Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
365ccf2a8a9...18.exe
windows7-x64
765ccf2a8a9...18.exe
windows10-2004-x64
7$PLUGINSDI...se.dll
windows7-x64
3$PLUGINSDI...se.dll
windows10-2004-x64
3$PLUGINSDI...se.rtf
windows7-x64
4$PLUGINSDI...se.rtf
windows10-2004-x64
1$PLUGINSDI...ub.exe
windows7-x64
7$PLUGINSDI...ub.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...on.dll
windows7-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
3$PLUGINSDIR/Math.dll
windows7-x64
3$PLUGINSDIR/Math.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...se.rtf
windows7-x64
4$PLUGINSDI...se.rtf
windows10-2004-x64
1$PLUGINSDI...se.rtf
windows7-x64
4$PLUGINSDI...se.rtf
windows10-2004-x64
1$PLUGINSDI...ib.dll
windows7-x64
3$PLUGINSDI...ib.dll
windows10-2004-x64
3$PLUGINSDI...se.rtf
windows7-x64
4$PLUGINSDI...se.rtf
windows10-2004-x64
1$PLUGINSDI...vo.rtf
windows7-x64
4$PLUGINSDI...vo.rtf
windows10-2004-x64
1$PLUGINSDI...de.rtf
windows7-x64
4$PLUGINSDI...de.rtf
windows10-2004-x64
1$PLUGINSDI...DS.rtf
windows7-x64
4$PLUGINSDI...DS.rtf
windows10-2004-x64
1Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/07/2024, 02:32
Static task
static1
Behavioral task
behavioral1
Sample
65ccf2a8a9c90629015cc3b004347fd7_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
65ccf2a8a9c90629015cc3b004347fd7_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/CustomLicense.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/CustomLicense.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/DefaultTab_license.rtf
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/DefaultTab_license.rtf
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/DualStub.exe
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/DualStub.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/Math.dll
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/Math.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/frg_license.rtf
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/frg_license.rtf
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/gc_license.rtf
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/gc_license.rtf
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/intlib.dll
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/intlib.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/jp_license.rtf
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/jp_license.rtf
Resource
win10v2004-20240709-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/license_Ciuvo.rtf
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/license_Ciuvo.rtf
Resource
win10v2004-20240709-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/license_Ciuvo_de.rtf
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/license_Ciuvo_de.rtf
Resource
win10v2004-20240709-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/license_GDS.rtf
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/license_GDS.rtf
Resource
win10v2004-20240704-en
General
-
Target
$PLUGINSDIR/license_Ciuvo_de.rtf
-
Size
31KB
-
MD5
c17d94791d08bc745dfb92155cb214fe
-
SHA1
5fdb5c87f120baea6d77db3c7a1d8150c2fe96e5
-
SHA256
dc3838a77f2869905c5117814f1eb4edf8c980994f4fb5c728518e9ea0835442
-
SHA512
035c133c8e547d36eae7246e69d0ef57a447a9a3a7b5dfe48c465c5357d7abedfbdef74717ebef76a9f5e8f05766f6223a64cbd22e60640b5661d09f5c67bb94
-
SSDEEP
768:fmDxjufnFvTCPe+V9EOReOb1vPwgyr+dX/VHDfAhWba5TzAVqnD69n:4vPDhddfMWP
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2472 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2472 WINWORD.EXE 2472 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2472 wrote to memory of 2808 2472 WINWORD.EXE 32 PID 2472 wrote to memory of 2808 2472 WINWORD.EXE 32 PID 2472 wrote to memory of 2808 2472 WINWORD.EXE 32 PID 2472 wrote to memory of 2808 2472 WINWORD.EXE 32
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\license_Ciuvo_de.rtf"1⤵
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2808
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD573d38e9a3d92a7950582e6788ef68cfd
SHA13d3ec2141ce9c1ee4a3ebede7e0a35605e6ed9a9
SHA256edc3944c309c51cda4ac2529657005893ff8eb0255ba6ddfa6e6fa78ae4ac4b1
SHA512c95718b5e4aae8ab120a34c62d1ea0e895c858361461eb410de3f92c4e3b945103893f142615b82e4c746e03b37865f82c483133df1d5c53db659b670ad96557