Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
12/03/2024, 15:15 UTC
Static task
static1
Behavioral task
behavioral1
Sample
654bb8d3fb077affd795af90c23934a50c61e96ae5d3ff694366535468dcf9ca.doc
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
654bb8d3fb077affd795af90c23934a50c61e96ae5d3ff694366535468dcf9ca.doc
Resource
win10v2004-20240226-en
General
-
Target
654bb8d3fb077affd795af90c23934a50c61e96ae5d3ff694366535468dcf9ca.doc
-
Size
8KB
-
MD5
b39be9e3d8bcd48167c35e4d15a6f28f
-
SHA1
9770bab690febc2ed77052263570a2206cf85e40
-
SHA256
654bb8d3fb077affd795af90c23934a50c61e96ae5d3ff694366535468dcf9ca
-
SHA512
3b387a60a857cd9bb33bb99d7518c6d9acce37252b44c32cb9715cf84d5a711be579da758810c2879b7113d7f7c24ba7a32336062f725dcf4819878d5988009e
-
SSDEEP
96:m4BWSBOEo98tVbaCoub1vzg+X4GjhliTt85uIiCGtcFiaaFLjix:mDZ6XP1jhet6BGtQa
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2932 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 2932 WINWORD.EXE 2932 WINWORD.EXE 2932 WINWORD.EXE 2932 WINWORD.EXE 2932 WINWORD.EXE 2932 WINWORD.EXE 2932 WINWORD.EXE 2932 WINWORD.EXE 2932 WINWORD.EXE 2932 WINWORD.EXE 2932 WINWORD.EXE 2932 WINWORD.EXE 2932 WINWORD.EXE 2932 WINWORD.EXE 2932 WINWORD.EXE 2932 WINWORD.EXE 2932 WINWORD.EXE 2932 WINWORD.EXE 2932 WINWORD.EXE 2932 WINWORD.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\654bb8d3fb077affd795af90c23934a50c61e96ae5d3ff694366535468dcf9ca.doc"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2932