Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 01:02
Static task
static1
Behavioral task
behavioral1
Sample
1eea717f1a4eab39a53621a99e1e2466_JaffaCakes118.doc
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1eea717f1a4eab39a53621a99e1e2466_JaffaCakes118.doc
Resource
win10v2004-20240419-en
General
-
Target
1eea717f1a4eab39a53621a99e1e2466_JaffaCakes118.doc
-
Size
33KB
-
MD5
1eea717f1a4eab39a53621a99e1e2466
-
SHA1
8526e4a11eac226d3c3b04f9f7cc688a3aa51046
-
SHA256
6c8373c2ee7c3a2e9954fd6b790f30fe897debfc4a6716c31bf40a18e92c9530
-
SHA512
1ca232b4fea2447b58c6baca2dd1ac1cfa02a9f22de21a56c3d1ed4d3fd221cea8269a4e683b784b0428d96c498d8b8a978d1cafd3c7ffb514689303572459c6
-
SSDEEP
192:g2AZNYl8esirLT42zRaQF5kitEnhQbwbHxscY4IZ0j97QDa:g2H8esX2da+kitYhxIZ0j9
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1108 WINWORD.EXE 1108 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 1108 WINWORD.EXE 1108 WINWORD.EXE 1108 WINWORD.EXE 1108 WINWORD.EXE 1108 WINWORD.EXE 1108 WINWORD.EXE 1108 WINWORD.EXE 1108 WINWORD.EXE 1108 WINWORD.EXE 1108 WINWORD.EXE 1108 WINWORD.EXE 1108 WINWORD.EXE 1108 WINWORD.EXE 1108 WINWORD.EXE 1108 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1eea717f1a4eab39a53621a99e1e2466_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
23KB
MD517bdd6007d41900829216829a48f0d25
SHA17afc9d21b2c7dd6ab007e0c98ee85f0ec6d774ab
SHA256f305bd1658250f22d431f3dc90fa1b0f9b8d35b3f3d48ccc76d81e77a6d57ad3
SHA51212b80b144e05e4395051e55fbf893bd1722713062e574812aeace59ade6008f2d0dae962c9e0242a1a3fe4738173ef8dace721246e3f7527f789d51d93ea33f4