Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
92s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 22:40
Behavioral task
behavioral1
Sample
7ea8e50ce884dab89a13803ccebea26e_JaffaCakes118.doc
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
7ea8e50ce884dab89a13803ccebea26e_JaffaCakes118.doc
Resource
win10v2004-20240508-en
General
-
Target
7ea8e50ce884dab89a13803ccebea26e_JaffaCakes118.doc
-
Size
1.5MB
-
MD5
7ea8e50ce884dab89a13803ccebea26e
-
SHA1
7216a0df0b873c1da8fbdf85268743be0fed9d1b
-
SHA256
24708d87f5c812fa30e41d7f0fc89e92370773ad8af4494ba1d2adf9cdee56da
-
SHA512
6ae8f1b58aa6a5b3b21231e876d428aced756276fd56c8f6fbdd9ddb6e0806ef1fb013ff60abbaf366c3ff491e9dc76b5699e49c3a9aabf14a531ee7fb1ad316
-
SSDEEP
6144:E+Vq1TSD1Og+DJF0j5reJGSkapJYUzpK43bO6GnLz77:JiRg+DJKheJHPYC84rvGLz77
Malware Config
Signatures
-
Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 1512 1636 DW20.EXE 82 -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dwwin.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dwwin.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dwwin.exe -
Enumerates system info in registry 2 TTPs 5 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dwwin.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dwwin.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1636 WINWORD.EXE 1636 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1636 WINWORD.EXE 1636 WINWORD.EXE 1636 WINWORD.EXE 1636 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1636 WINWORD.EXE 1636 WINWORD.EXE 1636 WINWORD.EXE 1636 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1636 wrote to memory of 1512 1636 WINWORD.EXE 88 PID 1636 wrote to memory of 1512 1636 WINWORD.EXE 88 PID 1512 wrote to memory of 1624 1512 DW20.EXE 89 PID 1512 wrote to memory of 1624 1512 DW20.EXE 89
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7ea8e50ce884dab89a13803ccebea26e_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 46802⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 46803⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:1624
-
-