Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    361s
  • max time network
    362s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    31/05/2024, 14:55

General

  • Target

    bad991de-de2d-ea8a-4302-d1b146a7e953.eml

  • Size

    29KB

  • MD5

    45ca75cdd74ebe649682e902ce6524f1

  • SHA1

    690018174df6585e1a6c723c67127b5d9d6214ee

  • SHA256

    47a2eeb78b83eb938ffbe3c54f9e78dfa3e2359ce191ca6cd603313f0a3a083b

  • SHA512

    906507a7d9a1178c515a14baa5fd64a081507c37bc977dc8df71090083e0875aecb5771805e5d48fc8cb24542705f728db87fe67c816355ff351d3d9b10737a2

  • SSDEEP

    384:pAT+3lqvOK7xPsKU4zpQM3AvdL7lLBx+A8jC7HgSKG39bguAiStWAheLs5xa:/zWtsKUxN8YvADQs/a

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 14 IoCs
  • Drops file in Windows directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
    C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE /eml "C:\Users\Admin\AppData\Local\Temp\bad991de-de2d-ea8a-4302-d1b146a7e953.eml"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1632

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

    Filesize

    240KB

    MD5

    31b8c8ae56787119d66e7fc424cc49b7

    SHA1

    8e158830da7b4fc6d75372fd59911478bf01bbcb

    SHA256

    08c5960952ffd2983d743e9067a70b30721182c9ec1dc1baac36ff4acfe8c6f7

    SHA512

    847de8e7708a4463c95a45905f281568ff6494358cab418daeb65e252524c8f7872542ab96efcbd86ff942f030536fb1e135eb07c48483d203d71e492b494f72

  • C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

    Filesize

    240KB

    MD5

    1896bc6d8cc69109a6c83a3f7a663be7

    SHA1

    0d64d03875b3a3b7e40baeb63d2b74f63495254b

    SHA256

    3a033fd8199e79d99d26c9e7e9e36b9dba0014d7ef16e3db1b4e6fec9920d8cf

    SHA512

    d383e1437d977d89b51beb25641b741bb5ee68218d8db57f6ad92c63044d78596537f22a6b04221a7fa962c0bc7f8e27735e381c2ac92c595df768ff73c0ce10

  • C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.inf

    Filesize

    1KB

    MD5

    48dd6cae43ce26b992c35799fcd76898

    SHA1

    8e600544df0250da7d634599ce6ee50da11c0355

    SHA256

    7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a

    SHA512

    c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31

  • memory/1632-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1632-1-0x000000007383D000-0x0000000073848000-memory.dmp

    Filesize

    44KB

  • memory/1632-128-0x000000007383D000-0x0000000073848000-memory.dmp

    Filesize

    44KB

  • memory/1632-133-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/1632-135-0x000000007383D000-0x0000000073848000-memory.dmp

    Filesize

    44KB