Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
14/07/2024, 08:17
General
-
Target
$PLUGINSDIR/license_pbr.rtf
-
Size
65KB
-
MD5
d27946865ca1eadb4e44ed2f0a612cb6
-
SHA1
3b764b75d8ef713d0f338227aae7dd11ae4427c1
-
SHA256
45df50add034de53c266945c24181160d308342e848872b133effc1077fe02ee
-
SHA512
d18f9e9165ad96634b2ded4ef3a772156329a69ed6680f1a65bd016bbe2789d9115a1b05af469e37333294ad7e330a35b3813911a546f04226e9faef5b209238
-
SSDEEP
768:je6mikHrBLxRYMHX6YXL5UMHX6YhL5UMHX6YyLvRYMHX6YJZcXlBGBBuBLxRYMHf:Sn4vtybALZiLiSxp7kDe
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license_pbr.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD551899c8d678fefd79ef0ade9b3ffb670
SHA1cfef792bbe7beaafecd2713104c974f850dc0b54
SHA2565eaa9c6a93a6579381148b99ad778fc18fe6850fd8129daae9d23faeafdb67eb
SHA512ec9d883fee0ef7f89e343784e3526a2339d689b1f6e4a3c225d50462ab246acf8b90c53bd294537441f837b1fe6c77972fe40548aded6ea90e6ce3ebf26a5ffd
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB