Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 17:10
Static task
static1
Behavioral task
behavioral1
Sample
Нападение на американские космические системы очень д.scr
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Нападение на американские космические системы очень д.scr
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
Новый щит и новый меч Вооруженные Силы России и США.doc
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Новый щит и новый меч Вооруженные Силы России и США.doc
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Ракетно-ядерная рулетка.doc
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
Ракетно-ядерная рулетка.doc
Resource
win10v2004-20240709-en
General
-
Target
Новый щит и новый меч Вооруженные Силы России и США.doc
-
Size
80KB
-
MD5
5cc125e416646bb04e253793b52252c0
-
SHA1
5f9b986c6792de82bdb992c7504ae090b84d6d52
-
SHA256
6c85434279ce173bf41eec77ff1f7117f10eb8071c9e8cfeb5c521ed1ef5066c
-
SHA512
17e8961fb1700416e43908c351e5d6d4d74d1a49c8ea03e8eab4ffb00389834075a204b5099ed7e01a38f45483df16a2ebec3ddb2472ec5085a0657cd94b5d97
-
SSDEEP
768:089Aa2aJPfDYB0LjqRj/LtwqKsQ5OqOS0a4FMBRsKCBV0:08yLQqZd4n4F+5IV0
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3012 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3012 WINWORD.EXE 3012 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2840 3012 WINWORD.EXE 32 PID 3012 wrote to memory of 2840 3012 WINWORD.EXE 32 PID 3012 wrote to memory of 2840 3012 WINWORD.EXE 32 PID 3012 wrote to memory of 2840 3012 WINWORD.EXE 32
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Новый щит и новый меч Вооруженные Силы России и США.doc"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2840
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5fa2f10d703fc8505bb516ceeb4fc8099
SHA144a06b838fb7bd65a59a482f0999981083abe9d4
SHA2567d4529eabc25ac14defd602fddbd8378293c01a49c993c377c91bd66d3bbe8e9
SHA5128b80982ad11f23358a4cfdffacac22bb982c4191a65ef1fe2b5b2ea112fd6de9f96add49d4486c590fcbfdaf737984cd13d0ca84f937020f86fa54a61e9285be