Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20/08/2024, 14:49
General
-
Target
afa78afb7e8f2f47d8fc0d308abfb0bb_JaffaCakes118.xlsm
-
Size
26KB
-
MD5
afa78afb7e8f2f47d8fc0d308abfb0bb
-
SHA1
1ef3a820447080a44f5bd96f7c94c9c8e6765d3c
-
SHA256
2c57cdeb1938688244dcaf05544e47daef28a6cec2866a674df9b6a4ed45237a
-
SHA512
ce160e93222bd5592c8f6c7ac666a734dee3f0c065721a886d6ae5492dbaf668ad48d0c2eafc0d57c93b46cb9ae53b9f3a74e5739ea8181e085ba8779ccd528a
-
SSDEEP
384:6d3gdaSUlM9z5BUSMUtiJ+gK+qD8qsuSvNtmPWbtqpq/9R9dhqujV6M:IIvxgAPh+kNSaPWp5VR9WI
Malware Config
Extracted
https://en.ioho.me/u87o11.txt
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\afa78afb7e8f2f47d8fc0d308abfb0bb_JaffaCakes118.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -s C:\bQRmAmpj\YsnVxs\xVmDcR.2⤵
- Process spawned unexpected child process
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5aea3005aa51439531a2b154fe5ea973d
SHA1bb99431cf8928b2c676860239180573dc23b2152
SHA25664ecb4b7512b8a46916b59b683fc22215ef3a089b9cd08a6b4c88efb246b06d4
SHA512535eab151c7a6b3f14bb4c3d40621c8f9714d6bd3bc60cbe3338621dead36fc3b9fcba28dd546ae5dd8ca3844e5328f5e607017a3d0429e007ea2a31ea3f9e69
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB