Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
17/04/2024, 09:36
General
-
Target
f57aa3bbe3fae170bdda042d979ed6a4_JaffaCakes118.doc
-
Size
37KB
-
MD5
f57aa3bbe3fae170bdda042d979ed6a4
-
SHA1
ccefd52e896ea971d6dcf13e21eb7248e80db908
-
SHA256
b9656022ed7793ea88b296d9cfc76922a75f962deec9e9edc627b4b108f8bc85
-
SHA512
032ae1a8fc9522b56f4f5310b62940a028cc620dc19539c25d4d1342b82069c803c965dc4d4afe5b4b7c6d6cc3e9384167044d28be8b8e4e8b60f2cbed6f58d3
-
SSDEEP
192:45KwpT858VR85SbWFwCLfyEzMv7v8xkqPG3Z869J36uxyb6Hqv5RZwQjv7bwpz:g8d7yEz0j8Fwt6uUkqv5AQjv
Malware Config
Signatures
-
Office macro that triggers on suspicious action 1 IoCs
Office document macro which triggers in special circumstances - often malicious.
-
Deletes itself 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f57aa3bbe3fae170bdda042d979ed6a4_JaffaCakes118.doc" /o ""1⤵
- Deletes itself
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
51KB
MD5c85b142a63c7f5c51f699889e4f648dd
SHA1774ad9dec8b7571227528de9025a3607de93257b
SHA2564b54bb6be2e4c80d25a427a0c2e563c6246bd56fe816f6d31304945462c0d400
SHA512da52ffd6b8b4ae21a8fd903d8f4e68cfb99888c8e1a1634de9f8c710ebafc43d7f2f905c43564cbe118261c264b25ef24dcc62b48b2f0b1ef6dbeadc5e6abc0c
-
Filesize
23KB
MD57329162f837851f7ebaec84c39fa7977
SHA15f60fdc6013f60acb804cc864072fd2cd0e9cc15
SHA256347cd7e21b73ddae6d3eaca9e3b9ef2cfec8a12fc6acda251a2c4d6cec164fe0
SHA51237962fe405a4e39b06ed53800d8db7fa5712d32c4d1d32d4ef3c848b4bc1b3abd526ce7f2ff9979f9c6011b5c38c4fe46c5f4ae2b186a1cf3a24f8bcc585da09
-
Filesize
2.0MB
-
Filesize
8.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
8.0MB
-
Filesize
15.8MB
-
Filesize
15.8MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB