Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
20/07/2024, 08:16
General
-
Target
$PLUGINSDIR/filebulldog.rtf
-
Size
49KB
-
MD5
631f2949e010cec263adefaf4ef669ea
-
SHA1
7fcbdd13243b97c3fb82d3e4ff919de8e514473c
-
SHA256
f9daeeb2bf87842cdcfcca7ac228b827c81f692aa55a43fe9d1eaad24790c067
-
SHA512
048b49e62cde89f082318ef9bc63519fd635b1b0384c84de87d7f2327efec78a07a1e3f11763b72092fd53eae8e5d83ade98d61ef319b4a492d597be4f3f98f1
-
SSDEEP
384:gNaUnXkFKw0zybd6NgYUlvaH/se494ZZz/m4gnNzhuzY3+lXFL+GK9vi6rGs2AYE:gNqYUlvaH//vDgNzw83jwhAkhe
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\filebulldog.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD560454662061fc5c741e58b378166f315
SHA1da5039f4fd2d49e7544055b09a2d26dca1af75ed
SHA256a758d6e442a76d27287147a6fb6421c85daeceee04ba4394e032f67f337891b2
SHA512e351904d0936f46a36957ee22f8a9bae6f81970e0802bdc0fd894716fc85b0c303bba6861b4571182e29dc7bfec8204583e9b74aebc7e0c77e1a13152dcc90e5
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB