Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
4Static
static
3Inkecn.exe
windows7-x64
3Inkecn.exe
windows10-2004-x64
3Update.exe
windows7-x64
3Update.exe
windows10-2004-x64
3icon/新云软件.url
windows7-x64
1icon/新云软件.url
windows10-2004-x64
1pic/make/�....0.doc
windows7-x64
4pic/make/�....0.doc
windows10-2004-x64
1大众印�....0.doc
windows7-x64
4大众印�....0.doc
windows10-2004-x64
1Analysis
-
max time kernel
100s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 22:34
Static task
static1
Behavioral task
behavioral1
Sample
Inkecn.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Inkecn.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Update.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
Update.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
icon/新云软件.url
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
icon/新云软件.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
pic/make/大众印客精灵-使用说明V1.0.0.doc
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
pic/make/大众印客精灵-使用说明V1.0.0.doc
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
大众印客精灵-使用说明V1.0.0.doc
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
大众印客精灵-使用说明V1.0.0.doc
Resource
win10v2004-20240802-en
General
-
Target
大众印客精灵-使用说明V1.0.0.doc
-
Size
929KB
-
MD5
e1a5bd1826d74324215c3e3a57afc189
-
SHA1
9bcf559ef8d2c33272a778fb7659fac8e644de17
-
SHA256
9fe3d0af4ea3aa389e302b92b4f8a58bef3e47db9c9fabad979f059c439be4cc
-
SHA512
a3dae27898535dc190cf61c3d22caf0b1974c8cc492ee5b449e48acefe7c91e040e12e6682607d309367335080b3834895d1f6456dabea178503018a0637adb3
-
SSDEEP
12288:BYbgpEuuJixqlsQsUCO82R1vRpgP2BZMvUUAsKPpGIaN4MgLi3LrBi38FEkbmWCE:BLpBu4Mi41v3gcy6sKh/rL8xi3CRbd7
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 288 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 288 WINWORD.EXE 288 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 288 wrote to memory of 2820 288 WINWORD.EXE 31 PID 288 wrote to memory of 2820 288 WINWORD.EXE 31 PID 288 wrote to memory of 2820 288 WINWORD.EXE 31 PID 288 wrote to memory of 2820 288 WINWORD.EXE 31
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\大众印客精灵-使用说明V1.0.0.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:288 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2820
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD508007f390c1b3c1944473b0736663102
SHA10be65d335ca8f9a0737bb2b4ae60ab754fcac930
SHA2569d1038a0268e38ecf6b76706d1fec0e0aaf90b9f4a3abc9142f103f9e5dafbfe
SHA5121ec3f1407daf17bf86ab2e3952249016fa01ce7a5bbb6c4f87769ab73f01a95ac0103438e74b4e55d14299e50602e6d622a111d1acdafa294fea797ecb7be6a4
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84