Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2024, 08:59
Static task
static1
Behavioral task
behavioral1
Sample
eD0C#50003_Mn8.docx
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
eD0C#50003_Mn8.docx
Resource
win10v2004-20240802-en
General
-
Target
eD0C#50003_Mn8.docx
-
Size
36KB
-
MD5
9c1eeb3be212d8a2d2fc1d5c08b566f7
-
SHA1
c8d68b0e28d5e303418bc8891bfc5a51354bba1b
-
SHA256
b24509ddc372c34411bf3d7f1fc4b7ee718f52b830bddab42805f146b6df2d16
-
SHA512
04a2620bc1df58c00d6939d8a5ae49e83ae7c560cdd36acbddfc9793cfee060f9e10e54eea04f32515b0460c0042de34078c4648f67dfb298eb1507d9a760cec
-
SSDEEP
768:pUrSps3pqCTn+FRUxJYzx5ahyY6PbBSAHio3WiFzrQVmcI3:pUXl+BlbVSZkzFYmB
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3016 WINWORD.EXE 3016 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 3016 WINWORD.EXE 3016 WINWORD.EXE 3016 WINWORD.EXE 3016 WINWORD.EXE 3016 WINWORD.EXE 3016 WINWORD.EXE 3016 WINWORD.EXE 3016 WINWORD.EXE 3016 WINWORD.EXE 3016 WINWORD.EXE 3016 WINWORD.EXE 3016 WINWORD.EXE 3016 WINWORD.EXE 3016 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\eD0C#50003_Mn8.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3016
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
18KB
MD58db378ed4f5feddfb7e8139ab822b075
SHA1c4353247d59de516b8815d89e51c6ba7ee41dd08
SHA2564a03f573413acee56a21f256505d927c0011f2b656bdcba012901c7a17da92a0
SHA512d77810d2f6717717d37640b9f09acb998c3d1f4a8c5c1843f069d8a47179a63240c74af3a92f31b5f58632665f5a491a025f75bd578e37a37aa66ca5b2ea1bd4
-
Filesize
16B
MD5d29962abc88624befc0135579ae485ec
SHA1e40a6458296ec6a2427bcb280572d023a9862b31
SHA256a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
SHA5124311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f