Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
53s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
15/08/2024, 21:06
Behavioral task
behavioral1
Sample
248666f8c95c0bf9ed9895b59d7f50af173103dc817f17c1f15857906235d7a5.doc
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
248666f8c95c0bf9ed9895b59d7f50af173103dc817f17c1f15857906235d7a5.doc
Resource
win10v2004-20240802-en
General
-
Target
248666f8c95c0bf9ed9895b59d7f50af173103dc817f17c1f15857906235d7a5.doc
-
Size
42KB
-
MD5
111b578c044bbc3bb44acbd29f858dcc
-
SHA1
04e858619319263b758b27a63365b76de3e9f190
-
SHA256
248666f8c95c0bf9ed9895b59d7f50af173103dc817f17c1f15857906235d7a5
-
SHA512
946e49228118ac0cfef1043c8f60f766c1f34090b79ea8a1fb643c010e3e4b54d04d7755ece9cf4ba91c7d56f4c9a262ff347066a958fdc66e86c0b518a318be
-
SSDEEP
384:YE8iSwvxjk+t2hGtXrZz1F/7E5Ncz9V8RlpvQeGDWxxDEC9YrQh0:Yqxw+twMl1F/7E4z9V8RlpvQeGDWDFw
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2488 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2488 WINWORD.EXE 2488 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2744 2488 WINWORD.EXE 30 PID 2488 wrote to memory of 2744 2488 WINWORD.EXE 30 PID 2488 wrote to memory of 2744 2488 WINWORD.EXE 30 PID 2488 wrote to memory of 2744 2488 WINWORD.EXE 30
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\248666f8c95c0bf9ed9895b59d7f50af173103dc817f17c1f15857906235d7a5.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2744
-