Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2024, 08:07
Behavioral task
behavioral1
Sample
fc4e17137145b02d20d91c2aa9ca7bd2_JaffaCakes118.xls
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fc4e17137145b02d20d91c2aa9ca7bd2_JaffaCakes118.xls
Resource
win10v2004-20240412-en
General
-
Target
fc4e17137145b02d20d91c2aa9ca7bd2_JaffaCakes118.xls
-
Size
30KB
-
MD5
fc4e17137145b02d20d91c2aa9ca7bd2
-
SHA1
15809f9aa0f10183532c4ee9ca0f71f3d3ea6fd1
-
SHA256
a21740eb9008c710ae2fcce990e6fa90e416021d706edd45aa347adea0e1bc24
-
SHA512
d7794d38754d3cf3236a13b1c63e6a7ff1052b8a70fed2e52b53ab056cd15123bcfcb6809334547d5415a42a9d658adb2bdf79cd41d0ca8a81c62bdf28a43637
-
SSDEEP
768:mSjxDY9EsuAtdwzMlpXDCrI8y2RdlQfPjbw:mDlz/9Hw
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2900 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 2900 EXCEL.EXE 2900 EXCEL.EXE 2900 EXCEL.EXE 2900 EXCEL.EXE 2900 EXCEL.EXE 2900 EXCEL.EXE 2900 EXCEL.EXE 2900 EXCEL.EXE 2900 EXCEL.EXE 2900 EXCEL.EXE 2900 EXCEL.EXE 2900 EXCEL.EXE 2900 EXCEL.EXE 2900 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\fc4e17137145b02d20d91c2aa9ca7bd2_JaffaCakes118.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD51650b27c4d7b33e17367bcddccbe7428
SHA17515a70be26746c81c1a9483582ecba2d2eab4d1
SHA256b9dd95cf210cdae7bacf677eefd02f6c83bfffad41ebb6dca11c44d5701be00a
SHA51275e47dfcd2e8073bbbab87eab32e72aaba8bc789d33366771bc33745ac092f5b9d3498754c5a2364f0a56226b9cd40d5833ef263b2626e6f26975c44510c11e7
-
Filesize
256B
MD5c6b1a5f0fabb13661274b6680a92fb51
SHA1fb4f7039b2ebec3cb4437d95d522525294cadccc
SHA2563187033c928e0b968eba0b2ade93ae172fe40093bb6f99ac4b3f8a0d5fd506d1
SHA51225138c9e45282406b41ed01d2dc97da4be0db6cb254b8bac28244990065264390c6514d163f95e32993d91d9c77366de8de26440f51ac873da7ac97feff0d221