Analysis
-
max time kernel
143s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 01:25
Static task
static1
Behavioral task
behavioral1
Sample
27a31bb63bd705c8f48ed9d0fe457349_JaffaCakes118.rtf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
27a31bb63bd705c8f48ed9d0fe457349_JaffaCakes118.rtf
Resource
win10v2004-20240426-en
General
-
Target
27a31bb63bd705c8f48ed9d0fe457349_JaffaCakes118.rtf
-
Size
724KB
-
MD5
27a31bb63bd705c8f48ed9d0fe457349
-
SHA1
b51ed1f439b535f986f13480d65bb770e3817ad7
-
SHA256
40c8077131f4d635924d0948059b6a834a0bf5ad82692d67203deb715d065d91
-
SHA512
bc7b4df2dcc84ae735fb4aee364ab9f985cc4c7a39e8d7c6d5dff2cf437743751b599ac90ca798c643b261cbeefbdb5cf33f9ca7c722a7c104242304e000571b
-
SSDEEP
12288:HQPeWsDY0kXbI80vIsRdznAx9MEH+3yaOXGXav:wPFs0Xt0QGdzA3JSyajXQ
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
NTFS ADS 5 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Temp\{BB39AAEC-5BDF-438F-8C8B-6FC3A838237B}\decoy.doc:Zone.Identifier WINWORD.EXE File opened for modification C:\Users\Admin\AppData\Local\Temp\{BB39AAEC-5BDF-438F-8C8B-6FC3A838237B}\task.bat:Zone.Identifier WINWORD.EXE File opened for modification C:\Users\Admin\AppData\Local\Temp\{BB39AAEC-5BDF-438F-8C8B-6FC3A838237B}\exe.exe:Zone.Identifier WINWORD.EXE File opened for modification C:\Users\Admin\AppData\Local\Temp\{BB39AAEC-5BDF-438F-8C8B-6FC3A838237B}\2nd.bat:Zone.Identifier WINWORD.EXE File opened for modification C:\Users\Admin\AppData\Local\Temp\{BB39AAEC-5BDF-438F-8C8B-6FC3A838237B}\inteldriverupd1.sct:Zone.Identifier WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 3120 WINWORD.EXE 3120 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
WINWORD.EXEpid process 3120 WINWORD.EXE 3120 WINWORD.EXE 3120 WINWORD.EXE 3120 WINWORD.EXE 3120 WINWORD.EXE 3120 WINWORD.EXE 3120 WINWORD.EXE 3120 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\27a31bb63bd705c8f48ed9d0fe457349_JaffaCakes118.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3120
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\{BB39AAEC-5BDF-438F-8C8B-6FC3A838237B}\inteldriverupd1.sct:Zone.IdentifierFilesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
memory/3120-10-0x00007FFA8A4F0000-0x00007FFA8A6E5000-memory.dmpFilesize
2.0MB
-
memory/3120-83-0x00007FFA8A4F0000-0x00007FFA8A6E5000-memory.dmpFilesize
2.0MB
-
memory/3120-11-0x00007FFA8A4F0000-0x00007FFA8A6E5000-memory.dmpFilesize
2.0MB
-
memory/3120-3-0x00007FFA4A570000-0x00007FFA4A580000-memory.dmpFilesize
64KB
-
memory/3120-2-0x00007FFA4A570000-0x00007FFA4A580000-memory.dmpFilesize
64KB
-
memory/3120-6-0x00007FFA8A4F0000-0x00007FFA8A6E5000-memory.dmpFilesize
2.0MB
-
memory/3120-7-0x00007FFA8A4F0000-0x00007FFA8A6E5000-memory.dmpFilesize
2.0MB
-
memory/3120-8-0x00007FFA8A4F0000-0x00007FFA8A6E5000-memory.dmpFilesize
2.0MB
-
memory/3120-9-0x00007FFA8A4F0000-0x00007FFA8A6E5000-memory.dmpFilesize
2.0MB
-
memory/3120-13-0x00007FFA8A4F0000-0x00007FFA8A6E5000-memory.dmpFilesize
2.0MB
-
memory/3120-12-0x00007FFA8A4F0000-0x00007FFA8A6E5000-memory.dmpFilesize
2.0MB
-
memory/3120-14-0x00007FFA47C10000-0x00007FFA47C20000-memory.dmpFilesize
64KB
-
memory/3120-5-0x00007FFA4A570000-0x00007FFA4A580000-memory.dmpFilesize
64KB
-
memory/3120-4-0x00007FFA4A570000-0x00007FFA4A580000-memory.dmpFilesize
64KB
-
memory/3120-50-0x00007FFA8A58D000-0x00007FFA8A58E000-memory.dmpFilesize
4KB
-
memory/3120-16-0x00007FFA8A4F0000-0x00007FFA8A6E5000-memory.dmpFilesize
2.0MB
-
memory/3120-18-0x00007FFA47C10000-0x00007FFA47C20000-memory.dmpFilesize
64KB
-
memory/3120-17-0x00007FFA8A4F0000-0x00007FFA8A6E5000-memory.dmpFilesize
2.0MB
-
memory/3120-19-0x00007FFA8A4F0000-0x00007FFA8A6E5000-memory.dmpFilesize
2.0MB
-
memory/3120-1-0x00007FFA8A58D000-0x00007FFA8A58E000-memory.dmpFilesize
4KB
-
memory/3120-49-0x00007FFA8A4F0000-0x00007FFA8A6E5000-memory.dmpFilesize
2.0MB
-
memory/3120-15-0x00007FFA8A4F0000-0x00007FFA8A6E5000-memory.dmpFilesize
2.0MB
-
memory/3120-79-0x00007FFA4A570000-0x00007FFA4A580000-memory.dmpFilesize
64KB
-
memory/3120-80-0x00007FFA4A570000-0x00007FFA4A580000-memory.dmpFilesize
64KB
-
memory/3120-81-0x00007FFA4A570000-0x00007FFA4A580000-memory.dmpFilesize
64KB
-
memory/3120-82-0x00007FFA4A570000-0x00007FFA4A580000-memory.dmpFilesize
64KB
-
memory/3120-0-0x00007FFA4A570000-0x00007FFA4A580000-memory.dmpFilesize
64KB