Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    23/09/2024, 17:38

General

  • Target

    27e17bc7efc2513c75ecc1d8dac97187ca4b3f6d6aa2113e814e66ea5d2cb696.docm

  • Size

    124KB

  • MD5

    cc0f9cc1f9133b0f5dd045a34b2d7ae1

  • SHA1

    c41f1c79442c0e2b717473f9c40d395176afffdb

  • SHA256

    27e17bc7efc2513c75ecc1d8dac97187ca4b3f6d6aa2113e814e66ea5d2cb696

  • SHA512

    154c2ddc43ba72e1f166dc025e20ef5c580e1f490f1828496c1f10f8ef17b4432137740c66552d12cb647499e9ad7d5a62e5ab709ed2bcd9d08d2416b475c3da

  • SSDEEP

    1536:vkc9anle9tQVTGH7gPgP8MDw/jlQx1JE7vReOr0l77CXXNaHsdUXSIt98iuBXFtc:vVWqQVtClwH9r0l77AnsSmy/BVtqxp

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\27e17bc7efc2513c75ecc1d8dac97187ca4b3f6d6aa2113e814e66ea5d2cb696.docm"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2640
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2032

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      19KB

      MD5

      920bfbec93eecdea19d7eb13ad751a1b

      SHA1

      205947162e0d72bd6eec27a31c6b2b64923c53cd

      SHA256

      55b62fc0557210f774ba151d230c67b61427c98b117d6299717b2ecafc8cf424

      SHA512

      8b5e10d16b4336546739f91c6f22bf9ec7f56fc63ad8cc03137dfe29cd15bf04ac8b37bebae1d56c008dd3ee523ccf29f0c6cee38f47e54ef818665781178fa1

    • memory/2640-12-0x000000007141D000-0x0000000071428000-memory.dmp

      Filesize

      44KB

    • memory/2640-15-0x0000000000690000-0x0000000000790000-memory.dmp

      Filesize

      1024KB

    • memory/2640-6-0x0000000000690000-0x0000000000790000-memory.dmp

      Filesize

      1024KB

    • memory/2640-9-0x0000000000690000-0x0000000000790000-memory.dmp

      Filesize

      1024KB

    • memory/2640-11-0x0000000000690000-0x0000000000790000-memory.dmp

      Filesize

      1024KB

    • memory/2640-10-0x0000000000690000-0x0000000000790000-memory.dmp

      Filesize

      1024KB

    • memory/2640-8-0x0000000000690000-0x0000000000790000-memory.dmp

      Filesize

      1024KB

    • memory/2640-7-0x0000000000690000-0x0000000000790000-memory.dmp

      Filesize

      1024KB

    • memory/2640-5-0x0000000000690000-0x0000000000790000-memory.dmp

      Filesize

      1024KB

    • memory/2640-0-0x000000002F991000-0x000000002F992000-memory.dmp

      Filesize

      4KB

    • memory/2640-2-0x000000007141D000-0x0000000071428000-memory.dmp

      Filesize

      44KB

    • memory/2640-16-0x0000000000690000-0x0000000000790000-memory.dmp

      Filesize

      1024KB

    • memory/2640-13-0x0000000000690000-0x0000000000790000-memory.dmp

      Filesize

      1024KB

    • memory/2640-18-0x0000000000690000-0x0000000000790000-memory.dmp

      Filesize

      1024KB

    • memory/2640-17-0x0000000000690000-0x0000000000790000-memory.dmp

      Filesize

      1024KB

    • memory/2640-14-0x0000000000690000-0x0000000000790000-memory.dmp

      Filesize

      1024KB

    • memory/2640-25-0x0000000000690000-0x0000000000790000-memory.dmp

      Filesize

      1024KB

    • memory/2640-26-0x0000000000690000-0x0000000000790000-memory.dmp

      Filesize

      1024KB

    • memory/2640-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2640-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2640-47-0x000000007141D000-0x0000000071428000-memory.dmp

      Filesize

      44KB