Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
4Static
static
1virus yuny...AQ.rtf
windows7-x64
4virus yuny...AQ.rtf
windows10-2004-x64
1virus yuny...un.rtf
windows7-x64
4virus yuny...un.rtf
windows10-2004-x64
1virus yuny...AQ.rtf
windows7-x64
4virus yuny...AQ.rtf
windows10-2004-x64
1virus yuny...un.rtf
windows7-x64
4virus yuny...un.rtf
windows10-2004-x64
1Analysis
-
max time kernel
143s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/08/2024, 20:01
Static task
static1
Behavioral task
behavioral1
Sample
virus yunyun/Baca AQ.rtf
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
virus yunyun/Baca AQ.rtf
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
virus yunyun/My name is Yuyun.rtf
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
virus yunyun/My name is Yuyun.rtf
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
virus yunyun/_vti_cnf/Baca AQ.rtf
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
virus yunyun/_vti_cnf/Baca AQ.rtf
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
virus yunyun/_vti_cnf/My name is Yuyun.rtf
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
virus yunyun/_vti_cnf/My name is Yuyun.rtf
Resource
win10v2004-20240802-en
General
-
Target
virus yunyun/_vti_cnf/My name is Yuyun.rtf
-
Size
1KB
-
MD5
5f973c8004be579518a85dfe2bcd56d7
-
SHA1
f691293fefabe3ff7f1bdd72230e0791f3777b80
-
SHA256
f48ed7892dd1743f121840d13ce017aabaea41b121438eca2fbf615352226a0a
-
SHA512
8c625bbecf326053fea32e895d1e1d8b4da45f0e5e5e2d01fe198ba577644d1d7db27f17423482771f448e4d707004bbfe67bf48ff382e052463037d8a250295
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2400 WINWORD.EXE 2400 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 2400 WINWORD.EXE 2400 WINWORD.EXE 2400 WINWORD.EXE 2400 WINWORD.EXE 2400 WINWORD.EXE 2400 WINWORD.EXE 2400 WINWORD.EXE 2400 WINWORD.EXE 2400 WINWORD.EXE 2400 WINWORD.EXE 2400 WINWORD.EXE 2400 WINWORD.EXE 2400 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\virus yunyun\_vti_cnf\My name is Yuyun.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2400
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84