Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7cb5deb4338...1N.exe
windows7-x64
7cb5deb4338...1N.exe
windows10-2004-x64
7$PLUGINSDI...es.dll
windows7-x64
3$PLUGINSDI...es.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/eula.rtf
windows7-x64
4$PLUGINSDIR/eula.rtf
windows10-2004-x64
1$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...it.dll
windows7-x64
7$PLUGINSDI...it.dll
windows10-2004-x64
7$PLUGINSDI...7z.dll
windows7-x64
3$PLUGINSDI...7z.dll
windows10-2004-x64
3Analysis
-
max time kernel
119s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 03:14
Behavioral task
behavioral1
Sample
cb5deb433869d9c6fad0e50217a6e6cb29ed1fa5f923a07458fa67e1d4cfd9e1N.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
cb5deb433869d9c6fad0e50217a6e6cb29ed1fa5f923a07458fa67e1d4cfd9e1N.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Processes.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Processes.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/ShellExecAsUser.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/ShellExecAsUser.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/eula.rtf
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/eula.rtf
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsRichEdit.dll
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsRichEdit.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20241007-en
General
-
Target
$PLUGINSDIR/eula.rtf
-
Size
7KB
-
MD5
f8c819b8561555c7eb7f43bceb5041e8
-
SHA1
b745abb915ce85856c887f07e042676a025abbe9
-
SHA256
1f65f7426ce8df2cb5199dcff30a632425d4f5edd5390fe5d6176ab36592b95c
-
SHA512
13ab0c43dd377fc6aa0b832005937900187570c4f38cba9aca91e7dc4ac5caba56bf683c622b2c62d46d8bfdd9d0637054889b270b121340b66cf4808dcf66bf
-
SSDEEP
192:5fM+ONlyE1gJRNyalqKNO30dISDS9Vb3+DmhGZ6G2J2WlMMFHyzQO2:1ONYE1gJRNyaYXqSAP6T0W1HyzL2
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2532 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2532 WINWORD.EXE 2532 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2748 2532 WINWORD.EXE 31 PID 2532 wrote to memory of 2748 2532 WINWORD.EXE 31 PID 2532 wrote to memory of 2748 2532 WINWORD.EXE 31 PID 2532 wrote to memory of 2748 2532 WINWORD.EXE 31
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\eula.rtf"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2748
-