdfbf6df5c37222da0eb3d3b
SHA512b682455238f57a7b5f7e46ac7d7345d3c981093f02dbe1bb46cbfe8dd4e5ac9e6b3e0b2831f56d61acfeeee212d3766111b85032081abb13e45b04659e0d4ba0
-
Filesize
606B
MD52916e08714b8685caaee85ce3d4257a6
SHA1b9f54b27f6798c393c937081fa9e5b9e99b4f93a
SHA256e64a2746b7a2a73d422728c08aa9a694f8e3bd40b9d8e3869a3e57b854724ece
SHA512d3482f6f850b177bb736bc430644209e7f65422b949351fd43ce3a14af423357fed8053a430949ce7d20f4645e1e08b3491b745366cd3e4042c0c6d3e107a990
-
Filesize
452B
MD5cf352ed37f4a54bf7a7e07121504cd4f
SHA11deeb11b269ce3db9fbc81855d5ac5307d1bd798
SHA256bc8e882ecdb14abd3f168275d53fbc3577b58e5350c06fe8985582402414d429
SHA5124634aeed613f9874b55d3ac3c1007bbefeb0836baa3be7305d9c30e74c03a9047a6243c9cec666758bb111ea86fbb63348119f05800d8e81735f4d8b6d30666e
-
Filesize
490B
MD5b6d51080cb50efc33b17011f9ed79fb1
SHA15cca986e67f99c744a9bc796c1f3f644de59cc0d
SHA2563bd32253f0beb6ec0c2aa2f40e95ab48174a4c77b9c492e0f5aacd357464090a
SHA512bd2349a69b96d52a280c7635439987c152a3339fb6b8e166ec13dbd9152ac0b35ba2870239eee4b19b0856f7ddea98a83ec1118c37805ea1124719b2845e3560
-
Filesize
420B
MD5243cb7e63c75a954abe8166f98700ab1
SHA1aa0aadf8c230331dc66d2d42cf08cec57b05b487
SHA256f6ed4dccb51f71aafa2a6a8d0f6c61879dfa7845956e9ae5caecd1e16792bb00
SHA512823e5b619e70cb8a26ea65cceb936d00e5ee5d8879e348249591b1b725603fd7b493652083abc67c27687164d3fe42f38ff120c0750b19155f3bf7c24771cd5a
-
Filesize
436B
MD51b45bcb64999b3c2a32b40944e6b064c
SHA1ba91238e63e77c96b7932c4125458b75cab1d21c
SHA256abb2cd76e5e1bc6e44322b7238b1405518c8a13907ca00f8065cc6d2cda4eb39
SHA5127b5f4d920f0d3486675ec08444c25e9641be0584eddcc406269ea3a017414d919e3213503c22e158411c4708d752e3073767ebdad2afefa6342d6a34b106774b
-
Filesize
452B
MD5162fe0143cbd186687d0bf8270a916de
SHA18b165d21bf8677092c4d0b95eeff0006243752b2
SHA256b5696dd237b94c5886b72b4e012572ebc15de7e33b48c6419e9d950596d1075c
SHA51270c325271ea80749275940a5cc1064bb8d547b5b4dd7dc30738cc03a707443350206930ffaae177113351bca528af2d99d2b1349d595d332bf836872f1039fc0
-
Filesize
272B
MD53dcdb004fdccbb65aa2911d9ba2da3a3
SHA1c77644ebb7ec7c5ebb72e2fb9070a8704a863001
SHA256124142fd5b1f28284c52cb1ae5069b8a9c19584a77598e287dbc1829c6b840d0
SHA51251745d4f3ebe11222a1b8a87f9781f4848283e836c7bf3d5b352fbdd8b6d442602beec66adaacfcc71765b9980f83da43a7356f562bbd9c90c131be5d1c1e087
-
Filesize
608B
MD5bdccab20a182ac7d79bddda15e444d6e
SHA15c75b3d3495dd9625dde20afeb72ea17cac28c6f
SHA2568c6026eb83667797a8106c33933b5f374b92370c65ddf695c8cad4ebb0054c03
SHA5123ba43cc0592b07bea27041cef72ad3445a381af1607b4c5ec8aff1d6875a7fe4c985c6fcf45d8020965e4aef9194405e367f1fc2faeacb46ff2a40167a40a765