Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/09/2024, 19:26

General

  • Target

    Readme.rtf

  • Size

    4KB

  • MD5

    f48b1c6feb2a69b3bc567c79999a5862

  • SHA1

    7d9c9b8296f3fee40151228f302a5c9c82a8ad15

  • SHA256

    be9d95460a750f3ad4a5e75b4122868cdea2ea65cd2f42141b217bcc546e8281

  • SHA512

    9b32cc9b60f32c23f08857299d653f46fe1b6b06e425006550ea42f76a0753b5fe17cf31f6de2d27d03c961a48512d698717c88fb437d479d9b560d704d7d7de

  • SSDEEP

    48:fR3c6uCUdaSd5olWzWBtcqAddAo+7dvSzVAU6ZzEHiieH2do0fHYwZjJ0oUr4frn:fRktdpeE9/YbsDFm/exmw0m6nblAMs

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Readme.rtf" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:512

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCD156C.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    2KB

    MD5

    9d2d015406f743960a2faf955c249231

    SHA1

    4b21ad560c8644275f28c5948ada7e2aabdb98eb

    SHA256

    d524cf4d5c10f179be69b506fb56f64b39f2ac82e9fa16c5ada0892940d9b2c0

    SHA512

    294ae7f93cd4e5a048689fd608da6b1897339471527ffc5a9d7eed303bfeac7cd3ca0f61925eb6b608d51b34ec99d59f49c5869edfc754e4c9264b4132c12307

  • memory/512-6-0x00007FFA9DFB0000-0x00007FFA9E1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/512-7-0x00007FFA9DFB0000-0x00007FFA9E1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/512-15-0x00007FFA9DFB0000-0x00007FFA9E1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/512-18-0x00007FFA9DFB0000-0x00007FFA9E1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/512-20-0x00007FFA9DFB0000-0x00007FFA9E1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/512-21-0x00007FFA9DFB0000-0x00007FFA9E1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/512-23-0x00007FFA9DFB0000-0x00007FFA9E1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/512-22-0x00007FFA5B900000-0x00007FFA5B910000-memory.dmp

    Filesize

    64KB

  • memory/512-19-0x00007FFA9DFB0000-0x00007FFA9E1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/512-17-0x00007FFA9DFB0000-0x00007FFA9E1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/512-16-0x00007FFA9DFB0000-0x00007FFA9E1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/512-14-0x00007FFA5B900000-0x00007FFA5B910000-memory.dmp

    Filesize

    64KB

  • memory/512-10-0x00007FFA9DFB0000-0x00007FFA9E1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/512-9-0x00007FFA9DFB0000-0x00007FFA9E1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/512-4-0x00007FFA5E030000-0x00007FFA5E040000-memory.dmp

    Filesize

    64KB

  • memory/512-5-0x00007FFA5E030000-0x00007FFA5E040000-memory.dmp

    Filesize

    64KB

  • memory/512-13-0x00007FFA9DFB0000-0x00007FFA9E1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/512-3-0x00007FFA5E030000-0x00007FFA5E040000-memory.dmp

    Filesize

    64KB

  • memory/512-8-0x00007FFA9DFB0000-0x00007FFA9E1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/512-2-0x00007FFA5E030000-0x00007FFA5E040000-memory.dmp

    Filesize

    64KB

  • memory/512-1-0x00007FFA5E030000-0x00007FFA5E040000-memory.dmp

    Filesize

    64KB

  • memory/512-0-0x00007FFA9E04D000-0x00007FFA9E04E000-memory.dmp

    Filesize

    4KB

  • memory/512-35-0x00007FFA9E04D000-0x00007FFA9E04E000-memory.dmp

    Filesize

    4KB

  • memory/512-36-0x00007FFA9DFB0000-0x00007FFA9E1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/512-37-0x00007FFA9DFB0000-0x00007FFA9E1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/512-38-0x00007FFA9DFB0000-0x00007FFA9E1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/512-12-0x00007FFA9DFB0000-0x00007FFA9E1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/512-11-0x00007FFA9DFB0000-0x00007FFA9E1A5000-memory.dmp

    Filesize

    2.0MB

  • memory/512-183-0x00007FFA5E030000-0x00007FFA5E040000-memory.dmp

    Filesize

    64KB

  • memory/512-186-0x00007FFA5E030000-0x00007FFA5E040000-memory.dmp

    Filesize

    64KB

  • memory/512-184-0x00007FFA5E030000-0x00007FFA5E040000-memory.dmp

    Filesize

    64KB

  • memory/512-185-0x00007FFA5E030000-0x00007FFA5E040000-memory.dmp

    Filesize

    64KB

  • memory/512-187-0x00007FFA9DFB0000-0x00007FFA9E1A5000-memory.dmp

    Filesize

    2.0MB