Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
101s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/09/2024, 14:01
Static task
static1
Behavioral task
behavioral1
Sample
swift.rtf
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
swift.rtf
Resource
win10v2004-20240802-en
General
-
Target
swift.rtf
-
Size
830KB
-
MD5
da0bf0c618afdcec9df34d437794e4c0
-
SHA1
f85223bf5b04d6eceb04baeee97825b060337dd5
-
SHA256
e25240231baa27e14f83428e060074197a63affbcf6f1c7990aa4a3115d4b7fd
-
SHA512
d168bff7c385b5a1de789dc19ec3f54c4ea720fcb8612da3ae838b536262479147ecb7497facd507a342b9c9724edf3b29b1bc213b176b835887c85a1e369541
-
SSDEEP
6144:VwAYwAYwAYwAYwAtFt+VG0BNs1H4wP/2OJ0+Q8XxBR:BR
Malware Config
Extracted
nanocore
1.2.2.0
pnauco5.ddns.net:1664
cde38e58-d99c-4068-b775-59569bc2e8ce
-
activate_away_mode
true
-
backup_connection_host
pnauco5.ddns.net
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2024-07-03T06:48:27.569053036Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1664
-
default_group
NEW
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
cde38e58-d99c-4068-b775-59569bc2e8ce
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
pnauco5.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 3 2428 EQNEDT32.EXE -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1552 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
pid Process 812 wehdpcat93625.exe 3012 wehdpcat93625.exe 1560 wehdpcat93625.exe -
Loads dropped DLL 1 IoCs
pid Process 2428 EQNEDT32.EXE -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Service = "C:\\Program Files (x86)\\UDP Service\\udpsv.exe" wehdpcat93625.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wehdpcat93625.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 812 set thread context of 1560 812 wehdpcat93625.exe 37 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\UDP Service\udpsv.exe wehdpcat93625.exe File opened for modification C:\Program Files (x86)\UDP Service\udpsv.exe wehdpcat93625.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wehdpcat93625.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EQNEDT32.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wehdpcat93625.exe -
Office loads VBA resources, possible macro or embedded object present
-
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
pid Process 2428 EQNEDT32.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3064 schtasks.exe 3016 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1768 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 812 wehdpcat93625.exe 812 wehdpcat93625.exe 1552 powershell.exe 1560 wehdpcat93625.exe 1560 wehdpcat93625.exe 1560 wehdpcat93625.exe 1560 wehdpcat93625.exe 1560 wehdpcat93625.exe 1560 wehdpcat93625.exe 1560 wehdpcat93625.exe 1560 wehdpcat93625.exe 1560 wehdpcat93625.exe 1560 wehdpcat93625.exe 1560 wehdpcat93625.exe 1560 wehdpcat93625.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1560 wehdpcat93625.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 812 wehdpcat93625.exe Token: SeDebugPrivilege 1552 powershell.exe Token: SeDebugPrivilege 1560 wehdpcat93625.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1768 WINWORD.EXE 1768 WINWORD.EXE -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2428 wrote to memory of 812 2428 EQNEDT32.EXE 31 PID 2428 wrote to memory of 812 2428 EQNEDT32.EXE 31 PID 2428 wrote to memory of 812 2428 EQNEDT32.EXE 31 PID 2428 wrote to memory of 812 2428 EQNEDT32.EXE 31 PID 1768 wrote to memory of 2736 1768 WINWORD.EXE 33 PID 1768 wrote to memory of 2736 1768 WINWORD.EXE 33 PID 1768 wrote to memory of 2736 1768 WINWORD.EXE 33 PID 1768 wrote to memory of 2736 1768 WINWORD.EXE 33 PID 812 wrote to memory of 1552 812 wehdpcat93625.exe 34 PID 812 wrote to memory of 1552 812 wehdpcat93625.exe 34 PID 812 wrote to memory of 1552 812 wehdpcat93625.exe 34 PID 812 wrote to memory of 1552 812 wehdpcat93625.exe 34 PID 812 wrote to memory of 3012 812 wehdpcat93625.exe 35 PID 812 wrote to memory of 3012 812 wehdpcat93625.exe 35 PID 812 wrote to memory of 3012 812 wehdpcat93625.exe 35 PID 812 wrote to memory of 3012 812 wehdpcat93625.exe 35 PID 812 wrote to memory of 1560 812 wehdpcat93625.exe 37 PID 812 wrote to memory of 1560 812 wehdpcat93625.exe 37 PID 812 wrote to memory of 1560 812 wehdpcat93625.exe 37 PID 812 wrote to memory of 1560 812 wehdpcat93625.exe 37 PID 812 wrote to memory of 1560 812 wehdpcat93625.exe 37 PID 812 wrote to memory of 1560 812 wehdpcat93625.exe 37 PID 812 wrote to memory of 1560 812 wehdpcat93625.exe 37 PID 812 wrote to memory of 1560 812 wehdpcat93625.exe 37 PID 812 wrote to memory of 1560 812 wehdpcat93625.exe 37 PID 1560 wrote to memory of 3064 1560 wehdpcat93625.exe 38 PID 1560 wrote to memory of 3064 1560 wehdpcat93625.exe 38 PID 1560 wrote to memory of 3064 1560 wehdpcat93625.exe 38 PID 1560 wrote to memory of 3064 1560 wehdpcat93625.exe 38 PID 1560 wrote to memory of 3016 1560 wehdpcat93625.exe 40 PID 1560 wrote to memory of 3016 1560 wehdpcat93625.exe 40 PID 1560 wrote to memory of 3016 1560 wehdpcat93625.exe 40 PID 1560 wrote to memory of 3016 1560 wehdpcat93625.exe 40
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\swift.rtf"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2736
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Roaming\wehdpcat93625.exe"C:\Users\Admin\AppData\Roaming\wehdpcat93625.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wehdpcat93625.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1552
-
-
C:\Users\Admin\AppData\Roaming\wehdpcat93625.exe"C:\Users\Admin\AppData\Roaming\wehdpcat93625.exe"3⤵
- Executes dropped EXE
PID:3012
-
-
C:\Users\Admin\AppData\Roaming\wehdpcat93625.exe"C:\Users\Admin\AppData\Roaming\wehdpcat93625.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF306.tmp"4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3064
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpF3A3.tmp"4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3016
-
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Exploitation for Client Execution
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57615ace31d4f031adbe9dcc0dbf9d79e
SHA10d98e20f1f3b5485c61a0857f1ea3b4e048b22c9
SHA256f7152a3f6ecea29cccec1906dd51a163ea60812546dff5843edffdfec7ff9aaf
SHA5126b86f5f08b9632a88dd1c954bf7d02207fa1fbed72807443f23e54e7b1ec0ec723ef93241b2445a40f6bcfb19e821c7e7dc33aac62d5ce1ee40a54fa4debd3b6
-
Filesize
1KB
MD50a24db62cb5b84309c4803346caaa25d
SHA167660778f61bb44168c33ed3fe56ed86cf9583e8
SHA25638d38647af394a04ee6add9f05c43244f04e64a6b96257f4b241a5038efa82df
SHA512d25d9df063f44595d5e0bf890755bd387655131ff369eeedf3d11ffcc6202ca4455bbb33a8a926dd06839cbd1ddec3d06809b3c66a82c6518aa14beaa469a548
-
Filesize
19KB
MD5e228796f830cfb68530b2831e39dceaf
SHA1fe6481a684092329551c157746e73a66c6186fff
SHA256cb9524e6973e18900c8eb80eaa75883dc98f5191fb8d02f0f83ca87e6afe0c88
SHA512ab0654452dbcb10b84b15f352657a74a44f0a00eebd322f5c41e982a83dc8c37c132b47ce3c92716103df30baac6d28afc86d50c5567e4e2b472291b4e7d6cb4
-
Filesize
629KB
MD5280baa14b25c23e63122a4028928dff0
SHA18070c5e450768312a50c64be6edc386b009bea77
SHA2564a842606d80e5bc30a9817fc11877889b24e3daccc2ba7ea0711d5c259e70226
SHA51226b96a7b246c3abaa02a989ea1e90a9ede181133f8a1e1b9605b3812f1505527d4164e14c169c73773e5872881bfa512793cffb381110c4a3b4f160e307f0f6f