Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
22/07/2024, 09:40
General
-
Target
$TEMP/license.rtf
-
Size
17KB
-
MD5
cc03cd21cc375355f8cb3a28cd83eceb
-
SHA1
6ae03782601f2869d99ce53b57d42d691ac7d25f
-
SHA256
d528ed72843628354b638c6fd51c6e7601d5f690fb5ddce0c88d4e75477f5429
-
SHA512
7f2e172dd0d6defd56f119c1da19a82e77797a1b497d8b9e4a2651ff22936dbdbd4becb5d24896f5f7e18832266b7e6fbf8b71100e726e889619458ad802e0d0
-
SSDEEP
192:doyiN6vTCHjJnO7pTgfzGbMMhg2yYLeE6qh/8H45j15JD8YEoqUTEshTphhE//:OyUL6bTNebqhtJzENshTphm/
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$TEMP\license.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD54267779084216f60c3a8140cfe362da0
SHA195310deb0ffee7b876d8c2f32562ff6f4bac5361
SHA256dcd611d3b0ca3517e0617fb6c2c4374c07fc3d773b36a27c0dd3744e96114dc2
SHA512aa6b51cce56386e37843d085aae3d196a100fc490ed11cba71cab85876c357a84837154127bf771cef7bbea7551271984cc3c76d4c0e77ca60c40e2082c5b679
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB