Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/03/2024, 14:33
Behavioral task
behavioral1
Sample
52211541d8cb47134dcb67c14a2c851edfeb5191d489916b2f691b4fe15b312a.doc
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
52211541d8cb47134dcb67c14a2c851edfeb5191d489916b2f691b4fe15b312a.doc
Resource
win10v2004-20240226-en
General
-
Target
52211541d8cb47134dcb67c14a2c851edfeb5191d489916b2f691b4fe15b312a.doc
-
Size
372KB
-
MD5
cca002334f80fe18f0ea49263f8519aa
-
SHA1
ba6b2d4f9be0421c9b75e07c54c4b6fc88887d94
-
SHA256
52211541d8cb47134dcb67c14a2c851edfeb5191d489916b2f691b4fe15b312a
-
SHA512
d774f35ff4989c156a461b132ed3e7eddf68b8006fd8f3cc38586de89cb45ff2afbb16b373c9f4f6509659441b0e4e819c93798cf72b00b3720f356ca182b088
-
SSDEEP
3072:LvuaXv2UlZoXUS8WbCA9U2xmYhp3y4/20qlGaOlko0uGQWslNXGEqR3RLO3fokwJ:A31YGV0k36+qvvApW+XG
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2388 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 2388 WINWORD.EXE 2388 WINWORD.EXE 2388 WINWORD.EXE 2388 WINWORD.EXE 2388 WINWORD.EXE 2388 WINWORD.EXE 2388 WINWORD.EXE 2388 WINWORD.EXE 2388 WINWORD.EXE 2388 WINWORD.EXE 2388 WINWORD.EXE 2388 WINWORD.EXE 2388 WINWORD.EXE 2388 WINWORD.EXE 2388 WINWORD.EXE 2388 WINWORD.EXE 2388 WINWORD.EXE 2388 WINWORD.EXE 2388 WINWORD.EXE 2388 WINWORD.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\52211541d8cb47134dcb67c14a2c851edfeb5191d489916b2f691b4fe15b312a.doc"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2388