Analysis
- max time kernel
144s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
04/05/2024, 16:04
General
- Target 1377d4a962058e8f1c4877448753e508_JaffaCakes118.docm
- Size 90KB
- Sample240504-th9jwsde96
- SHA256 6b9a2784bcfe19f9c4db8c385b2996fc3eee683cdecc17899d16385a89adb3da
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1377d4a962058e8f1c4877448753e508_JaffaCakes118.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\0.5166437.jse"2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
gb.xsl
0.5166437.jse
memory/3764-17-0x00007FFA88530000-0x00007FFA88725000-memory.dmp
memory/3764-16-0x00007FFA88530000-0x00007FFA88725000-memory.dmp
memory/3764-3-0x00007FFA485B0000-0x00007FFA485C0000-memory.dmp
memory/3764-6-0x00007FFA88530000-0x00007FFA88725000-memory.dmp
memory/3764-5-0x00007FFA485B0000-0x00007FFA485C0000-memory.dmp
memory/3764-7-0x00007FFA88530000-0x00007FFA88725000-memory.dmp
memory/3764-8-0x00007FFA88530000-0x00007FFA88725000-memory.dmp
memory/3764-9-0x00007FFA88530000-0x00007FFA88725000-memory.dmp
memory/3764-10-0x00007FFA88530000-0x00007FFA88725000-memory.dmp
memory/3764-12-0x00007FFA45EB0000-0x00007FFA45EC0000-memory.dmp
memory/3764-11-0x00007FFA88530000-0x00007FFA88725000-memory.dmp
memory/3764-13-0x00007FFA88530000-0x00007FFA88725000-memory.dmp
memory/3764-14-0x00007FFA88530000-0x00007FFA88725000-memory.dmp
memory/3764-15-0x00007FFA45EB0000-0x00007FFA45EC0000-memory.dmp
memory/3764-19-0x00007FFA88530000-0x00007FFA88725000-memory.dmp
memory/3764-18-0x00007FFA88530000-0x00007FFA88725000-memory.dmp
memory/3764-4-0x00007FFA885CD000-0x00007FFA885CE000-memory.dmp
memory/3764-1-0x00007FFA485B0000-0x00007FFA485C0000-memory.dmp
memory/3764-29-0x00007FFA88530000-0x00007FFA88725000-memory.dmp
memory/3764-30-0x00007FFA88530000-0x00007FFA88725000-memory.dmp
memory/3764-56-0x00007FFA88530000-0x00007FFA88725000-memory.dmp
memory/3764-2-0x00007FFA485B0000-0x00007FFA485C0000-memory.dmp
memory/3764-0-0x00007FFA485B0000-0x00007FFA485C0000-memory.dmp
memory/3764-567-0x00007FFA88530000-0x00007FFA88725000-memory.dmp
memory/3764-566-0x00007FFA88530000-0x00007FFA88725000-memory.dmp
memory/3764-565-0x00007FFA88530000-0x00007FFA88725000-memory.dmp
memory/3764-568-0x00007FFA88530000-0x00007FFA88725000-memory.dmp
memory/3764-569-0x00007FFA88530000-0x00007FFA88725000-memory.dmp
memory/3764-570-0x00007FFA88530000-0x00007FFA88725000-memory.dmp
memory/3764-571-0x00007FFA88530000-0x00007FFA88725000-memory.dmp
memory/3764-597-0x00007FFA485B0000-0x00007FFA485C0000-memory.dmp
memory/3764-598-0x00007FFA485B0000-0x00007FFA485C0000-memory.dmp
memory/3764-600-0x00007FFA485B0000-0x00007FFA485C0000-memory.dmp
memory/3764-599-0x00007FFA485B0000-0x00007FFA485C0000-memory.dmp
memory/3764-601-0x00007FFA88530000-0x00007FFA88725000-memory.dmp