Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/08/2024, 07:00

General

  • Target

    9d6073aed037108448c90e5495969ebd_JaffaCakes118.xls

  • Size

    786KB

  • MD5

    9d6073aed037108448c90e5495969ebd

  • SHA1

    f8fa3a86d5ef21b0a12b7b379de4cff074790f48

  • SHA256

    0b18ec92065020e7de0e0508299743783aac3df5d97bdfacb5cbc2118a9a336b

  • SHA512

    a830ebfcfc979491174e086a4b738937f5e5ef7872e35728a84c9a1e44d49124a9bf060518df0a5f6e7d1539663c10e49b8bff9edc3e1b6a85dc0f2d5d79a96d

  • SSDEEP

    6144:Ak3hOdsylKlgryzc4bNhZF+E+W2knA3g8hD6smRdbmF+m0jjfPiFSkANIXRj+MM8:Sg8p6sOR0Kf2Sk4yCMPECHJ

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 8 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\9d6073aed037108448c90e5495969ebd_JaffaCakes118.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2428
  • C:\Windows\system32\wbem\WmiC.exe
    WmiC
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4372
    • C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:/Windows/Temp//0dxf5.dll InitHelperDll
      2⤵
        PID:4992

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\D6E2.xSL

      Filesize

      4KB

      MD5

      6f0da330fa6ff42ac3d4bf71afa80d78

      SHA1

      d39c20e6c13cc54c07f3a42f0c5bb7116b0df1ec

      SHA256

      cafef64a34a6450137424e39e9c100475c050d28d742283ef4084fef3cac649d

      SHA512

      e851ed7ef631a1ac27387ce63cc1b190aa3765335a09d9ceeea5f43da9b65a95ea04a2e0b39fe2c01875030ddb61d01e56d35e8cd36d5362f4d12e875538066d

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

      Filesize

      1KB

      MD5

      25cb8321660fda0a1d4209a6a408acb1

      SHA1

      c082f5b0c165bf087b75301e643571ca27d37506

      SHA256

      ba02c47a3c468420d6716241f4ffe75ea8252281dbb8c15eb4e47dbce7f4adb0

      SHA512

      401a0bcb466b0a31c60c302472a056c16f3872ba22b09be58eb8158ce617b349a577594221a8924cab9c84ffc119759207be88f21b7fc05913e9a887d1e2d51c

    • C:\Windows\Temp\0dxf5.dll

      Filesize

      35KB

      MD5

      6eec91078598dda5fe8ce70eba349b3b

      SHA1

      0e9da0372116f63ed42441b4ccb15ca4a632a2e7

      SHA256

      177b8546356bfb211df2308b09f44b999dd86c6bbdbc57e41e6a5b8ae40992b8

      SHA512

      057e258ca1fe109ec0e5a47031610777f2e5b2bdf4eb234000f43ca422420d0471c6fa8262f27ef25d125f88833b1f378606f199e3ec8482dc69a82ccc78acae

    • memory/2428-0-0x00007FFC780D0000-0x00007FFC780E0000-memory.dmp

      Filesize

      64KB

    • memory/2428-2-0x00007FFC780D0000-0x00007FFC780E0000-memory.dmp

      Filesize

      64KB

    • memory/2428-1-0x00007FFCB80ED000-0x00007FFCB80EE000-memory.dmp

      Filesize

      4KB

    • memory/2428-3-0x00007FFC780D0000-0x00007FFC780E0000-memory.dmp

      Filesize

      64KB

    • memory/2428-4-0x00007FFC780D0000-0x00007FFC780E0000-memory.dmp

      Filesize

      64KB

    • memory/2428-9-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-10-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-11-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-12-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-13-0x00007FFC75B30000-0x00007FFC75B40000-memory.dmp

      Filesize

      64KB

    • memory/2428-8-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-14-0x00007FFC75B30000-0x00007FFC75B40000-memory.dmp

      Filesize

      64KB

    • memory/2428-7-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-16-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-15-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-6-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-5-0x00007FFC780D0000-0x00007FFC780E0000-memory.dmp

      Filesize

      64KB

    • memory/2428-17-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-19-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-21-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-20-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-18-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-31-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-32-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-49-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-56-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-61-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-66-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-70-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-77-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-76-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-75-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-78-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-79-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-84-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-83-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-86-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-87-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-88-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-85-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-82-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-80-0x00007FFCB80ED000-0x00007FFCB80EE000-memory.dmp

      Filesize

      4KB

    • memory/2428-81-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-89-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-90-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-91-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-92-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-94-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-96-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-95-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-97-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB

    • memory/2428-145-0x00007FFC780D0000-0x00007FFC780E0000-memory.dmp

      Filesize

      64KB

    • memory/2428-146-0x00007FFC780D0000-0x00007FFC780E0000-memory.dmp

      Filesize

      64KB

    • memory/2428-147-0x00007FFC780D0000-0x00007FFC780E0000-memory.dmp

      Filesize

      64KB

    • memory/2428-148-0x00007FFC780D0000-0x00007FFC780E0000-memory.dmp

      Filesize

      64KB

    • memory/2428-149-0x00007FFCB8050000-0x00007FFCB8245000-memory.dmp

      Filesize

      2.0MB