Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2024, 12:11

General

  • Target

    7d887e39bbb67f8c50cd36743e2b98ba96e6df226aa49e38c51c919cf2ec8c8e.pps

  • Size

    682KB

  • MD5

    cb0bd0bf38342c8fda2b6f8ae761c46d

  • SHA1

    a6a19a8f1d1ba6f1d6a0b3494288120f3521d28b

  • SHA256

    7d887e39bbb67f8c50cd36743e2b98ba96e6df226aa49e38c51c919cf2ec8c8e

  • SHA512

    9592aa6ab053c5ca34f0677226a9c7a04f40bfeaefa4160ed82930d4acc42fb2026470fc048f50b703ba5d409a3274bbade4d26388ec67a9628e0aef4eac1418

  • SSDEEP

    12288:5iXupIuCH0bz1NInOlNT15kQfnxeYnWzAlNT15BQrxs9V:5iX6ITonx5kAFKxs

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\AppData\Local\Temp\7d887e39bbb67f8c50cd36743e2b98ba96e6df226aa49e38c51c919cf2ec8c8e.pps" /ou ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4352

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4352-0-0x00007FFB3AF10000-0x00007FFB3AF20000-memory.dmp

    Filesize

    64KB

  • memory/4352-3-0x00007FFB7AE90000-0x00007FFB7B085000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-1-0x00007FFB3AF10000-0x00007FFB3AF20000-memory.dmp

    Filesize

    64KB

  • memory/4352-2-0x00007FFB3AF10000-0x00007FFB3AF20000-memory.dmp

    Filesize

    64KB

  • memory/4352-4-0x00007FFB7AE90000-0x00007FFB7B085000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-6-0x00007FFB3AF10000-0x00007FFB3AF20000-memory.dmp

    Filesize

    64KB

  • memory/4352-5-0x00007FFB3AF10000-0x00007FFB3AF20000-memory.dmp

    Filesize

    64KB

  • memory/4352-7-0x00007FFB7AE90000-0x00007FFB7B085000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-10-0x00007FFB7AE90000-0x00007FFB7B085000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-9-0x00007FFB7AE90000-0x00007FFB7B085000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-8-0x00007FFB38CB0000-0x00007FFB38CC0000-memory.dmp

    Filesize

    64KB

  • memory/4352-11-0x00007FFB7AE90000-0x00007FFB7B085000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-12-0x00007FFB38CB0000-0x00007FFB38CC0000-memory.dmp

    Filesize

    64KB

  • memory/4352-13-0x00007FFB7AE90000-0x00007FFB7B085000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-14-0x00007FFB7AE90000-0x00007FFB7B085000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-15-0x00007FFB7AE90000-0x00007FFB7B085000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-16-0x00007FFB7AE90000-0x00007FFB7B085000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-17-0x00007FFB7AE90000-0x00007FFB7B085000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-18-0x00007FFB7AE90000-0x00007FFB7B085000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-19-0x00007FFB7AE90000-0x00007FFB7B085000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-20-0x00007FFB7AE90000-0x00007FFB7B085000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-21-0x00007FFB7AE90000-0x00007FFB7B085000-memory.dmp

    Filesize

    2.0MB

  • memory/4352-59-0x00007FFB3AF10000-0x00007FFB3AF20000-memory.dmp

    Filesize

    64KB

  • memory/4352-60-0x00007FFB3AF10000-0x00007FFB3AF20000-memory.dmp

    Filesize

    64KB

  • memory/4352-61-0x00007FFB3AF10000-0x00007FFB3AF20000-memory.dmp

    Filesize

    64KB

  • memory/4352-62-0x00007FFB3AF10000-0x00007FFB3AF20000-memory.dmp

    Filesize

    64KB

  • memory/4352-63-0x00007FFB7AE90000-0x00007FFB7B085000-memory.dmp

    Filesize

    2.0MB