97d7e0aeaaac6a9039856b177812c2efc63502d824e6cf4bc5e135ead6428dbd

General

Target

1fc7f0392626c7d8700ae378804592a2_JaffaCakes118.docm
Size

123KB
MD5

1fc7f0392626c7d8700ae378804592a2
SHA1

bf7123bad4739ce7452a6a6a504e6971cb7b2483
SHA256

97d7e0aeaaac6a9039856b177812c2efc63502d824e6cf4bc5e135ead6428dbd
SHA512

2512aa9e597ccefd0b92c851214d45d4585aa4a692a53ce4c32efd68d59540fb2d3ea604b3a3e74b34ed4ff557ecaa903710dd2dcaf7c66fad1ae50aaf8ed98c
SSDEEP

3072:94r36UhasBY+M34Irf8Ug3n3iuJo7LSfKL3JfH:imya+KIOf8suCGfiJP

Score

10^/10

execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	3276	3676	WScript.exe	82

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3676	WINWORD.EXE
3676	WINWORD.EXE

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3676	WINWORD.EXE
3676	WINWORD.EXE
3676	WINWORD.EXE
3676	WINWORD.EXE
3676	WINWORD.EXE
3676	WINWORD.EXE
3676	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 3276	3676	WINWORD.EXE	87
PID 3676 wrote to memory of 3276	3676	WINWORD.EXE	87

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1fc7f0392626c7d8700ae378804592a2_JaffaCakes118.docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\0.7055475.jse"
  2⤵
  - Process spawned unexpected child process
  PID:3276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TCD6C8D.tmp\gb.xsl

Filesize
262KB

MD5
51d32ee5bc7ab811041f799652d26e04

SHA1
412193006aa3ef19e0a57e16acf86b830993024a

SHA256
6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

SHA512
5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

Download Submit
C:\Users\Admin\AppData\Roaming\0.7055475.jse

Filesize
29KB

MD5
428bb5eb41277bf98dca217eb4fdcf6a

SHA1
d74c30a2be4279392f9f16b6ee5e2335372e3742

SHA256
ca3ffca140fbc0ad5a01150f8e84e48aa07cd1547146bd987a3672c394f701ec

SHA512
c7f373efd3b1dc6e82c19a7a70abb9d7da089f7f7c8d07d311b3d571f64b565cdac2dabd95c8c207519344db9e90bb770f7bac1cdf375eeaafe059385c3167ae

Download Submit
memory/3676-9-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp

Filesize
2.0MB

Download
memory/3676-596-0x00007FFE41DD0000-0x00007FFE41DE0000-memory.dmp

Filesize
64KB

Download
memory/3676-4-0x00007FFE81DED000-0x00007FFE81DEE000-memory.dmp

Filesize
4KB

Download
memory/3676-5-0x00007FFE41DD0000-0x00007FFE41DE0000-memory.dmp

Filesize
64KB

Download
memory/3676-11-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp

Filesize
2.0MB

Download
memory/3676-0-0x00007FFE41DD0000-0x00007FFE41DE0000-memory.dmp

Filesize
64KB

Download
memory/3676-8-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp

Filesize
2.0MB

Download
memory/3676-7-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp

Filesize
2.0MB

Download
memory/3676-6-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp

Filesize
2.0MB

Download
memory/3676-15-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp

Filesize
2.0MB

Download
memory/3676-14-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp

Filesize
2.0MB

Download
memory/3676-16-0x00007FFE3F990000-0x00007FFE3F9A0000-memory.dmp

Filesize
64KB

Download
memory/3676-2-0x00007FFE41DD0000-0x00007FFE41DE0000-memory.dmp

Filesize
64KB

Download
memory/3676-13-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp

Filesize
2.0MB

Download
memory/3676-10-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp

Filesize
2.0MB

Download
memory/3676-17-0x00007FFE3F990000-0x00007FFE3F9A0000-memory.dmp

Filesize
64KB

Download
memory/3676-35-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp

Filesize
2.0MB

Download
memory/3676-66-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp

Filesize
2.0MB

Download
memory/3676-3-0x00007FFE41DD0000-0x00007FFE41DE0000-memory.dmp

Filesize
64KB

Download
memory/3676-1-0x00007FFE41DD0000-0x00007FFE41DE0000-memory.dmp

Filesize
64KB

Download
memory/3676-568-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp

Filesize
2.0MB

Download
memory/3676-569-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp

Filesize
2.0MB

Download
memory/3676-570-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp

Filesize
2.0MB

Download
memory/3676-12-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp

Filesize
2.0MB

Download
memory/3676-597-0x00007FFE41DD0000-0x00007FFE41DE0000-memory.dmp

Filesize
64KB

Download
memory/3676-599-0x00007FFE41DD0000-0x00007FFE41DE0000-memory.dmp

Filesize
64KB

Download
memory/3676-598-0x00007FFE41DD0000-0x00007FFE41DE0000-memory.dmp

Filesize
64KB

Download
memory/3676-600-0x00007FFE81D50000-0x00007FFE81F45000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads