Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
59s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/09/2024, 22:11
Static task
static1
Behavioral task
behavioral1
Sample
4a113cd5595f0bf827e6642a2edefb02d337668486fa7beeeed9bb66fbe8f141.doc
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4a113cd5595f0bf827e6642a2edefb02d337668486fa7beeeed9bb66fbe8f141.doc
Resource
win10v2004-20240802-en
General
-
Target
4a113cd5595f0bf827e6642a2edefb02d337668486fa7beeeed9bb66fbe8f141.doc
-
Size
52KB
-
MD5
e127fdcf56e6dd228e287ba311c3ed9a
-
SHA1
aba9f5937b2ba4d354a58acdc5e05765b48513f0
-
SHA256
4a113cd5595f0bf827e6642a2edefb02d337668486fa7beeeed9bb66fbe8f141
-
SHA512
473df90fba221098729838f068c3eae9f6ae73877d618c9b59029fd135b1d9e7e9d7c8112bf4b2c915448d4455051d9529d8b723d2ec43902729e3b1cf89d09b
-
SSDEEP
384:tjOyjHDONt8ekfqVIbuazZyGcSxwAjLi6cpVYnbH/qp2D2xz99OTd0jrnHt6dmei:tVIt8NqVQHzvfy4ecD2xz99OpU
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2288 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2288 WINWORD.EXE 2288 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2288 wrote to memory of 2708 2288 WINWORD.EXE 31 PID 2288 wrote to memory of 2708 2288 WINWORD.EXE 31 PID 2288 wrote to memory of 2708 2288 WINWORD.EXE 31 PID 2288 wrote to memory of 2708 2288 WINWORD.EXE 31
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\4a113cd5595f0bf827e6642a2edefb02d337668486fa7beeeed9bb66fbe8f141.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2708
-