Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2024, 17:03
Behavioral task
behavioral1
Sample
9f3901e6e69ac2ba464ca7fb633d56f0_JaffaCakes118.doc
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
9f3901e6e69ac2ba464ca7fb633d56f0_JaffaCakes118.doc
Resource
win10v2004-20240802-en
General
-
Target
9f3901e6e69ac2ba464ca7fb633d56f0_JaffaCakes118.doc
-
Size
35KB
-
MD5
9f3901e6e69ac2ba464ca7fb633d56f0
-
SHA1
80fea023eeda549d1f6d2fa57a9d892eced99575
-
SHA256
c1aefd16a5b24717146b09ce3ef1ce89a6773ca2c0e14786f3e2b633eb4da735
-
SHA512
7fe39229c63049cc631fb838f5e13e8fd318e3a936ed009893f4d65df1c22e8f95b09396c4f767d3d157ee845f95ce1cf64decb3ce4a05868364c9db321c6a31
-
SSDEEP
384:D2haoOFUOnd8xHpPr1a20pJWK/klzVyMjDt:aDW0Hhr1m/
Malware Config
Signatures
-
Office macro that triggers on suspicious action 1 IoCs
Office document macro which triggers in special circumstances - often malicious.
resource yara_rule behavioral2/files/0x0008000000023365-81.dat office_macro_on_action -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\~WRD0002.tmp\:Zone.Identifier:$DATA WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2724 WINWORD.EXE 2724 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 2724 WINWORD.EXE 2724 WINWORD.EXE 2724 WINWORD.EXE 2724 WINWORD.EXE 2724 WINWORD.EXE 2724 WINWORD.EXE 2724 WINWORD.EXE 2724 WINWORD.EXE 2724 WINWORD.EXE 2724 WINWORD.EXE 2724 WINWORD.EXE 2724 WINWORD.EXE 2724 WINWORD.EXE 2724 WINWORD.EXE 2724 WINWORD.EXE 2724 WINWORD.EXE 2724 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\9f3901e6e69ac2ba464ca7fb633d56f0_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
45KB
MD5f6ea01713e003f6c1bc77ad9dce68727
SHA1cfa86cf7a466f32877cdc55616a85c0c0b61185f
SHA256ca62552532b73437fd60a9308dc49b74364d556bad5ad6de7ddea23932329197
SHA512a8c29fd8a8f3caef11293668082720f939abfe920a6f931867c43e3440532cc7ae62b3e0d503b2e56865f5d877b9673c10e97d670af6a7293da8903b254c57cf
-
Filesize
25KB
MD5837d0dd1128247581ef16a172a9604b4
SHA1592b1bcb239a04625d2f0536f20720809519d2ca
SHA256ce6a265cd8ea93aa6beaf0da1b28a64b2cb02f5229494eda8f8b7019de9d1b98
SHA512ac7adb326829a25db64bfaa658fa0723e572cc2242b3baefa5ee62d968f3e6237c5fd1b1b24349ed71f19832e1f7cd32d05e7aa0b014fa279eb2b2d64325cd74
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize4KB
MD57b380ed485f9f0573fd338076a9e30ac
SHA1b97328f5c110a21e19fcd17692ae1513824f34a3
SHA256c1611de2a2c283e316662e62c1d93caa52fab902f8c9e762cda63c4047bb9e28
SHA5121c54a0172e88e6a7f9b1da75cbfe2b26ec944add9e2b0e3f15db150bd1575d3fe0ac6d3e406ca8aa5f56de657c4d8f79d8420208afc046a1fa12f1a9a454a3e6