Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
100s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 09:16
Static task
static1
Behavioral task
behavioral1
Sample
cvery.comc345785355/Crack/hz-md3.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cvery.comc345785355/Crack/hz-md3.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
cvery.comc345785355/MD_3_Users_Guide.doc
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
cvery.comc345785355/MD_3_Users_Guide.doc
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
cvery.comc345785355/Setup/MetaDraw_3_1_Install.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
cvery.comc345785355/Setup/MetaDraw_3_1_Install.exe
Resource
win10v2004-20240802-en
General
-
Target
cvery.comc345785355/MD_3_Users_Guide.doc
-
Size
1.9MB
-
MD5
99b0e23de8e89a71eeada39894fc3171
-
SHA1
dd59ca14ad12c52170c199c1d77fa22e39a812d7
-
SHA256
8bb4a4a2a6bbde823d99abf7ad17a3d20b4d549654d6dd8082caaaac8d7ec3f7
-
SHA512
a15db1cdd02ed8f497ee492cead7697e4240286c1f7a8dc95047567e59aa8af6953f1715988a3e22964f975c715cc4fc99bddb34fe6aa384f2c5326df4d98fa7
-
SSDEEP
49152:b8At8PYjtQ+jgUTLdlIfSbLLLLLLLLLLL5:/I6bLLLLLLLLLLL
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2856 WINWORD.EXE 2856 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 2856 WINWORD.EXE 2856 WINWORD.EXE 2856 WINWORD.EXE 2856 WINWORD.EXE 2856 WINWORD.EXE 2856 WINWORD.EXE 2856 WINWORD.EXE 2856 WINWORD.EXE 2856 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\cvery.comc345785355\MD_3_Users_Guide.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b82853133fae158c02a88e63065bf1be
SHA182637335e3e507cbd09dbd8828f43d80d56d7ed9
SHA256915330f0bff6a1920d80c1027255768d8f2ad83c424f9eed3bca79dd963084e0
SHA512c59fc791d3151af3e4f8d8c0917296bc06ca68e0e9492653d32071b467ea658a4c55be9be7e6e7883ff6e5f6a90f9a5c88dce8d34a1faffe218222556b07295f
-
Filesize
1KB
MD5a9f581a5377599e98e0a1b8d0174fe08
SHA141876fa57d3e792a7b622668da863834440d0d4b
SHA256ee4a74426a2b31e47372d150ca0ffba067f7ef8308f1e8978a3e7bea9f4db91e
SHA512aa01bb30170fbf8f92e027cc8737f449f2f9129adcf379a59a7d3e14a4d07222a7db342fd3d18c7683ce4074371bbc753eed2efe09dae3f4c78254d0359e0657
-
Filesize
468B
MD580602124ce59e77a440677515b94b3e6
SHA15821973244d9bff4bb04982ae62317c05b382cba
SHA2561138b5daca1973c99a2fc90434e02f5fb7782c5523302be7521214590981fe62
SHA5127d6af561ec7679f4a75c474f5b4e7765c9c03ee961bde26c51dd8efde69e90ded4361c494641102446f59a9b4f33b2059619c5367cbcba1a440c2c47af4daafa
-
Filesize
468B
MD54d8d783adffc6c4fb5ed93312a388fe0
SHA179e0445ff3ca18a636087e2d6e41181d37788003
SHA256c0d5b2f099b38045fd44b69ee8959f9edc8951378c9f570b8bd564d2bd043608
SHA512d229598d8f46e759389cfbdd26a802621bba7e9812012d85fa71b4bfd7a96930f2f7bd79a52d6aafb447c4e73ad2b700bf56a205bebdf3b3706b56f60cbb3275
-
Filesize
468B
MD5e8c3ffdf04647729a886ea9a90ac11a7
SHA16cf912387800e53d38716e105cee456c5dfa3ecd
SHA256387ea2f551b2b4367830d9f04790edd49a5085bd3196c09a3840747758e82b01
SHA5120e2144575a9f8270d5c2b3c7bac69f57fa1106dfff067da0b09ffa69f08982c90691e0067a1a64dc9432d0f7d5556249de0013af6e75665d1ba4e5b3abf94b1e
-
Filesize
1KB
MD574cc4d54e5ba5e854d16cfbcef031bed
SHA1a8c9b0ea6c4430d3d79569a3959c40c5657ee111
SHA25659b6cab9ead42f007290c91504b1e48eb0edfe5236d66f55b78c366bdab72bc3
SHA5122284ebbbe43add8a50a5f18afd596ce02c16bbabda542e821f7d8f8945e4726efca489b8c313141d9e18b3aa6c120eb4b6f91297b2315a8a9468fc31e6ecc802
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize2KB
MD517cfc5aa16253c639e960e912d8e7e74
SHA13dbe0c798341b4a7ccb6a3ed16a5b29b32ad9743
SHA256c60f16d2593460685db069bee72ae0297fbb4e13399a6c9242456dd76260044c
SHA5128a7931a68f1141bb8b1180f20c9c6371df8edf05994179e87fdb9c8e36c941cbe73339dc00649c7b28c2e3ba318cd934de7ba73ec6ef7f9fb1828f233b72c9c1