Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 00:32
Behavioral task
behavioral1
Sample
7ef121597ba88b20dab4c8216e3368d0_JaffaCakes118.xls
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
7ef121597ba88b20dab4c8216e3368d0_JaffaCakes118.xls
Resource
win10v2004-20240508-en
General
-
Target
7ef121597ba88b20dab4c8216e3368d0_JaffaCakes118.xls
-
Size
51KB
-
MD5
7ef121597ba88b20dab4c8216e3368d0
-
SHA1
82b2d537f37f4809b9542f838fa9efdbd42432d1
-
SHA256
0f4398e0650408b59d516bef26254464e99dc0ba48b10607ebe76f3957f7bb89
-
SHA512
3a41414cf72de452bbada30481fcb2235a61eb7b2a88e3485f0f9490e4720bed9e51cca5fa6e9f0ee5d07415ef2241f41dc441caf6cc8c18aa8b05cbec8bdf67
-
SSDEEP
1536:chjk3hbdlylKsgqopeJBWhZFGkE+cL2NdAFcRxbg+YCEzY/P7DwG3a10:chjk3hbdlylKsgqopeJBWhZFGkE+cL2V
Malware Config
Extracted
https://pemuda.suraunurulihsan.com.my/kd1aw6y7.txt
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 4392 1308 regsvr32.exe 88 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1308 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 18 IoCs
pid Process 1308 EXCEL.EXE 1308 EXCEL.EXE 1308 EXCEL.EXE 1308 EXCEL.EXE 1308 EXCEL.EXE 1308 EXCEL.EXE 1308 EXCEL.EXE 1308 EXCEL.EXE 1308 EXCEL.EXE 1308 EXCEL.EXE 1308 EXCEL.EXE 1308 EXCEL.EXE 1308 EXCEL.EXE 1308 EXCEL.EXE 1308 EXCEL.EXE 1308 EXCEL.EXE 1308 EXCEL.EXE 1308 EXCEL.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1308 wrote to memory of 4392 1308 EXCEL.EXE 96 PID 1308 wrote to memory of 4392 1308 EXCEL.EXE 96
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\7ef121597ba88b20dab4c8216e3368d0_JaffaCakes118.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -s C:\XYwiefeS\kbHaLR\dcZtpFfm.2⤵
- Process spawned unexpected child process
PID:4392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3756,i,9746875443948590908,1444894342962555245,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:81⤵PID:5000