Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    17/04/2024, 11:07

General

  • Target

    f5a11a001d08808f78804d40dbb15028_JaffaCakes118.doc

  • Size

    44KB

  • MD5

    f5a11a001d08808f78804d40dbb15028

  • SHA1

    eb31679e688aa59d867dadb65c1875bdeaa77226

  • SHA256

    ead0fc292493d1765cb4a18c6d24a38f81ed96c4d52df10fd89c2fca83693b9c

  • SHA512

    2d4a5249a6ca11159075adb608f2f9bd84e06c52b865df5b8b4f8d07fa76e142981c0d94e31ab4b41b101bf692c0ef2f748e825b4474dc0c2b7c130abd5acb35

  • SSDEEP

    384:u1UwH1+1JtgdUdaguSW218idbpJ3Y+zVsblzwpEpMjyWuTcW4thuigd:k1+1zbdYFiC+WCmXWD0igd

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f5a11a001d08808f78804d40dbb15028_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2164
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2604

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      ce46498b922d2e70e11d222a7bdd0c1d

      SHA1

      934f19c31b1026ab980362ad9fb4254e42e1c325

      SHA256

      8420a13b85f4500cf793a73724bd8e5fef9ec9736010b6a16f5e35c886e5644f

      SHA512

      53db6b1dcde146036ba4f2f3950a4dc5caf135d50ea7a28faef22421753e76c18a3845c7409b0f9e6e65172ef9be491733fdfe1014b6a28bf2bbe23ae3b7bf26

    • memory/2164-12-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2164-13-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2164-8-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2164-9-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2164-10-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2164-0-0x000000002FD41000-0x000000002FD42000-memory.dmp

      Filesize

      4KB

    • memory/2164-11-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2164-2-0x00000000719BD000-0x00000000719C8000-memory.dmp

      Filesize

      44KB

    • memory/2164-14-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2164-22-0x00000000719BD000-0x00000000719C8000-memory.dmp

      Filesize

      44KB

    • memory/2164-23-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2164-24-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2164-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2164-45-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB