Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/09/2024, 10:57

General

  • Target

    00f623bfb36a253403669fc4dec5f791_JaffaCakes118.xls

  • Size

    98KB

  • MD5

    00f623bfb36a253403669fc4dec5f791

  • SHA1

    67fd817afb56cf19571f688ebf76143cdded1c3d

  • SHA256

    b94df8bbdd72e9b935b14dd2de7746179ecf2864fd3f6ba8c51888e55d41cece

  • SHA512

    5b505acbca9594a5b6f01cce77a4b004faeddc679c7c9712894bd74232f6a5351c3ebe2e0f89011e5bf1728d28b819f6c3922850b24bc2d0e0a7fa1a8ba779c7

  • SSDEEP

    1536:sxxxxENLxrgxFtVwM8jIT+M0mTsbaP6hjSszg/jAyOWVbrzQ7ITkbA2syfshtcJt:eVaWVbrzQ7ITkZXimJtXw1d

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Deletes itself 1 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\00f623bfb36a253403669fc4dec5f791_JaffaCakes118.xls"
    1⤵
    • Deletes itself
    • Checks processor information in registry
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1180
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1824
      • C:\Windows\system32\attrib.exe
        attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
        3⤵
        • Views/modifies file attributes
        PID:2744
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c Del /F /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
      2⤵
      • Process spawned unexpected child process
      PID:1260
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c RD /S /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"
      2⤵
      • Process spawned unexpected child process
      PID:5024

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\00f623bfb36a253403669fc4dec5f791_JaffaCakes118.xls

    Filesize

    127KB

    MD5

    ccb077e224d5a157833b974f9702b44e

    SHA1

    d020a379e61539df140f03964dedbaf64886848b

    SHA256

    2416fb4b7d11a138bfe48ccca9881bf71e458474d4e1d7057514a1123edf4703

    SHA512

    83dd669c7fc88ac4257b15ef7d7efbb2540a16935d75fcbc606237d14b4649f839e1883384d16bc94e2788b7c3949ea61992ba1c60859171a3adc6be59920ae8

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    3KB

    MD5

    d6a1558bc94027219013204367e71b8d

    SHA1

    864d4766683d3fcaf4a4d52ae18e3b9421cd3a39

    SHA256

    8b3fcffdc5a84cf4336ac0701903dc8e0337f74bb598de31f978edd2102278e8

    SHA512

    536b09df92d217d79d979aed057b31ed7ceec8141a18ac858c28d9ad44058a633cb9355d33e1f028e9d283eaf975fb6575be7dd7b57014b82ea4d13f9c11edbf

  • memory/1180-57-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-14-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-4-0x00007FF7DA890000-0x00007FF7DA8A0000-memory.dmp

    Filesize

    64KB

  • memory/1180-6-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-7-0x00007FF7DA890000-0x00007FF7DA8A0000-memory.dmp

    Filesize

    64KB

  • memory/1180-5-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-10-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-11-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-9-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-13-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-12-0x00007FF7D83F0000-0x00007FF7D8400000-memory.dmp

    Filesize

    64KB

  • memory/1180-15-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-16-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-17-0x00007FF7D83F0000-0x00007FF7D8400000-memory.dmp

    Filesize

    64KB

  • memory/1180-19-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-18-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-49-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-8-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-2-0x00007FF7DA890000-0x00007FF7DA8A0000-memory.dmp

    Filesize

    64KB

  • memory/1180-1-0x00007FF81A8AD000-0x00007FF81A8AE000-memory.dmp

    Filesize

    4KB

  • memory/1180-58-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-46-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-59-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-48-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-60-0x00007FF81A8AD000-0x00007FF81A8AE000-memory.dmp

    Filesize

    4KB

  • memory/1180-61-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-73-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-76-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-78-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-77-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-75-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-74-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-79-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-3-0x00007FF7DA890000-0x00007FF7DA8A0000-memory.dmp

    Filesize

    64KB

  • memory/1180-117-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-121-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-122-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-123-0x00007FF81A810000-0x00007FF81AA05000-memory.dmp

    Filesize

    2.0MB

  • memory/1180-0-0x00007FF7DA890000-0x00007FF7DA8A0000-memory.dmp

    Filesize

    64KB