Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
24/01/2025, 14:24
Behavioral task
behavioral1
Sample
Oбразeц.rtf
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Oбразeц.rtf
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Акт сверки взаиморасчетов по состоянию на 23.01.2025 года.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Акт сверки взаиморасчетов по состоянию на 23.01.2025 года.exe
Resource
win10v2004-20241007-en
General
-
Target
Oбразeц.rtf
-
Size
130KB
-
MD5
1ac029b7f18fcffd5d1af894b82a2beb
-
SHA1
57592f8eda523607c1f69b38f7bbc03d93e23a1a
-
SHA256
5ce54620207204a2cab62d87a9d6389c1a3d37e911b2025e94a8cfb6f91dc600
-
SHA512
6a97d44e6c882b86f272a32286803af7d81f2c7760f21adfe150b0d0c70e6f90318c7d62776cac94fee3bd991a89055bfd128ec2f84d64f88a7c7c3f407666b6
-
SSDEEP
768:2rO6NIOuHvlnS70A70FBmD/lr9W2BmD/lr9WwrTXWrTB80mYmsuYu02I02MoElw5:2rnIPnSZzmnE80mYmsuYu02I02MVusW
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2448 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2448 WINWORD.EXE 2448 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2448 wrote to memory of 2856 2448 WINWORD.EXE 31 PID 2448 wrote to memory of 2856 2448 WINWORD.EXE 31 PID 2448 wrote to memory of 2856 2448 WINWORD.EXE 31 PID 2448 wrote to memory of 2856 2448 WINWORD.EXE 31
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Oбразeц.rtf"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2856
-