Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/03/2024, 15:04 UTC
Static task
static1
Behavioral task
behavioral1
Sample
c35f5e69c5c8bdbf035c498bcae432d4825f4557b960b475b0df9c004dba804f.doc
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c35f5e69c5c8bdbf035c498bcae432d4825f4557b960b475b0df9c004dba804f.doc
Resource
win10v2004-20240226-en
General
-
Target
c35f5e69c5c8bdbf035c498bcae432d4825f4557b960b475b0df9c004dba804f.doc
-
Size
292KB
-
MD5
2d243ccd8ff84c25fb9149ebf7766653
-
SHA1
ec2ae69054e3feaeea0cef0e647e3d87d7a7a4d8
-
SHA256
c35f5e69c5c8bdbf035c498bcae432d4825f4557b960b475b0df9c004dba804f
-
SHA512
f7d8f82681f6e79ad2cb225d7bf8e883c147373234ee7436a1344ac40e6db8ef10a59109cfc9b0ca89dd890a5c75e2e61fe0346331db4fc1cce67b6efe2eb99e
-
SSDEEP
6144:iLfhRGxoj8TyvcMkcuGiP7au99jxWbXFLtJu1wp:2fuxom+kcGP2uPABLW+
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2156 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 2156 WINWORD.EXE 2156 WINWORD.EXE 2156 WINWORD.EXE 2156 WINWORD.EXE 2156 WINWORD.EXE 2156 WINWORD.EXE 2156 WINWORD.EXE 2156 WINWORD.EXE 2156 WINWORD.EXE 2156 WINWORD.EXE 2156 WINWORD.EXE 2156 WINWORD.EXE 2156 WINWORD.EXE 2156 WINWORD.EXE 2156 WINWORD.EXE 2156 WINWORD.EXE 2156 WINWORD.EXE 2156 WINWORD.EXE 2156 WINWORD.EXE 2156 WINWORD.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\c35f5e69c5c8bdbf035c498bcae432d4825f4557b960b475b0df9c004dba804f.doc"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2156