Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
159s -
max time network
139s -
platform
windows10-1703_x64 -
resource
win10-20240404-uk -
resource tags
arch:x64arch:x86image:win10-20240404-uklocale:uk-uaos:windows10-1703-x64systemwindows -
submitted
30/09/2024, 13:00
Static task
static1
Behavioral task
behavioral1
Sample
проек ПІДОЗРИ Казарян.doc
Resource
win10-20240404-uk
General
-
Target
проек ПІДОЗРИ Казарян.doc
-
Size
122KB
-
MD5
7237644ae941a94f2bd46489c89eb97c
-
SHA1
5386594ce69f48989ca66910000004eec4557fe5
-
SHA256
4adac8a428bfdff15cf4ac6abd44fdc911f28e5e65ed141869082d2a68e64907
-
SHA512
5fcb9b7473b6faf23b6a4b78eb84cf9080b7fb583978aab20980f8780e760cae0015f19e90470a4c06c9815b81bd829bfa386d66d964b3711cad941c0a78b63d
-
SSDEEP
1536:Fjh9qeVBSG3L+cydzvx5ssgWD/pVDdrMiPQwMorQZ5Z1h8Q9BRNDH3:Fjh9xRb+cydzv/sJWD/fdgiowK9B
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3364 WINWORD.EXE 3364 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 3364 WINWORD.EXE 3364 WINWORD.EXE 3364 WINWORD.EXE 3364 WINWORD.EXE 3364 WINWORD.EXE 3364 WINWORD.EXE 3364 WINWORD.EXE 3364 WINWORD.EXE 3364 WINWORD.EXE 3364 WINWORD.EXE 3364 WINWORD.EXE 3364 WINWORD.EXE 3364 WINWORD.EXE 3364 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\проек ПІДОЗРИ Казарян.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3364
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e