Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
61s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 20:01
Static task
static1
Behavioral task
behavioral1
Sample
ARCHIVE PASSWORD and Instructions.docx
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ARCHIVE PASSWORD and Instructions.docx
Resource
win10v2004-20240802-en
General
-
Target
ARCHIVE PASSWORD and Instructions.docx
-
Size
349KB
-
MD5
7ebfdbcf29d2e06c213b88d97d420fde
-
SHA1
2218ba4ca703090c2257403a57061f102275736c
-
SHA256
772cc4e128a6995b6f5037f83d5a1d00172b1fb234995420a911adfb1f2c33f4
-
SHA512
5c0851dae4c13104de194064a3e53465e6ef0fe080c76a0e855c18adfd2f6202535a8663e26bb4ba572f1fa4dba1138ce6aa31928bff9e3c4123a1e293e70f0a
-
SSDEEP
6144:HUGvyf+c50AtjMSAKDU6x0VdUFgJV+uCAM6SqRCNrftVv0SVr++WxzcHe:H9vyrtoSAKudUiVhhxMftGSV++0c+
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2688 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2688 WINWORD.EXE 2688 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2712 2688 WINWORD.EXE 31 PID 2688 wrote to memory of 2712 2688 WINWORD.EXE 31 PID 2688 wrote to memory of 2712 2688 WINWORD.EXE 31 PID 2688 wrote to memory of 2712 2688 WINWORD.EXE 31
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ARCHIVE PASSWORD and Instructions.docx"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84