Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    101s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    24/04/2024, 05:46

General

  • Target

    390887d6627a4de66aac8349c57a495a.rtf

  • Size

    79KB

  • MD5

    390887d6627a4de66aac8349c57a495a

  • SHA1

    aec3c18736f1ab675276c7b21076b0b48c3251a7

  • SHA256

    4aefad6748025172503bac223b804d8de0dc741483409c7f19bc29b1859ba0bb

  • SHA512

    b0a8fc3d7d833d972c9b63d79725ec72cbce81ddcbd2d0f4106ca7c626ae6749b989128533f022638e2b7cb71719e5d9ad0038fc93f63e9fb2bab584df903c5a

  • SSDEEP

    1536:pcRtvbj0t9HSA0bWlK1X1Rd4sB6E1c8nchY9OIn4lOUoxemkQiQTVQpeqttSWs7L:qRFbj0t9VK1X1Rd4sBXc8ncS9OIn4l6h

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\390887d6627a4de66aac8349c57a495a.rtf"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2360
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:2820
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\InternetMonkeyloverkissoff.vbs"
        2⤵
        • Blocklisted process makes network request
        PID:2572

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\InternetMonkeyloverkissoff.vbs

      Filesize

      86KB

      MD5

      f298cc29054bc56d193e76414d436b2c

      SHA1

      f521a11c9e63022ae0a7228117ca6aea51a23f82

      SHA256

      b0e22909bea588ce8ab5dfb7d8a624b2e262dab70d4eaced092060872aa44a6e

      SHA512

      882aa14f083185e624198b4ade4c2a972305e2062928c2363ec14c3aacc6aa0902e98adaf63d8c641d3a015629601a9940b230826328d250ed788d2a744f536c

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      c7f4e042f547559ff40c173cf514dc2c

      SHA1

      05ea5188f38d566732ab962b3322cf5f4c97d61b

      SHA256

      af5f30d79f5c1b44c035f9b545af093dabcde93cec5c4239ed0ef7e1fe85e21d

      SHA512

      66d426a43edb6ccbee3c27bd2802c949c5ff605201e4c25bce240237d687886c1eafae0ea6ca1fe4ad421956dadf9a86c74f8d2dc97790e05da271b077f3d6ae

    • memory/2236-0-0x000000002F931000-0x000000002F932000-memory.dmp

      Filesize

      4KB

    • memory/2236-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2236-2-0x0000000070CCD000-0x0000000070CD8000-memory.dmp

      Filesize

      44KB

    • memory/2236-33-0x0000000070CCD000-0x0000000070CD8000-memory.dmp

      Filesize

      44KB

    • memory/2236-51-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB