Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    02/05/2024, 16:08

General

  • Target

    844d25a95681bdf377d72dc961fe7357.rtf

  • Size

    79KB

  • MD5

    844d25a95681bdf377d72dc961fe7357

  • SHA1

    6d4af02a91d8ab9567dd01df5e951297187d825c

  • SHA256

    fce215d41328ca3cc043df67cdd2adf2048e56a063dcf2ebc7b6d56c82a4b291

  • SHA512

    c76fe2557fe314368144cdfdf85dfa6fd78c37d0dd25f4a91678828773ca3ebe355533444e0e5a288c25bd14281baa1d9cafd785a587cffbcba3e145c78ba760

  • SSDEEP

    1536:Ekge5lutw2AC785LKTzfHO8txH8vznDuKqp6AQSO/ZBOACSb/m5wjeBQYVam/o:7ktw2Ao85LKTzfHOsB8r6V6AjO/ZBOAl

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 6 IoCs
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\844d25a95681bdf377d72dc961fe7357.rtf"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2352
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2776
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:3024
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\beautifulpictureforcouples.vbs"
        2⤵
        • Blocklisted process makes network request
        • Enumerates connected drives
        • Modifies system certificate store
        PID:2856

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      9d21bb8ddf42cce59acc09cce8dc4cdb

      SHA1

      7a452629fa3fd500b038f62a8d1cd3fe2b666bfb

      SHA256

      3b761e02d5e54b1e8dddd79fac854fdc36f9265e0d0aa5972f91e795ac93430e

      SHA512

      a926647f4cb6193f25b4d347702e941271b8a537f25a2799e347425a530909681327d66514372aeaf76b86f968c600ff5e9161c83b974ae7d7bcc66d99f64700

    • C:\Users\Admin\AppData\Roaming\beautifulpictureforcouples.vbs

      Filesize

      61KB

      MD5

      bd681a983ebbab5ad4d5ec646d94ddad

      SHA1

      eb9ee314c18f216c3ea61037c12f6f07e6ac6a99

      SHA256

      238416dfb090d60fa1d745a0fe4980cf99b2af9d820293f94bd19f66bb3d7b8d

      SHA512

      6247f473185c5ec6e003929beb4d076ebb62a62f3bd2a7c9f7e550c49fed9339336779d8ea4c1167aa7b8266ee548865ee517918a7a2b9841b15e69f85c942eb

    • memory/2352-0-0x000000002F061000-0x000000002F062000-memory.dmp

      Filesize

      4KB

    • memory/2352-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2352-2-0x0000000070FAD000-0x0000000070FB8000-memory.dmp

      Filesize

      44KB

    • memory/2352-51-0x0000000070FAD000-0x0000000070FB8000-memory.dmp

      Filesize

      44KB

    • memory/2352-69-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB