Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    14/03/2024, 02:42

General

  • Target

    c779e0f58297c6c9f17d38c1fdf973e2.doc

  • Size

    40KB

  • MD5

    c779e0f58297c6c9f17d38c1fdf973e2

  • SHA1

    cb0a0ac27dc7dca7757a37b76bea45dfcc2671ab

  • SHA256

    df51180c6950068f1b3ea41ae7389f81d315e0f91b9f6bfe6833bb8ea2f724d4

  • SHA512

    9928051fdbb96fc601440839857eb847b0c0be0733ef3026cfd209346bd23fc7f3601dfa5ba2ca2c619a33fe4507d713b5b322f0de9860573af8999bd6b9a2a5

  • SSDEEP

    192:mqEDoSZVVxsm0b5OmW0037gdTgm5ou0cDpAzboAyaMNHXL5Xn6zo+mcAz02oH9vG:mfbHSOmI7gZgEou0cDazbomVBAQ2AUm

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\c779e0f58297c6c9f17d38c1fdf973e2.doc"
    1⤵
    • Deletes itself
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1696
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1628

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\c779e0f58297c6c9f17d38c1fdf973e2.doc

      Filesize

      49KB

      MD5

      2ec86b6445385fd297e91184bfcf97cd

      SHA1

      aaf482994bb1f8e79f19eff7509c7b9416c481ea

      SHA256

      4c97c533a0b21132eb17ba39865ef68788f5055f84d2d1adea4e6e3136211ef1

      SHA512

      e0851b1cede06dc848463d402275c4f7952616d34b56174366f959242a5ab8803d3123382dfad68c5bc5d58dfdbf8535ddd377050122dbaa2323dedc938ea850

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      25KB

      MD5

      dd1043b0319015fdb8964e07f152f1ad

      SHA1

      76a83ca7d64449ea82a8dc4042334cce1c241925

      SHA256

      4c03afed84bb7a9693fcc031805d6f5c0ea1c90ecc57393fd34307d0da518cdf

      SHA512

      f735818029e5b983c3bdd9648c8fdf9bda602a57d5e39b9ef59fe62943a1191a8f437c3d962f566eca3ffcd8dd321a831414367960e7b5b5c00dedfe6bab9848

    • C:\ascii.vxd

      Filesize

      1KB

      MD5

      307774863062cba7c405b1ef6dc09199

      SHA1

      ae0c0ea189e1135f9f521949f82b4c37b3fdca63

      SHA256

      1571c1a999addd300b618374a186d7e105fc8c9b012611d576d695f3659dd110

      SHA512

      6abee8d8ae7d5712fea87b100b7948662f8075d2761d4351df8e4b6a689ce1a8e94575dba1fbd207316163e13e21efa3ed236904d28364f7c07a90467fa0ea07

    • memory/1696-11-0x0000000000690000-0x0000000000790000-memory.dmp

      Filesize

      1024KB

    • memory/1696-17-0x0000000000690000-0x0000000000790000-memory.dmp

      Filesize

      1024KB

    • memory/1696-18-0x0000000000690000-0x0000000000790000-memory.dmp

      Filesize

      1024KB

    • memory/1696-20-0x0000000000690000-0x0000000000790000-memory.dmp

      Filesize

      1024KB

    • memory/1696-21-0x0000000000690000-0x0000000000790000-memory.dmp

      Filesize

      1024KB

    • memory/1696-22-0x0000000000690000-0x0000000000790000-memory.dmp

      Filesize

      1024KB

    • memory/1696-0-0x000000002F281000-0x000000002F282000-memory.dmp

      Filesize

      4KB

    • memory/1696-2-0x0000000070ABD000-0x0000000070AC8000-memory.dmp

      Filesize

      44KB

    • memory/1696-45-0x0000000070ABD000-0x0000000070AC8000-memory.dmp

      Filesize

      44KB

    • memory/1696-46-0x0000000000690000-0x0000000000790000-memory.dmp

      Filesize

      1024KB

    • memory/1696-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1696-63-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB