Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
12/03/2024, 21:56
Behavioral task
behavioral1
Sample
b35aa8ee68cd07ca5121a82d64f0b1ab5585f706baea571b86149585d1e7703c.doc
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b35aa8ee68cd07ca5121a82d64f0b1ab5585f706baea571b86149585d1e7703c.doc
Resource
win10v2004-20240226-en
General
-
Target
b35aa8ee68cd07ca5121a82d64f0b1ab5585f706baea571b86149585d1e7703c.doc
-
Size
360KB
-
MD5
9e34c83123604f993e0674e1cdb02ca2
-
SHA1
dde946255f27595f01d1d3d16ce6ed34b2fbd4da
-
SHA256
b35aa8ee68cd07ca5121a82d64f0b1ab5585f706baea571b86149585d1e7703c
-
SHA512
bbafddf4dcc5bdf30fdf3819c647b1196babdf243ebc4f630279dc82847b805be8df598c427588d1bb58cc8e20b722f8290e4ef17a5a4ac951a2cf1f5590de69
-
SSDEEP
6144:cbHh5DeWHIXFDhxURm80i5TvW7Dmul6F/b+kAo:KHh5DeWHIXFDhxURCIW7quAF/Dx
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2176 WINWORD.EXE 2176 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 2176 WINWORD.EXE 2176 WINWORD.EXE 2176 WINWORD.EXE 2176 WINWORD.EXE 2176 WINWORD.EXE 2176 WINWORD.EXE 2176 WINWORD.EXE 2176 WINWORD.EXE 2176 WINWORD.EXE 2176 WINWORD.EXE 2176 WINWORD.EXE 2176 WINWORD.EXE 2176 WINWORD.EXE 2176 WINWORD.EXE 2176 WINWORD.EXE 2176 WINWORD.EXE 2176 WINWORD.EXE 2176 WINWORD.EXE 2176 WINWORD.EXE 2176 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\b35aa8ee68cd07ca5121a82d64f0b1ab5585f706baea571b86149585d1e7703c.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2176
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:81⤵PID:3676