Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    125s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/09/2024, 10:51

General

  • Target

    $PLUGINSDIR/AnimalShopping_license.rtf

  • Size

    102KB

  • MD5

    b9f0a9106d9c55d17ec154ae8c736688

  • SHA1

    529b0a0821e8acb5ab0d95d8fa10b24110264422

  • SHA256

    3e76b19f84b09bdf29a841978d19290ccaa6aeea46676eb89e9a02f977704332

  • SHA512

    5dec17fdf3e9685b370707f9b65848414ad3db09fd30a56096b25af5872ff7276d03d2a854f0573ce98963627795b1aee1ee9fe738cc3a2320d9c572cba863c8

  • SSDEEP

    3072:rCnlb8SacXMYUGL/IpJZ9zzNA5Kv1kCn6:O+g/IpJDzzNA5Kv1kC6

Score
3/10

Malware Config

Signatures

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AnimalShopping_license.rtf" /o ""
    1⤵
    • System Network Configuration Discovery: Internet Connection Discovery
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2740
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1012,i,3861745594156495651,17595114179815238301,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:8
    1⤵
      PID:3536

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\TCDE9EF.tmp\gb.xsl

      Filesize

      262KB

      MD5

      51d32ee5bc7ab811041f799652d26e04

      SHA1

      412193006aa3ef19e0a57e16acf86b830993024a

      SHA256

      6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

      SHA512

      5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

    • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

      Filesize

      16B

      MD5

      d29962abc88624befc0135579ae485ec

      SHA1

      e40a6458296ec6a2427bcb280572d023a9862b31

      SHA256

      a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

      SHA512

      4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

      Filesize

      1KB

      MD5

      900e1998ad549758e1323e8888a7d850

      SHA1

      17f72de9443d7772c743680b3c7e99d901e328d3

      SHA256

      ac2469d67fee9e6db2a5b7312630e5ce159c18eecb3cc67804310b0368b16ac3

      SHA512

      8e2354b7c3b195fbaf04d55b30230b44494943def25adf41b69e32cf4400eeaaa91d393acc3c52c7f59c8ef653e9eacce7e4d7bc8b62611f04cfc71e8eba338e

    • memory/2740-20-0x00007FFD20230000-0x00007FFD20425000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-16-0x00007FFD20230000-0x00007FFD20425000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-5-0x00007FFD20230000-0x00007FFD20425000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-4-0x00007FFCE02B0000-0x00007FFCE02C0000-memory.dmp

      Filesize

      64KB

    • memory/2740-7-0x00007FFCE02B0000-0x00007FFCE02C0000-memory.dmp

      Filesize

      64KB

    • memory/2740-10-0x00007FFD20230000-0x00007FFD20425000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-11-0x00007FFCDDEE0000-0x00007FFCDDEF0000-memory.dmp

      Filesize

      64KB

    • memory/2740-12-0x00007FFD20230000-0x00007FFD20425000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-14-0x00007FFD20230000-0x00007FFD20425000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-13-0x00007FFD20230000-0x00007FFD20425000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-9-0x00007FFD20230000-0x00007FFD20425000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-18-0x00007FFD20230000-0x00007FFD20425000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-21-0x00007FFD20230000-0x00007FFD20425000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-2-0x00007FFCE02B0000-0x00007FFCE02C0000-memory.dmp

      Filesize

      64KB

    • memory/2740-6-0x00007FFD20230000-0x00007FFD20425000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-19-0x00007FFD20230000-0x00007FFD20425000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-8-0x00007FFD20230000-0x00007FFD20425000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-15-0x00007FFCDDEE0000-0x00007FFCDDEF0000-memory.dmp

      Filesize

      64KB

    • memory/2740-17-0x00007FFD20230000-0x00007FFD20425000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-0-0x00007FFD202CD000-0x00007FFD202CE000-memory.dmp

      Filesize

      4KB

    • memory/2740-39-0x00007FFD202CD000-0x00007FFD202CE000-memory.dmp

      Filesize

      4KB

    • memory/2740-40-0x00007FFD20230000-0x00007FFD20425000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-41-0x00007FFD20230000-0x00007FFD20425000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-42-0x00007FFD20230000-0x00007FFD20425000-memory.dmp

      Filesize

      2.0MB

    • memory/2740-1-0x00007FFCE02B0000-0x00007FFCE02C0000-memory.dmp

      Filesize

      64KB

    • memory/2740-3-0x00007FFCE02B0000-0x00007FFCE02C0000-memory.dmp

      Filesize

      64KB

    • memory/2740-191-0x00007FFCE02B0000-0x00007FFCE02C0000-memory.dmp

      Filesize

      64KB

    • memory/2740-193-0x00007FFCE02B0000-0x00007FFCE02C0000-memory.dmp

      Filesize

      64KB

    • memory/2740-194-0x00007FFCE02B0000-0x00007FFCE02C0000-memory.dmp

      Filesize

      64KB

    • memory/2740-192-0x00007FFCE02B0000-0x00007FFCE02C0000-memory.dmp

      Filesize

      64KB

    • memory/2740-195-0x00007FFD20230000-0x00007FFD20425000-memory.dmp

      Filesize

      2.0MB