Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    25/01/2025, 02:35

General

  • Target

    $PLUGINSDIR/AnimalShopping_license.rtf

  • Size

    101KB

  • MD5

    52cda44f0fc8827f25e98e17d79f9070

  • SHA1

    8d2b4aaf6f9deeaaad0562af75372166d213dfe0

  • SHA256

    50733babddacc0b7deb8b428bcbb34f4ac083d41b3c516b5f98534ca1bb1f322

  • SHA512

    b464454c8c5d7675215beacc8205a3d37981e962915b167dc0bb9cd1de859303c72ea6540705ef15971cc4e61e5c48b7d77b7e7172eaab0197ae082ec37a0137

  • SSDEEP

    3072:rCnlb8SacXMY3JwwcOqeEIEQ7o3DaPRy2:O5uwcOq9IEQ7o3DaPRP

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Office loads VBA resources, possible macro or embedded object present
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\AnimalShopping_license.rtf"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2404

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2404-0-0x000000002F9A1000-0x000000002F9A2000-memory.dmp

    Filesize

    4KB

  • memory/2404-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2404-2-0x000000007120D000-0x0000000071218000-memory.dmp

    Filesize

    44KB

  • memory/2404-5-0x000000007120D000-0x0000000071218000-memory.dmp

    Filesize

    44KB