Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/08/2024, 17:32

General

  • Target

    $PLUGINSDIR/AnimalShopping_license.rtf

  • Size

    102KB

  • MD5

    b9f0a9106d9c55d17ec154ae8c736688

  • SHA1

    529b0a0821e8acb5ab0d95d8fa10b24110264422

  • SHA256

    3e76b19f84b09bdf29a841978d19290ccaa6aeea46676eb89e9a02f977704332

  • SHA512

    5dec17fdf3e9685b370707f9b65848414ad3db09fd30a56096b25af5872ff7276d03d2a854f0573ce98963627795b1aee1ee9fe738cc3a2320d9c572cba863c8

  • SSDEEP

    3072:rCnlb8SacXMYUGL/IpJZ9zzNA5Kv1kCn6:O+g/IpJDzzNA5Kv1kC6

Score
3/10

Malware Config

Signatures

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AnimalShopping_license.rtf" /o ""
    1⤵
    • System Network Configuration Discovery: Internet Connection Discovery
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3316
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4388,i,3210801877307184477,8078594481454001567,262144 --variations-seed-version --mojo-platform-channel-handle=1436 /prefetch:8
    1⤵
      PID:4264

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\TCD8709.tmp\sist02.xsl

      Filesize

      245KB

      MD5

      f883b260a8d67082ea895c14bf56dd56

      SHA1

      7954565c1f243d46ad3b1e2f1baf3281451fc14b

      SHA256

      ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

      SHA512

      d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

    • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

      Filesize

      16B

      MD5

      d29962abc88624befc0135579ae485ec

      SHA1

      e40a6458296ec6a2427bcb280572d023a9862b31

      SHA256

      a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

      SHA512

      4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

    • memory/3316-9-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

      Filesize

      2.0MB

    • memory/3316-544-0x00007FFDC7FB0000-0x00007FFDC7FC0000-memory.dmp

      Filesize

      64KB

    • memory/3316-4-0x00007FFDC7FB0000-0x00007FFDC7FC0000-memory.dmp

      Filesize

      64KB

    • memory/3316-5-0x00007FFE07FCD000-0x00007FFE07FCE000-memory.dmp

      Filesize

      4KB

    • memory/3316-7-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

      Filesize

      2.0MB

    • memory/3316-3-0x00007FFDC7FB0000-0x00007FFDC7FC0000-memory.dmp

      Filesize

      64KB

    • memory/3316-10-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

      Filesize

      2.0MB

    • memory/3316-12-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

      Filesize

      2.0MB

    • memory/3316-13-0x00007FFDC7400000-0x00007FFDC7410000-memory.dmp

      Filesize

      64KB

    • memory/3316-11-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

      Filesize

      2.0MB

    • memory/3316-8-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

      Filesize

      2.0MB

    • memory/3316-14-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

      Filesize

      2.0MB

    • memory/3316-0-0x00007FFDC7FB0000-0x00007FFDC7FC0000-memory.dmp

      Filesize

      64KB

    • memory/3316-6-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

      Filesize

      2.0MB

    • memory/3316-1-0x00007FFDC7FB0000-0x00007FFDC7FC0000-memory.dmp

      Filesize

      64KB

    • memory/3316-19-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

      Filesize

      2.0MB

    • memory/3316-18-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

      Filesize

      2.0MB

    • memory/3316-17-0x00007FFDC7400000-0x00007FFDC7410000-memory.dmp

      Filesize

      64KB

    • memory/3316-16-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

      Filesize

      2.0MB

    • memory/3316-2-0x00007FFDC7FB0000-0x00007FFDC7FC0000-memory.dmp

      Filesize

      64KB

    • memory/3316-519-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

      Filesize

      2.0MB

    • memory/3316-543-0x00007FFDC7FB0000-0x00007FFDC7FC0000-memory.dmp

      Filesize

      64KB

    • memory/3316-15-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

      Filesize

      2.0MB

    • memory/3316-546-0x00007FFDC7FB0000-0x00007FFDC7FC0000-memory.dmp

      Filesize

      64KB

    • memory/3316-545-0x00007FFDC7FB0000-0x00007FFDC7FC0000-memory.dmp

      Filesize

      64KB

    • memory/3316-547-0x00007FFE07F30000-0x00007FFE08125000-memory.dmp

      Filesize

      2.0MB