Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28/03/2024, 17:16

General

  • Target

    0b70546b28da5c1ad2bc4a52a6b0c283_JaffaCakes118.docm

  • Size

    19KB

  • MD5

    0b70546b28da5c1ad2bc4a52a6b0c283

  • SHA1

    3b2117fb8c4ae60ee931dca1d15dce002abd7f36

  • SHA256

    a4f30ee61af69027b7dd73603b8c37cac142a1e2a509ded8934450c3e0d3fe30

  • SHA512

    6296c37d49ffb913241db3c290d51dd0975abb680cfdf64d85289af1adb60bffb9f0a20a867b81bb1a74b9290e5961af3cea89aa8b11b9064673f3e4fe5f0981

  • SSDEEP

    384:/iB9hGhdtPWrhIJKPRMHnJzcFAY/cAT2G+XqRn5OOd4:/8w3+rhuHnJzA4GOqRn5q

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0b70546b28da5c1ad2bc4a52a6b0c283_JaffaCakes118.docm"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1288
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2052

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

            Filesize

            20KB

            MD5

            ea4882b1decba22d355c88081e9960ed

            SHA1

            942638e4d865474fa201685f557d2398e71471db

            SHA256

            da9d769160ba0b4b9e2701738ecb7342365ea62f039b187ee1ec2bdb1f90c294

            SHA512

            324d294f97bc07d2021f8ac3ca9fdd5f6b77c65924522473c9af3e4978ef672f3d37c31c1d94e52c8527ec0b98d27b2b75b7db449fe9d0aa969bf160f8f48e7c

          • memory/1288-19-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-23-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-5-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-6-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-7-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-8-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-9-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-10-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-21-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-13-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-11-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-14-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-15-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-16-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-2-0x0000000070BCD000-0x0000000070BD8000-memory.dmp

            Filesize

            44KB

          • memory/1288-17-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-12-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-0-0x000000002F861000-0x000000002F862000-memory.dmp

            Filesize

            4KB

          • memory/1288-22-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-18-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-25-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-27-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-26-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-30-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-31-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-28-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-29-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-24-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-40-0x0000000070BCD000-0x0000000070BD8000-memory.dmp

            Filesize

            44KB

          • memory/1288-41-0x0000000000650000-0x0000000000750000-memory.dmp

            Filesize

            1024KB

          • memory/1288-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB

          • memory/1288-59-0x000000005FFF0000-0x0000000060000000-memory.dmp

            Filesize

            64KB