Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
67s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
14/08/2024, 12:43
Behavioral task
behavioral1
Sample
82694647003053446a4f6a023bcfc99eadf52024ba6bad0a73046e85c63c4fd6.doc
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
82694647003053446a4f6a023bcfc99eadf52024ba6bad0a73046e85c63c4fd6.doc
Resource
win10v2004-20240802-en
General
-
Target
82694647003053446a4f6a023bcfc99eadf52024ba6bad0a73046e85c63c4fd6.doc
-
Size
1015KB
-
MD5
4e2bb8dc4cf7e0a500d42037edf7971b
-
SHA1
1e20196496f0bfefb2f56acae2f0ad2a968d0575
-
SHA256
82694647003053446a4f6a023bcfc99eadf52024ba6bad0a73046e85c63c4fd6
-
SHA512
761a39aced841b90f65cc9bc8ab80a47fd19fcebc74efc75766ca77006d4d3436692e1e36fe8c90ee839dc2166cdb08081070450d2417610c5b5c5a905d2a445
-
SSDEEP
24576:j4iSLaCMlHhYGBJUxbRKnX9Yy1Dhxp0oQ9K9jhwXGAxOgUk/T:kiSLaCkHhYGBJUxlK+y1Dp
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1692 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1692 WINWORD.EXE 1692 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1692 wrote to memory of 2824 1692 WINWORD.EXE 30 PID 1692 wrote to memory of 2824 1692 WINWORD.EXE 30 PID 1692 wrote to memory of 2824 1692 WINWORD.EXE 30 PID 1692 wrote to memory of 2824 1692 WINWORD.EXE 30
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\82694647003053446a4f6a023bcfc99eadf52024ba6bad0a73046e85c63c4fd6.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2824
-