Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
47s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18/12/2024, 21:55
General
-
Target
bd016a3a10a8e28d6a1ef688828c73282db9e17246653b71ee347d977628f155.docm
-
Size
83KB
-
MD5
7e884a5c624f84eb907b43d4518f9fd9
-
SHA1
a93c0597744dc6acd132072ad1ccf11259fd1664
-
SHA256
bd016a3a10a8e28d6a1ef688828c73282db9e17246653b71ee347d977628f155
-
SHA512
dc264281bab9ef3d1c51cc04e9d969ce1990c362fd653ddd4188894d069943fd3a017f5bb94f29bcf910231802b2baf16ae562646471d8572b0da5f3f709b94f
-
SSDEEP
1536:Yj+WqQuctgdgmT1pRFRT0/JDiX9vxgaBtLotjzMLqT+9E/wwkJkT0ioOXCls:k+X8YZPBTgJDwvKavotzMuT+y/wAT0NQ
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\bd016a3a10a8e28d6a1ef688828c73282db9e17246653b71ee347d977628f155.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rad11AB8.tmp.exe"C:\Users\Admin\AppData\Local\Temp\rad11AB8.tmp.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
72KB
MD5363f604c7fc3d5d26d75913257f8d9d2
SHA115a3c4be4de3b9c2bd82c863f23cf5bfefdf732e
SHA256b51fbd7bafd493ce77df3632a4e052112a86bb8a0d41b1ff6869c6a912afab3a
SHA5128fec37a8ac7485934868142f6e647fdd33f0af1c715646a99724e648d1fca1a3291e7813ae69bac07118f44806c3a28de111324ca7014554acc4143342156681
-
Filesize
3KB
MD5c8f7d3db5f72f86f63d2b0170cd89dd8
SHA1efa59b03964a32f67759b1528752f9f5e4df4217
SHA2562e013b7af33a34120ea7022e01776a1817da5e5c98ec96cd29fb2220f6fb629f
SHA5128db57b0ae3a7e756c00cac841537ed768d2c1b2f9815ebd937b9fbfd54025f7d31237608a1d6af4553bf369ed83c74f74c8810e030449b0fefbcc7781d73baf5
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB