Analysis

  • max time kernel
    134s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-05-2024 06:49

General

  • Target

    1fc9b5094b733179f1033890c79b2e41_JaffaCakes118.rtf

  • Size

    475KB

  • MD5

    1fc9b5094b733179f1033890c79b2e41

  • SHA1

    3f42f46d0398ae70f3435707c849fa7b7b9c62d3

  • SHA256

    816c9d6d36399c0ef5bb8d0334ef40ba6668cd043be104a4ec3f4291ae1a4b86

  • SHA512

    851a4874baa6206fe82ba7ee43df0211810b4390d91b7c70a02673e0826b1a7131c7da9c9b98e56a227d23daeb860957a5304281040b1580332c07f1f4f4cc84

  • SSDEEP

    12288:477BeRhC1p1Cy4FkRIni8oNX9gjOxMygi2svV:ocy54FJi8IyygHu

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 5 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1fc9b5094b733179f1033890c79b2e41_JaffaCakes118.rtf" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:876

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\{8FF3C6E7-534E-4B35-9410-D1344191A826}\inteldriverupd1.sct:Zone.Identifier

    Filesize

    26B

    MD5

    fbccf14d504b7b2dbcb5a5bda75bd93b

    SHA1

    d59fc84cdd5217c6cf74785703655f78da6b582b

    SHA256

    eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

    SHA512

    aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

  • memory/876-10-0x00007FFEA5F10000-0x00007FFEA5F20000-memory.dmp

    Filesize

    64KB

  • memory/876-71-0x00007FFEE8630000-0x00007FFEE8825000-memory.dmp

    Filesize

    2.0MB

  • memory/876-9-0x00007FFEE8630000-0x00007FFEE8825000-memory.dmp

    Filesize

    2.0MB

  • memory/876-2-0x00007FFEA86B0000-0x00007FFEA86C0000-memory.dmp

    Filesize

    64KB

  • memory/876-5-0x00007FFEA86B0000-0x00007FFEA86C0000-memory.dmp

    Filesize

    64KB

  • memory/876-6-0x00007FFEE8630000-0x00007FFEE8825000-memory.dmp

    Filesize

    2.0MB

  • memory/876-8-0x00007FFEE8630000-0x00007FFEE8825000-memory.dmp

    Filesize

    2.0MB

  • memory/876-7-0x00007FFEE8630000-0x00007FFEE8825000-memory.dmp

    Filesize

    2.0MB

  • memory/876-0-0x00007FFEA86B0000-0x00007FFEA86C0000-memory.dmp

    Filesize

    64KB

  • memory/876-4-0x00007FFEA86B0000-0x00007FFEA86C0000-memory.dmp

    Filesize

    64KB

  • memory/876-3-0x00007FFEA86B0000-0x00007FFEA86C0000-memory.dmp

    Filesize

    64KB

  • memory/876-11-0x00007FFEA5F10000-0x00007FFEA5F20000-memory.dmp

    Filesize

    64KB

  • memory/876-37-0x00007FFEE8630000-0x00007FFEE8825000-memory.dmp

    Filesize

    2.0MB

  • memory/876-38-0x00007FFEE86CD000-0x00007FFEE86CE000-memory.dmp

    Filesize

    4KB

  • memory/876-70-0x00007FFEA86B0000-0x00007FFEA86C0000-memory.dmp

    Filesize

    64KB

  • memory/876-69-0x00007FFEA86B0000-0x00007FFEA86C0000-memory.dmp

    Filesize

    64KB

  • memory/876-68-0x00007FFEA86B0000-0x00007FFEA86C0000-memory.dmp

    Filesize

    64KB

  • memory/876-67-0x00007FFEA86B0000-0x00007FFEA86C0000-memory.dmp

    Filesize

    64KB

  • memory/876-1-0x00007FFEE86CD000-0x00007FFEE86CE000-memory.dmp

    Filesize

    4KB