Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/08/2024, 17:32

General

  • Target

    $PLUGINSDIR/Iminent_license.rtf

  • Size

    56KB

  • MD5

    cbd9c82da4e208d7e2bec6dd37879174

  • SHA1

    d7661afdb253df33aebad995aca8554da8b9cf53

  • SHA256

    37e54e99851d09a66355021526fab376fce93288a2bbfaea7cd993356040e543

  • SHA512

    39502dec4b6ffc80375186590fce0957a6790592382739742656061d889950ad160074a1573a94e049aa302a3196f0a652af6bb533ebf0498f707ef75adb20d4

  • SSDEEP

    768:aE6m+kHbNZ/caU0MI6M1/caU0MI6Mn/caU0MI6MQ/caU0MI6Mvejq6CRFQ5/caUH:Nj/lb8W3YncXMYXip7RWKL9cOf

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Iminent_license.rtf" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2252

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCDB964.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    1KB

    MD5

    f85511a925f681583b49bf1627daf121

    SHA1

    2776249842656d69c4ce3b7128ab1a42dff7cd3f

    SHA256

    c56abc3830b558c6115ed8943b456d5d0dc12524514142ed504ebd1aa95a1e97

    SHA512

    310679d58924c7398998edb2a0ba9c0802d1ce5f1663b62093ad325ee53263daca3228f906e107537f5fefe687b9bd94b0d735e3b25bc3d882f7a1f4e1212ea1

  • memory/2252-10-0x00007FFD0E150000-0x00007FFD0E345000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-13-0x00007FFD0E150000-0x00007FFD0E345000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-3-0x00007FFD0E1ED000-0x00007FFD0E1EE000-memory.dmp

    Filesize

    4KB

  • memory/2252-5-0x00007FFCCE1D0000-0x00007FFCCE1E0000-memory.dmp

    Filesize

    64KB

  • memory/2252-2-0x00007FFCCE1D0000-0x00007FFCCE1E0000-memory.dmp

    Filesize

    64KB

  • memory/2252-9-0x00007FFD0E150000-0x00007FFD0E345000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-8-0x00007FFD0E150000-0x00007FFD0E345000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-7-0x00007FFD0E150000-0x00007FFD0E345000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-14-0x00007FFD0E150000-0x00007FFD0E345000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-12-0x00007FFD0E150000-0x00007FFD0E345000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-4-0x00007FFCCE1D0000-0x00007FFCCE1E0000-memory.dmp

    Filesize

    64KB

  • memory/2252-15-0x00007FFCCC170000-0x00007FFCCC180000-memory.dmp

    Filesize

    64KB

  • memory/2252-11-0x00007FFD0E150000-0x00007FFD0E345000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-6-0x00007FFD0E150000-0x00007FFD0E345000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-16-0x00007FFCCC170000-0x00007FFCCC180000-memory.dmp

    Filesize

    64KB

  • memory/2252-0-0x00007FFCCE1D0000-0x00007FFCCE1E0000-memory.dmp

    Filesize

    64KB

  • memory/2252-1-0x00007FFCCE1D0000-0x00007FFCCE1E0000-memory.dmp

    Filesize

    64KB

  • memory/2252-351-0x00007FFD0E150000-0x00007FFD0E345000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-382-0x00007FFCCE1D0000-0x00007FFCCE1E0000-memory.dmp

    Filesize

    64KB

  • memory/2252-384-0x00007FFCCE1D0000-0x00007FFCCE1E0000-memory.dmp

    Filesize

    64KB

  • memory/2252-383-0x00007FFCCE1D0000-0x00007FFCCE1E0000-memory.dmp

    Filesize

    64KB

  • memory/2252-385-0x00007FFCCE1D0000-0x00007FFCCE1E0000-memory.dmp

    Filesize

    64KB

  • memory/2252-386-0x00007FFD0E150000-0x00007FFD0E345000-memory.dmp

    Filesize

    2.0MB