Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/01/2025, 02:35

General

  • Target

    $PLUGINSDIR/license_AVG.rtf

  • Size

    55KB

  • MD5

    df37a95a1fa22b46035fd64a0d9bf468

  • SHA1

    3723c58da5ae852ee1d86b117d9ea4a3a6d2d175

  • SHA256

    683c8faa65f4cad659f4838f7178da4d1cd4fb7e385e4ae2933e6383533ffcb1

  • SHA512

    3aa3c12b39c8827bd71737536a4cc9922b07410825eae9b7a7a299c9494a2bd1958904384fdad6beed16277a8f6e9545211960607e2321f5cd408cb3669d3951

  • SSDEEP

    768:A6ZVONul/f21xmAbiCyaPYT7dkJurzuY9o4/r/bARdP69At5Hm7XlYTcZGyhMxJr:nHPupQFm

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license_AVG.rtf" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4676

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCD2639.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    3KB

    MD5

    22693876cf2c3b31575a594102edd35c

    SHA1

    94e3ce944e949950670947e85dd2a5b3ad6eb235

    SHA256

    c744b5fe9444833f1f7bb70c365275cf5218615f801851f444e1103c81800d74

    SHA512

    e472fdcca23b8f60e4bc4438cb0feff1b6a84fdadd77060e581b353e7fdb67ef40468cc4b6a0bbec48196593db5d7ed6828ac1288c8f522c909868a35e7b9a59

  • memory/4676-15-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4676-17-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4676-4-0x00007FFA26970000-0x00007FFA26980000-memory.dmp

    Filesize

    64KB

  • memory/4676-7-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4676-6-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4676-8-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4676-5-0x00007FFA26970000-0x00007FFA26980000-memory.dmp

    Filesize

    64KB

  • memory/4676-9-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4676-11-0x00007FFA24880000-0x00007FFA24890000-memory.dmp

    Filesize

    64KB

  • memory/4676-18-0x00007FFA24880000-0x00007FFA24890000-memory.dmp

    Filesize

    64KB

  • memory/4676-0-0x00007FFA26970000-0x00007FFA26980000-memory.dmp

    Filesize

    64KB

  • memory/4676-1-0x00007FFA26970000-0x00007FFA26980000-memory.dmp

    Filesize

    64KB

  • memory/4676-10-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4676-20-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4676-19-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4676-16-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4676-14-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4676-13-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4676-12-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4676-34-0x00007FFA668F0000-0x00007FFA66AE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4676-2-0x00007FFA26970000-0x00007FFA26980000-memory.dmp

    Filesize

    64KB

  • memory/4676-3-0x00007FFA6698D000-0x00007FFA6698E000-memory.dmp

    Filesize

    4KB