Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    29/09/2024, 13:21

General

  • Target

    fe9d69fc9e928e62df311b6396286656_JaffaCakes118.rtf

  • Size

    884KB

  • MD5

    fe9d69fc9e928e62df311b6396286656

  • SHA1

    f79d97050e3b5898c476d4b8b08002a58cf96baa

  • SHA256

    4e96ee3b819f6b5e357284a6a401efe0ea7a3307d35d0d040452780a472dba3e

  • SHA512

    1ed5afc1e1fafa529630a0b1adb9c5e1922de30344bfc104208d9a81e4980505d483f605eab477686b7ee0a02a7a61564671acf6361949c2d15eb8753acf2663

  • SSDEEP

    24576:xIRIlfARYEpsJO7oqmxVSxStXIVpdFmkP8Io:n

Malware Config

Extracted

Family

lokibot

C2

http://globalogroup.com/group/glo/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Office loads VBA resources, possible macro or embedded object present
  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\fe9d69fc9e928e62df311b6396286656_JaffaCakes118.rtf"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2032
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tAsK.bAt
      2⤵
      • Process spawned unexpected child process
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2368
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\2nd.bat
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2452
        • C:\Windows\SysWOW64\timeout.exe
          TIMEOUT 1
          4⤵
          • System Location Discovery: System Language Discovery
          • Delays execution with timeout.exe
          PID:2172
        • C:\Users\Admin\AppData\Local\Temp\exe.exe
          C:\Users\Admin\AppData\Local\Temp\ExE.ExE
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1900
          • C:\Windows\SysWOW64\explorer.exe
            "C:\Windows\System32\explorer.exe" /c select, C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2580
        • C:\Windows\SysWOW64\taskkill.exe
          TASKKILL /F /IM winword.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2788
        • C:\Windows\SysWOW64\reg.exe
          reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Word\Resiliency /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2668
        • C:\Windows\SysWOW64\reg.exe
          reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Resiliency /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2208
        • C:\Windows\SysWOW64\reg.exe
          reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Word\Resiliency /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1380
        • C:\Windows\SysWOW64\reg.exe
          reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Word\Resiliency /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2500
        • C:\Windows\SysWOW64\reg.exe
          reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Word\Resiliency /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1168
        • C:\Windows\SysWOW64\reg.exe
          reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2868
        • C:\Windows\SysWOW64\reg.exe
          reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Word\Resiliency /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2976
        • C:\Windows\SysWOW64\reg.exe
          reg delete HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word\Resiliency /f
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1144
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\8.0\Word\File MRU" /v "Item 1"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3000
          • C:\Windows\SysWOW64\reg.exe
            REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\8.0\Word\File MRU" /v "Item 1"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2828
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\9.0\Word\File MRU" /v "Item 1"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2940
          • C:\Windows\SysWOW64\reg.exe
            REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\9.0\Word\File MRU" /v "Item 1"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3044
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\10.0\Word\File MRU" /v "Item 1"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2024
          • C:\Windows\SysWOW64\reg.exe
            REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\10.0\Word\File MRU" /v "Item 1"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1876
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\File MRU" /v "Item 1"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2840
          • C:\Windows\SysWOW64\reg.exe
            REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\11.0\Word\File MRU" /v "Item 1"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2856
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Word\File MRU" /v "Item 1"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2688
          • C:\Windows\SysWOW64\reg.exe
            REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\12.0\Word\File MRU" /v "Item 1"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2680
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\File MRU" /v "Item 1"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3024
          • C:\Windows\SysWOW64\reg.exe
            REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\14.0\Word\File MRU" /v "Item 1"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2832
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Word\File MRU" /v "Item 1"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2968
          • C:\Windows\SysWOW64\reg.exe
            REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Word\File MRU" /v "Item 1"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3020
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\File MRU" /v "Item 1"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2708
          • C:\Windows\SysWOW64\reg.exe
            REG QUERY "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\File MRU" /v "Item 1"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3016
        • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
          "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\ShowConvertFrom.docx"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: AddClipboardFormatListener
          • Suspicious use of SetWindowsHookEx
          PID:1840
          • C:\Windows\splwow64.exe
            C:\Windows\splwow64.exe 12288
            5⤵
              PID:2344
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tAsK.bAt
        2⤵
        • Process spawned unexpected child process
        • System Location Discovery: System Language Discovery
        PID:2896
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
        PID:2468
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe"
          2⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1500
          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\app.exe"
            3⤵
            • Executes dropped EXE
            • Accesses Microsoft Outlook profiles
            • Suspicious use of AdjustPrivilegeToken
            • outlook_office_path
            • outlook_win_path
            PID:2072

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\2nd.bat

        Filesize

        2KB

        MD5

        57ff2666bfc47c63e05d5c182b0f89f3

        SHA1

        c88b20b249b8f4ff963c897e2ba0028e20b316e2

        SHA256

        74249727c5d760e91b9277be58b45a03fd89a587cc19e0b42503b50db2e00356

        SHA512

        a7edf48519bbdf46aee1c5f60e419b4e604d04e3066aa3501e5fe3e81396fc443a4cafe35bdd06770a59e2009d0405dd4c97d8c121cd1bc30987270ad119b8b1

      • C:\Users\Admin\AppData\Local\Temp\decoy.doc

        Filesize

        191B

        MD5

        5d65bac473774c66544cc2f4062c9b78

        SHA1

        b2b606f85dd95ff2ab5bcca43966a9c4cbb372b2

        SHA256

        7697184623cf1ffe94e69db38ca0821d3ff2df5826af38a9f7e244f3a725b042

        SHA512

        853ad5701b858fd350bbf2171955d84d551260f883ccc25eb403f4b2606b6694d34c62ade98db0761da8ac3cb3250e98e19e54c3ab7c927782a3a0ed10924cd2

      • C:\Users\Admin\AppData\Local\Temp\inteldriverupd1.sct

        Filesize

        432B

        MD5

        8decdcaeb92d9f628b6bf95de4c0597a

        SHA1

        19443ad64921ef01a77619350efcc97cd767a36b

        SHA256

        e4f6b9def338fe9aca9e8796e79c58c5e42168e697c41bfe149946513765036e

        SHA512

        d67fee80c9f4884331e476f53de7516d21e926cf2f00094bf310ccd6e875164740b31749ec1ea43c1015037590b9bfebe2bde0065d75e42343bfbd0c46bccf59

      • C:\Users\Admin\AppData\Local\Temp\task.bat

        Filesize

        153B

        MD5

        89896bf3dc684cb01d6c9bd8f2df3694

        SHA1

        cd34ddbfe29c70d100f506addf4a6f831079dc01

        SHA256

        429934a64c0d46c46c09c3ccdac2db6801f96e28d072d3dd72ac01c5f023460b

        SHA512

        0f5371dee4db471524b3d6abf8fa673555b9dc92d596e7f3d73d13f810e899d19741cfebd46b09dfde60b0aee9288e2fac3bb8ec5cba3190dabd3bd87a0a29d1

      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3434294380-2554721341-1919518612-1000\0f5007522459c86e95ffcc62f32308f1_d9071d2c-e5ad-4187-a976-30114bb93bf6

        Filesize

        46B

        MD5

        d898504a722bff1524134c6ab6a5eaa5

        SHA1

        e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

        SHA256

        878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

        SHA512

        26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

      • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3434294380-2554721341-1919518612-1000\0f5007522459c86e95ffcc62f32308f1_d9071d2c-e5ad-4187-a976-30114bb93bf6

        Filesize

        46B

        MD5

        c07225d4e7d01d31042965f048728a0a

        SHA1

        69d70b340fd9f44c89adb9a2278df84faa9906b7

        SHA256

        8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

        SHA512

        23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

      • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

        Filesize

        19KB

        MD5

        90612e0651e68b269fe6606d85f5ce58

        SHA1

        2d6a9a4ba4acfd71bc1dad175aa202e5a7b33090

        SHA256

        e6455b6a16939015740dc5574cbc329c23b740de021ad52460eca8b558c42747

        SHA512

        19af7d6cdb764143a20e09c2f2b7827249ffba7acdb765c793c7541e9025cd50d8380e9d92ace10d7e98598d22bd26e7da9a82497be2ea7e5aa2a08bd9d776e9

      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.cch

        Filesize

        392B

        MD5

        f2919796198e267a150ed86173156733

        SHA1

        5a5a5fb489bbb1c95d01b3f6aef234d9ca520be4

        SHA256

        af54491527986b27210c92e5e62cd0aa0605c49593b0d273a04af077af7aab17

        SHA512

        cc0b410b1b37ff41e2ad06b88cf12af424d022a8de5ceb267b3648f7a7bcd3e82314675652c0373181634a1003727e681f87c3e7d3ba253ef74fd4d35479804a

      • \Users\Admin\AppData\Local\Temp\exe.exe

        Filesize

        386KB

        MD5

        dd67ccac47f6b10075de9c0a9be7a154

        SHA1

        42551b5c1abfc9c1b653c9fd36f93cf12541f4c5

        SHA256

        d611d8d6f8e5e8d0f7af9aa1bf58b041139670de1b61253fa461cc84d4fa58f6

        SHA512

        add5d6b23fe7854cfda276f28b4c915176545ddbe8007581860858844262f4efaa361425c775b9b36876731ea19f751326b3ea8c7fdb4e374e7645576f50cf4e

      • memory/1840-58-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

      • memory/1840-147-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

      • memory/2032-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

        Filesize

        64KB

      • memory/2032-0-0x000000002FD21000-0x000000002FD22000-memory.dmp

        Filesize

        4KB

      • memory/2032-38-0x00000000711AD000-0x00000000711B8000-memory.dmp

        Filesize

        44KB

      • memory/2032-2-0x00000000711AD000-0x00000000711B8000-memory.dmp

        Filesize

        44KB

      • memory/2072-70-0x0000000000400000-0x00000000004A2000-memory.dmp

        Filesize

        648KB

      • memory/2072-72-0x0000000000400000-0x00000000004A2000-memory.dmp

        Filesize

        648KB