Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
23/07/2024, 02:32
General
-
Target
$PLUGINSDIR/license_Ciuvo.rtf
-
Size
36KB
-
MD5
ba4c90081e04285a65dc539bb7ecc1b5
-
SHA1
858a3c8f576a5369ca6c1c19288c7601224454bb
-
SHA256
36438f8057a12df36d93c249b90cff0df7d50b70aa4ee9053bf5902e6f5e8340
-
SHA512
17d01f17643cc978aa855916ccb2fea15c7b8742f91d5c6b42b64062fb6aa8b826ed2c769ea35a4308ef6746a67df1c20c81cc63e5ec45e8caafff10eb9baa07
-
SSDEEP
192:Oe66QzSvmgoUpYzKCXHjJnaKFQusE+VjcQh+gg+KpehSJSy3zS2GRerpadVB5NAx:u6wStoUpYSKcYAWJjMdT5ivZfF
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license_Ciuvo.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5a4cbeb7fd5286e5b127a8471234c248a
SHA138298e93635c1e1d3dfeda6bbe39dbd3519b5cf1
SHA25642a4cb6dbea94ce56c4b0c20f7fa6bf65eaf4068de26fe7dafb2399e39e382b8
SHA512bd8f4d97021d4c8adce115c38389f016ec88dc713fdf7b90b4a6ce112d2e830cf72231495bcc7adf8a811faabb59b1697e60c22b180b766aa279d3be04d59c39
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB