Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
12/07/2024, 07:33
General
-
Target
$PLUGINSDIR/license_MLPC.rtf
-
Size
48KB
-
MD5
281d9ee1023a271ae94baa4f5311d642
-
SHA1
e6f5436a259e38c2ba6ce1836cce802d68bea3c3
-
SHA256
759b483399086ba4ed71d29144a8be3a46cf5a6dacca1c4f3c2d369c20f203f3
-
SHA512
f06e2462688dfbbc22895b9109ceb651e44ea1cb8d47be213b31c98aabd8a76a93b004c7cc53db8e8efd77782f51b667363ada6709e1d1aefb16ba3cc71a7fee
-
SSDEEP
768:I9rCh1UH4PgB4/Js24HbovQRDS7RK5rQvYXS77K5rQvYXS7UK5rQvYXS7TGl0nuG:+xDhEIl4BUrmuPSthlyCimOLUBu
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license_MLPC.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5e517001c05ff78e8e6cb7a33ba6d7dd0
SHA1ced8f80b0a9b764240c0105dd0a005f565b8bde8
SHA256cb327053c9988ff090d0d7302b50e13364052ae24cab300d9f0d20186ececedf
SHA512efc507b85a30114a11694b87bd2c087c3a71502764653410b193c8f352d1f8db1f5a977b82d5ebe37011f02bfa359040df5b1e933462c9abbbed013aa94c3577
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB