fb0c667d6466a10c63e6698f7833a5e95cbef31bbe9dc8971260cf4eed615ddc

General

Target

08498f4c78d546d0d305d2703f5935bb_JaffaCakes118.docm
Size

90KB
MD5

08498f4c78d546d0d305d2703f5935bb
SHA1

d4477789ad45ca89b7844111a719ec3d7f44f490
SHA256

fb0c667d6466a10c63e6698f7833a5e95cbef31bbe9dc8971260cf4eed615ddc
SHA512

dc2f7dd5ce38a0c711cc586c100691fc97591caefa328ec1f22bf90f33f7d6ca1424cfa2b7dbb23e549bd702f8d3f2e8b42237f5d01fb671da0614ffec43d1f6
SSDEEP

1536:BF4+CArnZrVr7G6ez5Gc4IbxpIe8k+ong3n37wPwGuyUZXTN30srE:BfnmR4Irf8Ug3n3iuJxxkeE

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	4932	3996	WScript.exe	80

Blocklisted process makes network request 3 IoCs

flow	pid	Process
10	4932	WScript.exe
15	4932	WScript.exe
17	4932	WScript.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3996	WINWORD.EXE
3996	WINWORD.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3996	WINWORD.EXE
3996	WINWORD.EXE
3996	WINWORD.EXE
3996	WINWORD.EXE
3996	WINWORD.EXE
3996	WINWORD.EXE
3996	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 4932	3996	WINWORD.EXE	85
PID 3996 wrote to memory of 4932	3996	WINWORD.EXE	85

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\08498f4c78d546d0d305d2703f5935bb_JaffaCakes118.docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\0.6537897.jse"
  2⤵
  - Process spawned unexpected child process
  - Blocklisted process makes network request
  PID:4932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
4KB

MD5
1bfe591a4fe3d91b03cdf26eaacd8f89

SHA1
719c37c320f518ac168c86723724891950911cea

SHA256
9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

SHA512
02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Filesize
338B

MD5
fbf8f8924fd9448f57b63ed769e517e3

SHA1
9466a1efd2ff95aaa2487db44d33f357484bb7f4

SHA256
0ce19f10c39c79a3186e6869e86993074c23f1c77284b69d12c408159747ba8f

SHA512
f39617362a62c0b5a9caefc2befe92b66b199aa98f08ac272f58f4cc0e80c1c0bdac1ea7bce367d91c570838e74f0ae7132de6e6779e88d54f0286e70659e41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCD864C.tmp\iso690.xsl

Filesize
263KB

MD5
ff0e07eff1333cdf9fc2523d323dd654

SHA1
77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

SHA256
3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

SHA512
b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

Download Submit
C:\Users\Admin\AppData\Roaming\0.6537897.jse

Filesize
23KB

MD5
87ae3dd6f689c329cdcd64a28ac3a3bd

SHA1
4d074126556450430508c6a742304984f04a205f

SHA256
f9ad0af6807b6e7977ec8d17def477c8ca2591958cf3098d5b801d7778bc3d05

SHA512
88c1eaf90df71911a6a77418876174d3c76b2498671a439c42038c54a86e13a87846b73b1c1c2b6b47f8ebd8240bc81a29be7890ff74511dc3eccc0433ca2e1a

Download Submit
memory/3996-30-0x0000023AA9F40000-0x0000023AAAF10000-memory.dmp

Filesize
15.8MB

Download
memory/3996-31-0x0000023AAC450000-0x0000023AAC650000-memory.dmp

Filesize
2.0MB

Download
memory/3996-6-0x00007FFC92910000-0x00007FFC92B05000-memory.dmp

Filesize
2.0MB

Download
memory/3996-8-0x00007FFC92910000-0x00007FFC92B05000-memory.dmp

Filesize
2.0MB

Download
memory/3996-7-0x00007FFC92910000-0x00007FFC92B05000-memory.dmp

Filesize
2.0MB

Download
memory/3996-13-0x00007FFC92910000-0x00007FFC92B05000-memory.dmp

Filesize
2.0MB

Download
memory/3996-12-0x00007FFC92910000-0x00007FFC92B05000-memory.dmp

Filesize
2.0MB

Download
memory/3996-11-0x00007FFC92910000-0x00007FFC92B05000-memory.dmp

Filesize
2.0MB

Download
memory/3996-10-0x00007FFC92910000-0x00007FFC92B05000-memory.dmp

Filesize
2.0MB

Download
memory/3996-9-0x00007FFC92910000-0x00007FFC92B05000-memory.dmp

Filesize
2.0MB

Download
memory/3996-16-0x00007FFC504B0000-0x00007FFC504C0000-memory.dmp

Filesize
64KB

Download
memory/3996-15-0x00007FFC92910000-0x00007FFC92B05000-memory.dmp

Filesize
2.0MB

Download
memory/3996-14-0x00007FFC92910000-0x00007FFC92B05000-memory.dmp

Filesize
2.0MB

Download
memory/3996-17-0x00007FFC504B0000-0x00007FFC504C0000-memory.dmp

Filesize
64KB

Download
memory/3996-0-0x00007FFC52990000-0x00007FFC529A0000-memory.dmp

Filesize
64KB

Download
memory/3996-5-0x00007FFC92910000-0x00007FFC92B05000-memory.dmp

Filesize
2.0MB

Download
memory/3996-68-0x0000023AA9F40000-0x0000023AAAF10000-memory.dmp

Filesize
15.8MB

Download
memory/3996-70-0x0000023AA9F40000-0x0000023AAAF10000-memory.dmp

Filesize
15.8MB

Download
memory/3996-4-0x00007FFC52990000-0x00007FFC529A0000-memory.dmp

Filesize
64KB

Download
memory/3996-1-0x00007FFC52990000-0x00007FFC529A0000-memory.dmp

Filesize
64KB

Download
memory/3996-3-0x00007FFC52990000-0x00007FFC529A0000-memory.dmp

Filesize
64KB

Download
memory/3996-87-0x00007FFC92910000-0x00007FFC92B05000-memory.dmp

Filesize
2.0MB

Download
memory/3996-88-0x0000023AA9F40000-0x0000023AAAF10000-memory.dmp

Filesize
15.8MB

Download
memory/3996-521-0x0000023AAC450000-0x0000023AAC650000-memory.dmp

Filesize
2.0MB

Download
memory/3996-2-0x00007FFC52990000-0x00007FFC529A0000-memory.dmp

Filesize
64KB

Download
memory/3996-567-0x0000023AA9F40000-0x0000023AAAF10000-memory.dmp

Filesize
15.8MB

Download
memory/3996-568-0x0000023AA9F40000-0x0000023AAAF10000-memory.dmp

Filesize
15.8MB

Download
memory/3996-592-0x00007FFC52990000-0x00007FFC529A0000-memory.dmp

Filesize
64KB

Download
memory/3996-593-0x00007FFC52990000-0x00007FFC529A0000-memory.dmp

Filesize
64KB

Download
memory/3996-595-0x00007FFC52990000-0x00007FFC529A0000-memory.dmp

Filesize
64KB

Download
memory/3996-594-0x00007FFC52990000-0x00007FFC529A0000-memory.dmp

Filesize
64KB

Download
memory/3996-596-0x00007FFC92910000-0x00007FFC92B05000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads