Analysis

  • max time kernel
    122s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    17-04-2024 09:36

General

  • Target

    f57aa3bbe3fae170bdda042d979ed6a4_JaffaCakes118.doc

  • Size

    37KB

  • MD5

    f57aa3bbe3fae170bdda042d979ed6a4

  • SHA1

    ccefd52e896ea971d6dcf13e21eb7248e80db908

  • SHA256

    b9656022ed7793ea88b296d9cfc76922a75f962deec9e9edc627b4b108f8bc85

  • SHA512

    032ae1a8fc9522b56f4f5310b62940a028cc620dc19539c25d4d1342b82069c803c965dc4d4afe5b4b7c6d6cc3e9384167044d28be8b8e4e8b60f2cbed6f58d3

  • SSDEEP

    192:45KwpT858VR85SbWFwCLfyEzMv7v8xkqPG3Z869J36uxyb6Hqv5RZwQjv7bwpz:g8d7yEz0j8Fwt6uUkqv5AQjv

Malware Config

Signatures

  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

  • Deletes itself 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f57aa3bbe3fae170bdda042d979ed6a4_JaffaCakes118.doc"
    1⤵
    • Deletes itself
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1184
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2420

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\f57aa3bbe3fae170bdda042d979ed6a4_JaffaCakes118.doc
      Filesize

      48KB

      MD5

      e12edf4528a5353a81303a7fbe8407ea

      SHA1

      2d095168527b2d97b243e1ddea08d217389efc19

      SHA256

      ea8ac1524cb8f6f9bcf22f7d8d8d0328cef1c12bf946951d2cc0d534c23afa8e

      SHA512

      7e8dca172bc03296200c1608efb64a83aafa161a663462850b6df12068476133238f62d21b8b8cb51f0fd1474b53fd55353228d810e5b213d885d4bd355daa5a

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      24KB

      MD5

      5d9acd7c1ba55fbc8c777189e2adaa6d

      SHA1

      cf534acdda4b7f0d3368a1d93c5383671bce5258

      SHA256

      93f7727790c65b41aca70c3e7c1180cf8f54b826aa05b6ea205f5472e20ac93a

      SHA512

      24a69bb275cb93ec3c02ac8cc06baa2fa2f328fd6b893a8c0dc00e90e1714da673b66e9cef17c48a366826edc75fa82f2ead2843037fd4db787a776eaac30f48

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm
      Filesize

      25KB

      MD5

      474e75c3b8f98ca81dd48b942f5a6f97

      SHA1

      4ea1f093acea681fee919e05e84b93f742f90879

      SHA256

      90dcc2ce974597e5e89c8bb7d9f76580bf8fe1a73d6d70652463927c43e52dd6

      SHA512

      c58d03cc2fbd3780dd11c8db2158d6c7b36405118caf0965e5d13b1b8d6fa43148b1b12e9736850272fc467a70701c49d49f5b8bd27737b368fadb973315dc0a

    • memory/1184-0-0x000000002FD31000-0x000000002FD32000-memory.dmp
      Filesize

      4KB

    • memory/1184-1-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1184-2-0x00000000719FD000-0x0000000071A08000-memory.dmp
      Filesize

      44KB

    • memory/1184-6-0x0000000000760000-0x0000000000860000-memory.dmp
      Filesize

      1024KB

    • memory/1184-7-0x0000000000760000-0x0000000000860000-memory.dmp
      Filesize

      1024KB

    • memory/1184-8-0x0000000000760000-0x0000000000860000-memory.dmp
      Filesize

      1024KB

    • memory/1184-30-0x00000000719FD000-0x0000000071A08000-memory.dmp
      Filesize

      44KB

    • memory/1184-31-0x0000000000760000-0x0000000000860000-memory.dmp
      Filesize

      1024KB

    • memory/1184-68-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB