Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    102s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/09/2024, 04:27

General

  • Target

    百分百阿里旺旺群发器(淘宝版)/旺旺群发使用前必读文档.doc

  • Size

    44KB

  • MD5

    6ebc7658e79f63c9e7a435fdbeec2e20

  • SHA1

    9395830b78ee90c780d085eaed248ddfbfcbc32a

  • SHA256

    220d8a877e4281a3a48670d0e618a63657665d99380b22bdd8b8e0d619cf5fdd

  • SHA512

    bc4064962046feafa6a487d98c20b9f7206d778bd329d6ce5e8fc9f4b38f2e0338693b1e929bb8da7c7775dc44afb577a0d516aaf301040ee0465c29b05e1832

  • SSDEEP

    768:gKpFUC/dEuupT6ST3peao1CQ+JFnvGZ789:JpFh/nul6Sbxoc5jl

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\百分百阿里旺旺群发器(淘宝版)\旺旺群发使用前必读文档.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3560

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCDDC31.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    1KB

    MD5

    ee3c0c9501d9015f28e6ae19957f9dc0

    SHA1

    1d13b239dfe1f1f534a7a917701b80d899cf727e

    SHA256

    cbb8ef0a214700f6db6fe59776fa7866c0b0c2bc91a8a4faf6a1a2aaa7729324

    SHA512

    76e62fb02dc6da32b38c2dbd7ad4012f564622657f00395fd701b7cc26493e3140aebf202390592de5df56cb50ed1a41e418f39da5b3a61e88f940d2e607bdc6

  • memory/3560-21-0x00007FFD92F00000-0x00007FFD92F10000-memory.dmp

    Filesize

    64KB

  • memory/3560-11-0x00007FFDD53F0000-0x00007FFDD55E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3560-5-0x00007FFDD53F0000-0x00007FFDD55E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3560-4-0x00007FFD95470000-0x00007FFD95480000-memory.dmp

    Filesize

    64KB

  • memory/3560-8-0x00007FFDD53F0000-0x00007FFDD55E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3560-12-0x00007FFDD53F0000-0x00007FFDD55E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3560-14-0x00007FFDD53F0000-0x00007FFDD55E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3560-13-0x00007FFDD53F0000-0x00007FFDD55E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3560-15-0x00007FFDD53F0000-0x00007FFDD55E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3560-18-0x00007FFDD53F0000-0x00007FFDD55E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3560-20-0x00007FFDD53F0000-0x00007FFDD55E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3560-19-0x00007FFDD53F0000-0x00007FFDD55E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3560-23-0x00007FFDD53F0000-0x00007FFDD55E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3560-22-0x00007FFDD53F0000-0x00007FFDD55E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3560-1-0x00007FFDD548D000-0x00007FFDD548E000-memory.dmp

    Filesize

    4KB

  • memory/3560-17-0x00007FFDD53F0000-0x00007FFDD55E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3560-2-0x00007FFD95470000-0x00007FFD95480000-memory.dmp

    Filesize

    64KB

  • memory/3560-10-0x00007FFDD53F0000-0x00007FFDD55E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3560-16-0x00007FFD92F00000-0x00007FFD92F10000-memory.dmp

    Filesize

    64KB

  • memory/3560-9-0x00007FFDD53F0000-0x00007FFDD55E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3560-7-0x00007FFD95470000-0x00007FFD95480000-memory.dmp

    Filesize

    64KB

  • memory/3560-6-0x00007FFDD53F0000-0x00007FFDD55E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3560-37-0x00007FFDD53F0000-0x00007FFDD55E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3560-38-0x00007FFDD548D000-0x00007FFDD548E000-memory.dmp

    Filesize

    4KB

  • memory/3560-39-0x00007FFDD53F0000-0x00007FFDD55E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3560-40-0x00007FFDD53F0000-0x00007FFDD55E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3560-3-0x00007FFD95470000-0x00007FFD95480000-memory.dmp

    Filesize

    64KB

  • memory/3560-0-0x00007FFD95470000-0x00007FFD95480000-memory.dmp

    Filesize

    64KB

  • memory/3560-181-0x00007FFD95470000-0x00007FFD95480000-memory.dmp

    Filesize

    64KB

  • memory/3560-180-0x00007FFD95470000-0x00007FFD95480000-memory.dmp

    Filesize

    64KB

  • memory/3560-182-0x00007FFD95470000-0x00007FFD95480000-memory.dmp

    Filesize

    64KB

  • memory/3560-183-0x00007FFD95470000-0x00007FFD95480000-memory.dmp

    Filesize

    64KB

  • memory/3560-184-0x00007FFDD53F0000-0x00007FFDD55E5000-memory.dmp

    Filesize

    2.0MB