Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29-04-2024 05:04
Behavioral task
behavioral1
Sample
06e0998e9c8ae7ba03cf2c5e10c3a2c9_JaffaCakes118.doc
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
06e0998e9c8ae7ba03cf2c5e10c3a2c9_JaffaCakes118.doc
Resource
win10v2004-20240419-en
General
-
Target
06e0998e9c8ae7ba03cf2c5e10c3a2c9_JaffaCakes118.doc
-
Size
115KB
-
MD5
06e0998e9c8ae7ba03cf2c5e10c3a2c9
-
SHA1
e144ed0a39d7b2f71fd1f29a3e2a6cd97a6db4a3
-
SHA256
31a8593b18120bcd4f5060bbece6be1396e158ba439b8315a22774dda3e98413
-
SHA512
cf9bface8227dca4432f6f33ec4249186095ff7def63f5dd15c7690695d9d0c9feefcaac3a8fc394f8c9ba2f7c1dd4e21866e1a5a3eb2dfcecd49481a1ee2375
-
SSDEEP
1536:mAG1udvDu3xv+pekyzdJNWiKuBGjsJIGgVawLkRyvj:HGwd8GCWSIGQawLi
Malware Config
Extracted
metasploit
windows/download_exec
http://192.168.0.30:80/nQCZ
- headers User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 1036 1580 rundll32.exe WINWORD.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 1580 WINWORD.EXE 1580 WINWORD.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
WINWORD.EXEpid process 1580 WINWORD.EXE 1580 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 1580 WINWORD.EXE 1580 WINWORD.EXE 1580 WINWORD.EXE 1580 WINWORD.EXE 1580 WINWORD.EXE 1580 WINWORD.EXE 1580 WINWORD.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
WINWORD.EXEdescription pid process target process PID 1580 wrote to memory of 772 1580 WINWORD.EXE splwow64.exe PID 1580 wrote to memory of 772 1580 WINWORD.EXE splwow64.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe PID 1580 wrote to memory of 1036 1580 WINWORD.EXE rundll32.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\06e0998e9c8ae7ba03cf2c5e10c3a2c9_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:772
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe2⤵
- Process spawned unexpected child process
PID:1036
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\D5905111.wmfFilesize
528B
MD5f84d8312d9b020933152891e33d38052
SHA1b491dedfcf58566ec76591bd6c79bc62d552cd4c
SHA256892d73bfa7613ecf6967aa5cbb50db4bfee4177c2980753953aec2aebc7f8e80
SHA512afc82e28484e9c441408419c52fd550a1e2eb4658ab50f3a43be94b0a9ed7bd0235c3dea332edffb2b01401680320097cb08b19450951bf4e567ac27d3e12afd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\D71789CB.wmfFilesize
610B
MD551953777d5b75ab8465e961f1b42afe1
SHA1638bbb3b793c65cb90b689dc9a103d1b06b727a9
SHA256a34848b974be1698ffbff62a8e14cbd14498bd2e7e74960a8c7958832985dd2a
SHA512303c93eca1c714c1bd69d65465fd046767785e0bfd8da7d4723a68adb2ad34cafc429cb21b12012c65e03d224988f5d50fd825313da82a5a11a929b82323c328
-
memory/1036-41-0x00000000009D0000-0x00000000009D1000-memory.dmpFilesize
4KB
-
memory/1580-8-0x00007FFC39350000-0x00007FFC39545000-memory.dmpFilesize
2.0MB
-
memory/1580-18-0x00007FFC39350000-0x00007FFC39545000-memory.dmpFilesize
2.0MB
-
memory/1580-7-0x00007FFC39350000-0x00007FFC39545000-memory.dmpFilesize
2.0MB
-
memory/1580-6-0x00007FFC39350000-0x00007FFC39545000-memory.dmpFilesize
2.0MB
-
memory/1580-2-0x00007FFBF93D0000-0x00007FFBF93E0000-memory.dmpFilesize
64KB
-
memory/1580-5-0x00007FFC39350000-0x00007FFC39545000-memory.dmpFilesize
2.0MB
-
memory/1580-11-0x00007FFBF6EC0000-0x00007FFBF6ED0000-memory.dmpFilesize
64KB
-
memory/1580-10-0x00007FFC39350000-0x00007FFC39545000-memory.dmpFilesize
2.0MB
-
memory/1580-12-0x00007FFC39350000-0x00007FFC39545000-memory.dmpFilesize
2.0MB
-
memory/1580-13-0x00007FFC39350000-0x00007FFC39545000-memory.dmpFilesize
2.0MB
-
memory/1580-14-0x00007FFC39350000-0x00007FFC39545000-memory.dmpFilesize
2.0MB
-
memory/1580-16-0x00007FFBF6EC0000-0x00007FFBF6ED0000-memory.dmpFilesize
64KB
-
memory/1580-15-0x00007FFC39350000-0x00007FFC39545000-memory.dmpFilesize
2.0MB
-
memory/1580-4-0x00007FFBF93D0000-0x00007FFBF93E0000-memory.dmpFilesize
64KB
-
memory/1580-17-0x00007FFC39350000-0x00007FFC39545000-memory.dmpFilesize
2.0MB
-
memory/1580-9-0x00007FFC39350000-0x00007FFC39545000-memory.dmpFilesize
2.0MB
-
memory/1580-3-0x00007FFBF93D0000-0x00007FFBF93E0000-memory.dmpFilesize
64KB
-
memory/1580-1-0x00007FFBF93D0000-0x00007FFBF93E0000-memory.dmpFilesize
64KB
-
memory/1580-0-0x00007FFBF93D0000-0x00007FFBF93E0000-memory.dmpFilesize
64KB
-
memory/1580-54-0x00007FFC39350000-0x00007FFC39545000-memory.dmpFilesize
2.0MB
-
memory/1580-82-0x00007FFBF93D0000-0x00007FFBF93E0000-memory.dmpFilesize
64KB
-
memory/1580-83-0x00007FFBF93D0000-0x00007FFBF93E0000-memory.dmpFilesize
64KB
-
memory/1580-81-0x00007FFBF93D0000-0x00007FFBF93E0000-memory.dmpFilesize
64KB
-
memory/1580-84-0x00007FFBF93D0000-0x00007FFBF93E0000-memory.dmpFilesize
64KB
-
memory/1580-85-0x00007FFC39350000-0x00007FFC39545000-memory.dmpFilesize
2.0MB