Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
8Ehhbsuuemv.exe
windows7-x64
10Ehhbsuuemv.exe
windows10-2004-x64
10GjIEmKW.exe
windows7-x64
10GjIEmKW.exe
windows10-2004-x64
10Jtvcsfni.exe
windows7-x64
10Jtvcsfni.exe
windows10-2004-x64
10OriginalBuild.exe
windows7-x64
3OriginalBuild.exe
windows10-2004-x64
8PUMPED_docc.exe
windows7-x64
10PUMPED_docc.exe
windows10-2004-x64
10Servicing-...te.pdf
windows7-x64
3Servicing-...te.pdf
windows10-2004-x64
3cgu3.docx
windows7-x64
6cgu3.docx
windows10-2004-x64
6debt.rtf.lnk
windows7-x64
10debt.rtf.lnk
windows10-2004-x64
10eeee.dotm
windows7-x64
3eeee.dotm
windows10-2004-x64
1egor.dotm
windows7-x64
10egor.dotm
windows10-2004-x64
10errr.dotm
windows7-x64
3errr.dotm
windows10-2004-x64
1example.dotm
windows7-x64
10example.dotm
windows10-2004-x64
10fasfs.dotm
windows7-x64
10fasfs.dotm
windows10-2004-x64
10ferrr.dotm
windows7-x64
3ferrr.dotm
windows10-2004-x64
1fffffffnew.dotm
windows7-x64
10fffffffnew.dotm
windows10-2004-x64
10fp4h5ur67j.exe
windows7-x64
10fp4h5ur67j.exe
windows10-2004-x64
10Analysis
-
max time kernel
137s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2024, 02:36
Behavioral task
behavioral1
Sample
Ehhbsuuemv.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Ehhbsuuemv.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
GjIEmKW.exe
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
GjIEmKW.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Jtvcsfni.exe
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
Jtvcsfni.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
OriginalBuild.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
OriginalBuild.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
PUMPED_docc.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
PUMPED_docc.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Servicing-invoice-template.pdf
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Servicing-invoice-template.pdf
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
cgu3.docx
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
cgu3.docx
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
debt.rtf.lnk
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
debt.rtf.lnk
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
eeee.dotm
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
eeee.dotm
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
egor.dotm
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
egor.dotm
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
errr.dotm
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
errr.dotm
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
example.dotm
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
example.dotm
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
fasfs.dotm
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
fasfs.dotm
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
ferrr.dotm
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
ferrr.dotm
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
fffffffnew.dotm
Resource
win7-20241010-en
Behavioral task
behavioral30
Sample
fffffffnew.dotm
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
fp4h5ur67j.exe
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
fp4h5ur67j.exe
Resource
win10v2004-20241007-en
General
-
Target
errr.dotm
-
Size
14KB
-
MD5
15320db9003264c8ce3a7356030746a8
-
SHA1
db6c48cb0b2ea475602ee20bd10d6be192da4a37
-
SHA256
ed057ee336974e52d68f2eb5278c7d61fdbfff8f388e287d4c8c09bd2eed0a2f
-
SHA512
608015f8c7ede90b8859fe2c2838322db98e78ff1e369d1a3019cbfb8d279ca515e2494e0d6946d17cdbed1582faeac2ce2bd53eadbe45751dba542794b0a758
-
SSDEEP
384:tmtl4pb+aVHXwnSC78Qot2J6akwLWdxd36UbYB3ho:ql4pq6El8Qojakw6L0M
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4128 WINWORD.EXE 4128 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4128 WINWORD.EXE 4128 WINWORD.EXE 4128 WINWORD.EXE 4128 WINWORD.EXE 4128 WINWORD.EXE 4128 WINWORD.EXE 4128 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\errr.dotm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize2KB
MD590e491fde30f46b3b66348b549db80bf
SHA162e2e4a1f87ea4b61e218ecb5c21f669e933f3be
SHA256c44019c6fcc4f6107fa82e54dc5c2ea395d0d7419668a2810711b54b5fafacd4
SHA512c6376f45328a87b8803c63f0bc78e0468532fb2ed05ded2dd6cfb4b0f93a6b62dad737bbafedddb5590a100dffdc256615d7ac4a6f3f75e67bee3e639ee1f42e