Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
25/06/2024, 17:07
General
-
Target
25062024_1707_25062024_Boweitech-PO240624.docx
-
Size
16KB
-
MD5
96ab9ded82cab1f08da63925fbb04015
-
SHA1
f01510bfbb0aba940ccae884b5bd0c1a70e36ad1
-
SHA256
7f5525e9f137916591a4648e61ef5b87399b0fa2821e580c848b3b41dbd37bd2
-
SHA512
2a038dce0006e5adeb30c5797b145758b8bfcf0d2d624e24feb07b3985a6058613fda91fa86236799fdf3a8f5bcd0c9c673e83ae7318911318983b083f7d16a7
-
SSDEEP
384:XyXXUm+Wns8PL8wi4OEwH8TIbE91r2fRxJYWvi/5Z4rs2:XcXmg5P3DOqnYJf3vu5Z4Z
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\25062024_1707_25062024_Boweitech-PO240624.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
487KB
MD5737355ad732da62afc3eca04aaefbc25
SHA119d6816b326e076e33ba21df51c328685f59bd75
SHA256688ade2a84dc563da3868c853dc6df1150d07ba094f0e6ee0eff9cb6b3faf938
SHA51280e6f89912a00bf4c435e01faec1987dfab9a4f44110f0b23ab45badb006c1a0eb7f0ae0c6764849217b0a45431eff1c33e94ac89b41c9383238200aad8ab449
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
250B
MD5107a074e587bc2d4cebca1ae95fd8dc4
SHA1215169af0a468a963c562a14b13e09c586053ca7
SHA256bc9137f2ccfa115b22c3e1eebfed75457e6796fcfea9c62d0eeab20257323a3c
SHA51221d65718b0c22a7b617dd0441ee2c3333e5f8fdbf90e9c20e9c5a4727020549100a4cbcba77c807c947248be585dd616cadfd003982e01af2b7b90de917b931d
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB