Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28/05/2024, 18:01

General

  • Target

    Постанова про створення слідчої групи.docm

  • Size

    116KB

  • MD5

    1c51dcfec855841fbd2d1952083d8aaa

  • SHA1

    37740bcc95f5b54ab4d1fe305314171219b7e00f

  • SHA256

    ae473d07d944f559e365f0dfe60c54b82d12c6eb9ab50251561e2355b5e6a950

  • SHA512

    47b81ebd7b4cffac1aad383fb3ea52f2e38e25cb9888cb984c55d72c32d704689b0ae7cbb97ae09789d065611fb210c7fe4054c80759541ab5ec446b1e431393

  • SSDEEP

    3072:aeDBY47dxw8YnGFyD3IJAPQvHgp7s5qRQydB:ae/dilnQyx+PcRQ6

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 5 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Постанова про створення слідчої групи.docm"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1728
    • \??\c:\Users\Public\ctrlpanel.exe
      c:\Users\Public\ctrlpanel.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:1976
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2280
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
      1⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1420
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
      1⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2292
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
      1⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2932
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
      1⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1368

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\MSO1033.acl

      Filesize

      36KB

      MD5

      69c266548d1b30386a8cb3627e2d4dab

      SHA1

      daa86bcd73d5a4a494a4a122452ce03652ecd44e

      SHA256

      b2ab6a748cbb6dd2801d3a47631dd149ce490f74604b8ab54aad29c989da7dc2

      SHA512

      fc8cc252375b7b66bece26d5ab881a5a77e51bac6bde6bc5d68d9598db3a460e1d8f7c4342d725b62a249a6d83612dcf56ec27b49d512813304eb5f16ed1d0be

    • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

      Filesize

      55B

      MD5

      b04fd3884038b13390e7a065db5af8e8

      SHA1

      77766abc66b4466c2bbbf7c95ffce8e88888cb2a

      SHA256

      dbfc917519388f434307e61f1e03c6d76817d90ff746217f0f9c06858c3c3650

      SHA512

      a1739f2774f4bb11335eaec921a76736a0f5ec3a98c04fbf0777e902c07c640bc90f4806710d12e34f9f51d855044f007a1519f779eaf1754e533134b2a0e8e4

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      421177138715ea7722e63265febb97d0

      SHA1

      8f849fba56fe951c6297028e4616e22f0905edd0

      SHA256

      ea0635700981268d6255131bf464645a1a6f0713cc18003734b83518800cb15b

      SHA512

      81402bfe9dc849784eaea4412c0a6434b13d915a23478ccb60ef7923323ae76ad854b8c47d7d40e1757b0c0295466696f1f13fdede13a44ca18ad0158511f04f

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      db1a9a100693d9bf244e15058d949cbb

      SHA1

      a49efc6cfcb5219f18f68c65b3091874f2598658

      SHA256

      c907e2875b8a33648dd3a1820637767db670abe1898c53d07555aa216f72f05b

      SHA512

      c1106736633b87d8b9196821b9e5e4b8232b82d399a59d9f0220c8edb8fbfce955cfcf2c77c50e8ee1771440088a9b3509e56fe06b96d6fcfda12b63f131b491

    • \??\c:\Users\Public\ctrlpanel.exe

      Filesize

      34KB

      MD5

      40d2ccd570bd898cc31af1cbfe5fb08e

      SHA1

      41d81d3275f8fe7be023b9731519cdf359743818

      SHA256

      10e720fbcf797a2f40fbaa214b3402df14b7637404e5e91d7651bd13d28a69d8

      SHA512

      0753eec8f21c4681559b82327c93098d2d74732df05d2304a8428dc7af0ff13d49079eacd0dc29d9b32ba5e5095cac6b9fa62a82f77e3ca3bb5986b64fe9195d

    • memory/1368-265-0x0000000003FC0000-0x0000000003FC2000-memory.dmp

      Filesize

      8KB

    • memory/1420-195-0x0000000003660000-0x0000000003662000-memory.dmp

      Filesize

      8KB

    • memory/1728-222-0x00000000714AD000-0x00000000714B8000-memory.dmp

      Filesize

      44KB

    • memory/1728-199-0x00000000053A0000-0x00000000054A0000-memory.dmp

      Filesize

      1024KB

    • memory/1728-131-0x00000000053A0000-0x00000000054A0000-memory.dmp

      Filesize

      1024KB

    • memory/1728-173-0x00000000053A0000-0x00000000054A0000-memory.dmp

      Filesize

      1024KB

    • memory/1728-68-0x00000000053A0000-0x00000000054A0000-memory.dmp

      Filesize

      1024KB

    • memory/1728-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1728-156-0x00000000053A0000-0x00000000054A0000-memory.dmp

      Filesize

      1024KB

    • memory/1728-2-0x00000000714AD000-0x00000000714B8000-memory.dmp

      Filesize

      44KB

    • memory/1728-81-0x00000000053A0000-0x00000000054A0000-memory.dmp

      Filesize

      1024KB

    • memory/1728-0-0x000000002F061000-0x000000002F062000-memory.dmp

      Filesize

      4KB

    • memory/1728-198-0x00000000714AD000-0x00000000714B8000-memory.dmp

      Filesize

      44KB

    • memory/1728-106-0x00000000053A0000-0x00000000054A0000-memory.dmp

      Filesize

      1024KB

    • memory/1728-170-0x00000000053A0000-0x00000000054A0000-memory.dmp

      Filesize

      1024KB

    • memory/1728-221-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1976-194-0x000000001AC80000-0x000000001AC90000-memory.dmp

      Filesize

      64KB

    • memory/1976-176-0x000000001AFA0000-0x000000001B080000-memory.dmp

      Filesize

      896KB

    • memory/1976-196-0x000000001AD90000-0x000000001ADA2000-memory.dmp

      Filesize

      72KB

    • memory/1976-191-0x000000001AD20000-0x000000001AD90000-memory.dmp

      Filesize

      448KB

    • memory/2292-244-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2292-247-0x00000000037E0000-0x00000000037E2000-memory.dmp

      Filesize

      8KB

    • memory/2932-256-0x0000000003720000-0x0000000003722000-memory.dmp

      Filesize

      8KB