Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    20/06/2024, 10:44

General

  • Target

    0541cfd7e7b928d98712a77ff7099ba8_JaffaCakes118.doc

  • Size

    39KB

  • MD5

    0541cfd7e7b928d98712a77ff7099ba8

  • SHA1

    e4a59c2424e767793daeda9b82419b0da1467665

  • SHA256

    a4c2463c0ac75e50402b35fd6b951e6ba79f37fd3687fedf1edff35c3221afeb

  • SHA512

    537c99e1e7fd917489c497fc9d50c14bfc7d5b304fb8fb040d7d9d4985bb3b5403b0e759a1db015fb1c33ce1f85921d431afdce047f1b4997a81d2dc77f48eef

  • SSDEEP

    384:r0cSqzyzz6sRbDTWaYsLZIkmS6IVKuqP36Nkqv5bQLa9:rebDiaY+IkmS6IVKuduqv5bQL

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0541cfd7e7b928d98712a77ff7099ba8_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1216
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2532

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      25KB

      MD5

      47bfd32c0735f04a771a453cbc7467b7

      SHA1

      04d452a501e392b1b85893f1d4f6dd698ad70d17

      SHA256

      ffa558d1e323aaa45b042bed6dbd4a437bf473339ce0ce9633e42789898ecb04

      SHA512

      8a65ece718a3dcb3a46f21b50335adaea183792cda90f224aaa29fd8caab4fb8033f3eb447a5c0f017995ba0d9c97521a3c069a254f77c3fc0a6363420055486

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      25KB

      MD5

      d0e3a160722807b6ea51a15ea6afafae

      SHA1

      b761bb1a80132d720c8b29da4472579a21a83605

      SHA256

      307be7b76b7458f106e8e1968e0183dc53d85663773e38387a2b5c8244c8b1d5

      SHA512

      54aaf10f944a2e0ac2cb4952c21fa42ac47e051b7bca726fffb978acf06e9a6764c17c71560ea81b349ec12d01946edec702e6e009734508689e22ccbdbc3649

    • memory/1216-0-0x000000002F421000-0x000000002F422000-memory.dmp

      Filesize

      4KB

    • memory/1216-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1216-2-0x00000000713ED000-0x00000000713F8000-memory.dmp

      Filesize

      44KB

    • memory/1216-12-0x0000000005A80000-0x0000000005B80000-memory.dmp

      Filesize

      1024KB

    • memory/1216-24-0x00000000713ED000-0x00000000713F8000-memory.dmp

      Filesize

      44KB

    • memory/1216-25-0x0000000005A80000-0x0000000005B80000-memory.dmp

      Filesize

      1024KB

    • memory/1216-33-0x0000000005A80000-0x0000000005B80000-memory.dmp

      Filesize

      1024KB

    • memory/1216-48-0x0000000005A80000-0x0000000005B80000-memory.dmp

      Filesize

      1024KB

    • memory/1216-55-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB