Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    136s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/08/2024, 16:35

General

  • Target

    9f22824d8ae8bef36a655835e0d88bff_JaffaCakes118.xls

  • Size

    24KB

  • MD5

    9f22824d8ae8bef36a655835e0d88bff

  • SHA1

    696e2ad35bc459e9751a35c9d60826ac8cda71b3

  • SHA256

    06f81bfdf847b3ac7bd86b12d5ccdba75190eb87766e735eb114857e2c7a7d11

  • SHA512

    57cbc8a0a44c2e241b4f7cebe265c5db13e0ae96fac966217490854a41a1a541a9ab795d35598eaed26305b33af8c67901eafb4a500286eb4f3968b0215198cf

  • SSDEEP

    192:8DKkFfak/M/+//cfY1YwY9Klzn06yyC9/0A/iNFqkZgtnoZWTP29E22f0wQfiFfZ:yl10mnambvWi4ijqggloZaqE27w

Malware Config

Signatures

  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

  • Deletes itself 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\9f22824d8ae8bef36a655835e0d88bff_JaffaCakes118.xls"
    1⤵
    • Deletes itself
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3952

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\9f22824d8ae8bef36a655835e0d88bff_JaffaCakes118.xls

    Filesize

    50KB

    MD5

    de8db0092f33f4739bd046e40232a1d6

    SHA1

    6ec51d45270cd716644e2c5a273cf36c15decca5

    SHA256

    31b5d627a6773ab2055ae01bac92f45d916353bc1e9d81f1d47f6ddad72062a3

    SHA512

    d2b7036468a342b28fa60ad888e7e437aaddf359f54c0e3b1cf5a5651c57ca06b84a9bf038cf4ac61a7279ff93175c4e254df49d4add765b1a1dc666983a8bf0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

    Filesize

    371B

    MD5

    2742b4a39934d0b4e60ae3ae67e5443d

    SHA1

    7ee5724aba8686de504d696467aa9833951d009b

    SHA256

    b6681cc43030c007c878c57c4d33cfa693aa409127ef89ff55a5854925663065

    SHA512

    699516a8ebb0b3c0043bce078d6d7c86cc64e64964396f24f94b6fb065db9f66ba48eeae862ccbe77eac3519e0f64d8b9ac38605a53388c2f4c956b2b880da82

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    2KB

    MD5

    a4fdceac3a205f05cd7298a6a162d2d0

    SHA1

    b5ec748f1e8e05e8bb75702e8b53d5215aa2bd0c

    SHA256

    090a9ec9f4b834b5e76c3a12ea81e5e528e91a36c2454f5fef6c5a58e869e5eb

    SHA512

    4a66fce9a17e2c7bc77fb2d9ad584ef4faa573665502a080fd8b521552f3c3b85e69df5b7d1eaf0634c52e58499e1168d52a8a022fb4a399bb40759f31102381

  • memory/3952-47-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-18-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-9-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-13-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-12-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-14-0x00007FFE6BCF0000-0x00007FFE6BD00000-memory.dmp

    Filesize

    64KB

  • memory/3952-11-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-10-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-15-0x00007FFE6BCF0000-0x00007FFE6BD00000-memory.dmp

    Filesize

    64KB

  • memory/3952-8-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-16-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-20-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-22-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-21-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-19-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-45-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-17-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-7-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-6-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-2-0x00007FFE6DEB0000-0x00007FFE6DEC0000-memory.dmp

    Filesize

    64KB

  • memory/3952-46-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-1-0x00007FFEADECD000-0x00007FFEADECE000-memory.dmp

    Filesize

    4KB

  • memory/3952-5-0x00007FFE6DEB0000-0x00007FFE6DEC0000-memory.dmp

    Filesize

    64KB

  • memory/3952-48-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-102-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-53-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-3-0x00007FFE6DEB0000-0x00007FFE6DEC0000-memory.dmp

    Filesize

    64KB

  • memory/3952-68-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-4-0x00007FFE6DEB0000-0x00007FFE6DEC0000-memory.dmp

    Filesize

    64KB

  • memory/3952-94-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-93-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-96-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-95-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-98-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-97-0x00007FFEADECD000-0x00007FFEADECE000-memory.dmp

    Filesize

    4KB

  • memory/3952-99-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-100-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-101-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-50-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-110-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB

  • memory/3952-0-0x00007FFE6DEB0000-0x00007FFE6DEC0000-memory.dmp

    Filesize

    64KB

  • memory/3952-141-0x00007FFE6DEB0000-0x00007FFE6DEC0000-memory.dmp

    Filesize

    64KB

  • memory/3952-144-0x00007FFE6DEB0000-0x00007FFE6DEC0000-memory.dmp

    Filesize

    64KB

  • memory/3952-143-0x00007FFE6DEB0000-0x00007FFE6DEC0000-memory.dmp

    Filesize

    64KB

  • memory/3952-142-0x00007FFE6DEB0000-0x00007FFE6DEC0000-memory.dmp

    Filesize

    64KB

  • memory/3952-145-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

    Filesize

    2.0MB