Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    03/05/2024, 02:19

General

  • Target

    fce215d41328ca3cc043df67cdd2adf2048e56a063dcf2ebc7b6d56c82a4b291.rtf

  • Size

    79KB

  • MD5

    844d25a95681bdf377d72dc961fe7357

  • SHA1

    6d4af02a91d8ab9567dd01df5e951297187d825c

  • SHA256

    fce215d41328ca3cc043df67cdd2adf2048e56a063dcf2ebc7b6d56c82a4b291

  • SHA512

    c76fe2557fe314368144cdfdf85dfa6fd78c37d0dd25f4a91678828773ca3ebe355533444e0e5a288c25bd14281baa1d9cafd785a587cffbcba3e145c78ba760

  • SSDEEP

    1536:Ekge5lutw2AC785LKTzfHO8txH8vznDuKqp6AQSO/ZBOACSb/m5wjeBQYVam/o:7ktw2Ao85LKTzfHOsB8r6V6AjO/ZBOAl

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\fce215d41328ca3cc043df67cdd2adf2048e56a063dcf2ebc7b6d56c82a4b291.rtf"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1136
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1472
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:2116
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\beautifulpictureforcouples.vbs"
        2⤵
        • Blocklisted process makes network request
        • Enumerates connected drives
        PID:2828

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      0e8657e320fbc4e3ef6acf9b2175ed87

      SHA1

      074a5b8d0b17d3c4a9a3e5c2fe53621196e7ba32

      SHA256

      22e237488686a7ee202b5a55e95aea64dd3f700339b5253def0207453900da9f

      SHA512

      bfa6054fadb05648ef2b5bf3b9ab408e8a13da0e4c1c55d372857eee2fbef4714e48acf5c7e5732764d27c920a6b5ecbf1ba89deba6409d3f8336fc1ab9354f0

    • C:\Users\Admin\AppData\Roaming\beautifulpictureforcouples.vbs

      Filesize

      61KB

      MD5

      bd681a983ebbab5ad4d5ec646d94ddad

      SHA1

      eb9ee314c18f216c3ea61037c12f6f07e6ac6a99

      SHA256

      238416dfb090d60fa1d745a0fe4980cf99b2af9d820293f94bd19f66bb3d7b8d

      SHA512

      6247f473185c5ec6e003929beb4d076ebb62a62f3bd2a7c9f7e550c49fed9339336779d8ea4c1167aa7b8266ee548865ee517918a7a2b9841b15e69f85c942eb

    • memory/1136-0-0x000000002F5D1000-0x000000002F5D2000-memory.dmp

      Filesize

      4KB

    • memory/1136-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1136-2-0x000000007138D000-0x0000000071398000-memory.dmp

      Filesize

      44KB

    • memory/1136-33-0x000000007138D000-0x0000000071398000-memory.dmp

      Filesize

      44KB

    • memory/1136-51-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB