Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28/04/2024, 20:47
Behavioral task
behavioral1
Sample
06094b9a91777b1fd80fc4ce92a2ccc5_JaffaCakes118.doc
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
06094b9a91777b1fd80fc4ce92a2ccc5_JaffaCakes118.doc
Resource
win10v2004-20240419-en
4 signatures
150 seconds
General
-
Target
06094b9a91777b1fd80fc4ce92a2ccc5_JaffaCakes118.doc
-
Size
33KB
-
MD5
06094b9a91777b1fd80fc4ce92a2ccc5
-
SHA1
096fa22230eead0b4dc6fd5cf65ec6a726e86ba8
-
SHA256
a3f04febc1bddf96b24d9c357c7ae1860e1ba9ec839514e7844eb30268d8c692
-
SHA512
d2a2cb7d478312e8826f1eddd08f3e0a3e4b59f15ce44fd131aae9c92574b0cb0502a1363331005ac8b013740606721ffeb7fdb11c917ae087fe9b8d5443e682
-
SSDEEP
384:uK+GOm1aZxYwE3xMw/StSsIFHTdSIGr/BV7c/4H60jI7Ki7N7hRi:uEsVE3xMwHFddGLBoiQN7hRi
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2216 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 2216 WINWORD.EXE 2216 WINWORD.EXE 2216 WINWORD.EXE 2216 WINWORD.EXE 2216 WINWORD.EXE 2216 WINWORD.EXE 2216 WINWORD.EXE 2216 WINWORD.EXE 2216 WINWORD.EXE 2216 WINWORD.EXE 2216 WINWORD.EXE 2216 WINWORD.EXE 2216 WINWORD.EXE 2216 WINWORD.EXE 2216 WINWORD.EXE 2216 WINWORD.EXE 2216 WINWORD.EXE 2216 WINWORD.EXE 2216 WINWORD.EXE 2216 WINWORD.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\06094b9a91777b1fd80fc4ce92a2ccc5_JaffaCakes118.doc"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2216