Analysis

  • max time kernel
    101s
  • max time network
    135s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/03/2024, 17:16

General

  • Target

    0b70546b28da5c1ad2bc4a52a6b0c283_JaffaCakes118.docm

  • Size

    19KB

  • MD5

    0b70546b28da5c1ad2bc4a52a6b0c283

  • SHA1

    3b2117fb8c4ae60ee931dca1d15dce002abd7f36

  • SHA256

    a4f30ee61af69027b7dd73603b8c37cac142a1e2a509ded8934450c3e0d3fe30

  • SHA512

    6296c37d49ffb913241db3c290d51dd0975abb680cfdf64d85289af1adb60bffb9f0a20a867b81bb1a74b9290e5961af3cea89aa8b11b9064673f3e4fe5f0981

  • SSDEEP

    384:/iB9hGhdtPWrhIJKPRMHnJzcFAY/cAT2G+XqRn5OOd4:/8w3+rhuHnJzA4GOqRn5q

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0b70546b28da5c1ad2bc4a52a6b0c283_JaffaCakes118.docm" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4652
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
    1⤵
      PID:1568

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4652-0-0x00007FFFB5E50000-0x00007FFFB5E60000-memory.dmp

            Filesize

            64KB

          • memory/4652-3-0x00007FFFB5E50000-0x00007FFFB5E60000-memory.dmp

            Filesize

            64KB

          • memory/4652-2-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

            Filesize

            2.0MB

          • memory/4652-1-0x00007FFFB5E50000-0x00007FFFB5E60000-memory.dmp

            Filesize

            64KB

          • memory/4652-4-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

            Filesize

            2.0MB

          • memory/4652-5-0x00007FFFB5E50000-0x00007FFFB5E60000-memory.dmp

            Filesize

            64KB

          • memory/4652-6-0x00007FFFB5E50000-0x00007FFFB5E60000-memory.dmp

            Filesize

            64KB

          • memory/4652-7-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

            Filesize

            2.0MB

          • memory/4652-8-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

            Filesize

            2.0MB

          • memory/4652-9-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

            Filesize

            2.0MB

          • memory/4652-10-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

            Filesize

            2.0MB

          • memory/4652-12-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

            Filesize

            2.0MB

          • memory/4652-11-0x00007FFFB3C80000-0x00007FFFB3C90000-memory.dmp

            Filesize

            64KB

          • memory/4652-13-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

            Filesize

            2.0MB

          • memory/4652-15-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

            Filesize

            2.0MB

          • memory/4652-14-0x00007FFFB3C80000-0x00007FFFB3C90000-memory.dmp

            Filesize

            64KB

          • memory/4652-16-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

            Filesize

            2.0MB

          • memory/4652-17-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

            Filesize

            2.0MB

          • memory/4652-18-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

            Filesize

            2.0MB

          • memory/4652-19-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

            Filesize

            2.0MB

          • memory/4652-20-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

            Filesize

            2.0MB

          • memory/4652-21-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

            Filesize

            2.0MB

          • memory/4652-23-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

            Filesize

            2.0MB

          • memory/4652-26-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

            Filesize

            2.0MB

          • memory/4652-29-0x000001B56CFD0000-0x000001B56DFA0000-memory.dmp

            Filesize

            15.8MB

          • memory/4652-30-0x000001B56CFD0000-0x000001B56DFA0000-memory.dmp

            Filesize

            15.8MB

          • memory/4652-42-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

            Filesize

            2.0MB

          • memory/4652-43-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

            Filesize

            2.0MB

          • memory/4652-44-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

            Filesize

            2.0MB

          • memory/4652-45-0x000001B56CFD0000-0x000001B56DFA0000-memory.dmp

            Filesize

            15.8MB

          • memory/4652-46-0x000001B56CFD0000-0x000001B56DFA0000-memory.dmp

            Filesize

            15.8MB

          • memory/4652-67-0x00007FFFB5E50000-0x00007FFFB5E60000-memory.dmp

            Filesize

            64KB

          • memory/4652-68-0x00007FFFB5E50000-0x00007FFFB5E60000-memory.dmp

            Filesize

            64KB

          • memory/4652-69-0x00007FFFB5E50000-0x00007FFFB5E60000-memory.dmp

            Filesize

            64KB

          • memory/4652-70-0x00007FFFB5E50000-0x00007FFFB5E60000-memory.dmp

            Filesize

            64KB

          • memory/4652-71-0x00007FFFF5DD0000-0x00007FFFF5FC5000-memory.dmp

            Filesize

            2.0MB