Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

18/04/2024, 11:18

240418-ned1xsbd66 10

18/04/2024, 11:18

240418-nea92abd64 10

18/04/2024, 11:18

240418-neay9scf7z 10

18/04/2024, 11:18

240418-neacqscf7y 7

18/04/2024, 11:18

240418-nd92zacf7x 7

18/04/2024, 09:59

240418-lz5chaba8t 7

Analysis

  • max time kernel
    147s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    18/04/2024, 11:18

General

  • Target

    0145f04a8356780d52774ce5f7dd0a02f6d5b321694ed805ce3e27bdf04d3c94.exe

  • Size

    371KB

  • MD5

    eafe645b56c3f5cb746fb5f8504f6035

  • SHA1

    f539987de9fe59bff20483ac7a124afafc27036b

  • SHA256

    0145f04a8356780d52774ce5f7dd0a02f6d5b321694ed805ce3e27bdf04d3c94

  • SHA512

    61af2cfa960a72b66d54d0ee121acb5c54d455b05eb85fb2d7df2958d3134d348c87a5aef2aa46319532407f7ebf01eaedfb8dd889bb0f67ce5edc067445e806

  • SSDEEP

    6144:hnzQnu/cmM1oSigOQT2F8U92Iu7DMVQZhWLv3RXdYX9ji+uhi2PsrhY:dzQnkM1oSiBGI8bxn5W6i+uo20tY

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 3 IoCs

    Detects file using ACProtect software.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0145f04a8356780d52774ce5f7dd0a02f6d5b321694ed805ce3e27bdf04d3c94.exe
    "C:\Users\Admin\AppData\Local\Temp\0145f04a8356780d52774ce5f7dd0a02f6d5b321694ed805ce3e27bdf04d3c94.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0145f04a8356780d52774ce5f7dd0a02f6d5b321694ed805ce3e27bdf04d3c94.rtf"
      2⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2496
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2268

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\0145f04a8356780d52774ce5f7dd0a02f6d5b321694ed805ce3e27bdf04d3c94.rtf

      Filesize

      4KB

      MD5

      2d5020c82de674b48cfd17cc20fcbba2

      SHA1

      4e317eaeebd839ee5f6eb3925a9fbee819c5349c

      SHA256

      120becd55248f4a2ccbbc99ba9d3c2932223264a95cd72e9ae7568be61277e9a

      SHA512

      ffbbdda009237d6825f6cd6f751a41f4f9d716186901ffdbeed56c2d1410245771decd07f591cf56cafdd4bbebd4e4c74f009ff15736d5321635e34ff17d0d8d

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      40473537aa524d670e5e82decddb1d03

      SHA1

      ddd61e5e2ed96736553f074ae11aad7de4a071c3

      SHA256

      bf7ac1b62e44c1d164e8ae32a711b82b5ac2c2e264590493aeb1b39191b8e763

      SHA512

      529e36e44f1a0b9176df7542b23b367b308d6aa7b445c50be6ede7b3ff0aae981fff8cd41cbc3de7870487e8d65f23367f3fa49dbef88f743412701e13bf97ea

    • memory/1636-26-0x0000000000400000-0x0000000000461000-memory.dmp

      Filesize

      388KB

    • memory/1636-43-0x0000000002D30000-0x0000000002D58000-memory.dmp

      Filesize

      160KB

    • memory/1636-4-0x0000000002DA0000-0x0000000002DF8000-memory.dmp

      Filesize

      352KB

    • memory/1636-5-0x00000000007E0000-0x00000000007E1000-memory.dmp

      Filesize

      4KB

    • memory/1636-6-0x0000000000400000-0x0000000000461000-memory.dmp

      Filesize

      388KB

    • memory/1636-10-0x0000000000400000-0x0000000000461000-memory.dmp

      Filesize

      388KB

    • memory/1636-8-0x0000000000400000-0x0000000000461000-memory.dmp

      Filesize

      388KB

    • memory/1636-14-0x00000000007E0000-0x00000000007E1000-memory.dmp

      Filesize

      4KB

    • memory/1636-1-0x00000000007E0000-0x00000000007E1000-memory.dmp

      Filesize

      4KB

    • memory/1636-47-0x0000000000400000-0x0000000000461000-memory.dmp

      Filesize

      388KB

    • memory/1636-46-0x0000000002D30000-0x0000000002D58000-memory.dmp

      Filesize

      160KB

    • memory/1636-2-0x00000000007E0000-0x00000000007E1000-memory.dmp

      Filesize

      4KB

    • memory/1636-0-0x0000000002DA0000-0x0000000002DF8000-memory.dmp

      Filesize

      352KB

    • memory/1636-28-0x0000000010000000-0x0000000010012000-memory.dmp

      Filesize

      72KB

    • memory/1636-3-0x00000000007E0000-0x00000000007E1000-memory.dmp

      Filesize

      4KB

    • memory/1636-38-0x0000000001FE0000-0x0000000001FE8000-memory.dmp

      Filesize

      32KB

    • memory/1636-31-0x0000000010000000-0x0000000010012000-memory.dmp

      Filesize

      72KB

    • memory/1636-35-0x0000000010000000-0x0000000010012000-memory.dmp

      Filesize

      72KB

    • memory/1636-33-0x0000000001FE0000-0x0000000001FE8000-memory.dmp

      Filesize

      32KB

    • memory/1636-32-0x0000000010000000-0x0000000010012000-memory.dmp

      Filesize

      72KB

    • memory/1636-39-0x0000000001FE0000-0x0000000001FE8000-memory.dmp

      Filesize

      32KB

    • memory/1636-40-0x0000000002D30000-0x0000000002D58000-memory.dmp

      Filesize

      160KB

    • memory/1636-34-0x0000000010000000-0x0000000010012000-memory.dmp

      Filesize

      72KB

    • memory/1636-44-0x0000000002D30000-0x0000000002D58000-memory.dmp

      Filesize

      160KB

    • memory/2496-17-0x00000000714FD000-0x0000000071508000-memory.dmp

      Filesize

      44KB

    • memory/2496-16-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2496-48-0x00000000714FD000-0x0000000071508000-memory.dmp

      Filesize

      44KB

    • memory/2496-15-0x000000002FBB1000-0x000000002FBB2000-memory.dmp

      Filesize

      4KB

    • memory/2496-75-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB