Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
09/08/2024, 10:05
General
-
Target
678a5620c1a6144e6572baf64065c3ef.docx
-
Size
89KB
-
MD5
678a5620c1a6144e6572baf64065c3ef
-
SHA1
8485b42751328b5aa0bbc88b01600e8f17cebbcd
-
SHA256
0efbc73c4e417d1153c08bdf7e101ee744a3f34c8241b073c2e0dfe34cd6139a
-
SHA512
53fb3a8029e9ad7f8e4f4b2861b856563fbef62c7339a73c868a8c986cb27ab75ee528b1c4fa4c9007c031676a07946ee0263d56aa106de86790e7b1d2139a2f
-
SSDEEP
1536:CH3mtb7ih7kPw17kG1Nc2FjOppKdA6KJvarn82+C4kAh6rhFRmxN/Sh+e:CHWt3ixkw17kcrOppKdsvarh4h69vmHu
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\678a5620c1a6144e6572baf64065c3ef.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD5a91d2fcd4ff20d165f2060b52b3be3d5
SHA13fa940d03823cf4d3c5c9148e2e17225cebe35e7
SHA256dac9a2d5e3e466ce9b5d6f78a7448a58b3bef2a3b58c24287015cd74521bbd74
SHA512386324885bb148793b281f499071cc5b7b42fdc7d10d6b722690523a3bba2492cead854691ac07c9784339a5fd0470e67fccd1609f5902792cfc646572ac5fa3
-
Filesize
78KB
MD597f3291db00b29c1537f6faabfcf8983
SHA138ac80147123d212b5923160c7f29b93c25e885c
SHA2566f6e805c9473d6b4c0aec3b082cbc7e782b6c56a4d0048ef5902bb3ed8a8965c
SHA512ec3ccb5b3ab053968fa47048f6915de82e85bf1a4313eb479d34a9dbf4cd20ea059553c5f7407f8710da642f01356bc86411a10809575b286f43969d49a6cad0
-
Filesize
84KB
MD5796cd99100b39174ec3591fb314486cc
SHA192e386b8602c7773f560e1cbb7a1c199c55a6d55
SHA256e72b52d6fda30f2daf30d5b2cd24ab87acc15111a0abc2b4f722c183b5d569b1
SHA5129eff03bd47fa8491ddee3613803afdedd5039d13e91fd813c03e7bb992b020ca9e5caf3bef0926909eea5a606e925d29ccaff9628b4cab9c52b7ff6fe5e138c1
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
421B
MD54627cd941cf1cbceb53ad7cc0ae1e651
SHA1f0041c8b966e31d85316b56776b6f703a07ff2c1
SHA25630100e1f894aefb5b03c5cdec0f8aca40e4590c18c19b59d2422349e9307d8d6
SHA5126105b9a01bfa9990834676d885d7d26e36f522eecfc0ffd4bfb7a7b01115947eb300c2d0942fe3106f2a05a3aeb45217f27c58978b8b7d4596d91660a72b8124
-
Filesize
2KB
MD5c72ffefa5923b14c8c38dba7394d2e42
SHA10767e5bf0d7bd681137ac70428ad8234d1c69915
SHA256e3515f6e7457437a05335af4aeaf6543c02c57d9ea248e792db0522741f99bf7
SHA51229e622a90b4d17991af9f1f3cce21798491399319935a988645ca9d5035d6ba95076401215f3c0da71878d117adb6212894de4cefd7ed6dc5350b5380c1c81c1
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB