b8a1ecdac45c0d6c815cc70031cb0549b3a8a4dec7adeb8b1e216549e52cbaa9

General

Target

303f486490b099a40f8786abd53fb7f8_JaffaCakes118.docm
Size

195KB
MD5

303f486490b099a40f8786abd53fb7f8
SHA1

fb834998ffd0a056fc435270702609f66bf5b377
SHA256

b8a1ecdac45c0d6c815cc70031cb0549b3a8a4dec7adeb8b1e216549e52cbaa9
SHA512

eb3a1409ca7492a13a516016cc9b3a95cbc09ff9805432c75f3b4f4bb61855d1471ec56c6569eec459b1cb90658822574be74954615bfd7df8945807cdd4f7cb
SSDEEP

6144:TdTg+9TSueE1+lyrgIOU243CXlWzcYtZaPN:NgO+lUb2DX2Z6N

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

radA40D3.tmp.exe

pid process

4708 radA40D3.tmp.exe

pid	process
4708	radA40D3.tmp.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

3956 WINWORD.EXE
3956 WINWORD.EXE
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

3956 WINWORD.EXE
3956 WINWORD.EXE
3956 WINWORD.EXE
3956 WINWORD.EXE
3956 WINWORD.EXE
3956 WINWORD.EXE
3956 WINWORD.EXE

pid	process
3956	WINWORD.EXE
3956	WINWORD.EXE

pid	process
3956	WINWORD.EXE
3956	WINWORD.EXE
3956	WINWORD.EXE
3956	WINWORD.EXE
3956	WINWORD.EXE
3956	WINWORD.EXE
3956	WINWORD.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 3956 wrote to memory of 4708	3956	WINWORD.EXE	radA40D3.tmp.exe
PID 3956 wrote to memory of 4708	3956	WINWORD.EXE	radA40D3.tmp.exe
PID 3956 wrote to memory of 4708	3956	WINWORD.EXE	radA40D3.tmp.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\303f486490b099a40f8786abd53fb7f8_JaffaCakes118.docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3956

C:\Users\Admin\AppData\Local\Temp\radA40D3.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\radA40D3.tmp.exe"
2⤵
- Executes dropped EXE
PID:4708

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TCD971F.tmp\gb.xsl
Filesize
262KB

MD5
51d32ee5bc7ab811041f799652d26e04

SHA1
412193006aa3ef19e0a57e16acf86b830993024a

SHA256
6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

SHA512
5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

Download Submit
C:\Users\Admin\AppData\Local\Temp\radA40D3.tmp.exe
Filesize
72KB

MD5
b9bb353e5da0cc77030c12825657c3f8

SHA1
d7111c78f855d6316bb033107b4be8932b38575b

SHA256
bbb1eb88a95d05ef2f17b7ddb1529f82169a0836c93258693a58a9110e830e3f

SHA512
8840ced724a0638607e5cffe24fe26094d2b110932ef34529c9fecce3d42a1a2ac49cd5a200f6cdc1d53fe9b0c190a2b8313bbe04cea3c19f599d9f36063e9fc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/3956-14-0x00007FF90BFD0000-0x00007FF90C1C5000-memory.dmp

Filesize
2.0MB

Download
memory/3956-29-0x00007FF90BFD0000-0x00007FF90C1C5000-memory.dmp

Filesize
2.0MB

Download
memory/3956-5-0x00007FF90C06D000-0x00007FF90C06E000-memory.dmp

Filesize
4KB

Download
memory/3956-6-0x00007FF90BFD0000-0x00007FF90C1C5000-memory.dmp

Filesize
2.0MB

Download
memory/3956-7-0x00007FF90BFD0000-0x00007FF90C1C5000-memory.dmp

Filesize
2.0MB

Download
memory/3956-8-0x00007FF90BFD0000-0x00007FF90C1C5000-memory.dmp

Filesize
2.0MB

Download
memory/3956-10-0x00007FF90BFD0000-0x00007FF90C1C5000-memory.dmp

Filesize
2.0MB

Download
memory/3956-11-0x00007FF8C9E60000-0x00007FF8C9E70000-memory.dmp

Filesize
64KB

Download
memory/3956-9-0x00007FF90BFD0000-0x00007FF90C1C5000-memory.dmp

Filesize
2.0MB

Download
memory/3956-12-0x00007FF90BFD0000-0x00007FF90C1C5000-memory.dmp

Filesize
2.0MB

Download
memory/3956-13-0x00007FF90BFD0000-0x00007FF90C1C5000-memory.dmp

Filesize
2.0MB

Download
memory/3956-0-0x00007FF8CC050000-0x00007FF8CC060000-memory.dmp

Filesize
64KB

Download
memory/3956-15-0x00007FF8C9E60000-0x00007FF8C9E70000-memory.dmp

Filesize
64KB

Download
memory/3956-4-0x00007FF8CC050000-0x00007FF8CC060000-memory.dmp

Filesize
64KB

Download
memory/3956-39-0x00007FF90BFD0000-0x00007FF90C1C5000-memory.dmp

Filesize
2.0MB

Download
memory/3956-38-0x00007FF90BFD0000-0x00007FF90C1C5000-memory.dmp

Filesize
2.0MB

Download
memory/3956-37-0x00007FF90BFD0000-0x00007FF90C1C5000-memory.dmp

Filesize
2.0MB

Download
memory/3956-40-0x00007FF90BFD0000-0x00007FF90C1C5000-memory.dmp

Filesize
2.0MB

Download
memory/3956-42-0x00007FF90BFD0000-0x00007FF90C1C5000-memory.dmp

Filesize
2.0MB

Download
memory/3956-3-0x00007FF8CC050000-0x00007FF8CC060000-memory.dmp

Filesize
64KB

Download
memory/3956-545-0x00007FF90BFD0000-0x00007FF90C1C5000-memory.dmp

Filesize
2.0MB

Download
memory/3956-1-0x00007FF8CC050000-0x00007FF8CC060000-memory.dmp

Filesize
64KB

Download
memory/3956-65-0x00007FF90BFD0000-0x00007FF90C1C5000-memory.dmp

Filesize
2.0MB

Download
memory/3956-2-0x00007FF8CC050000-0x00007FF8CC060000-memory.dmp

Filesize
64KB

Download
memory/3956-543-0x00007FF90BFD0000-0x00007FF90C1C5000-memory.dmp

Filesize
2.0MB

Download
memory/3956-544-0x00007FF90BFD0000-0x00007FF90C1C5000-memory.dmp

Filesize
2.0MB

Download
memory/4708-56-0x00007FF90BFD0000-0x00007FF90C1C5000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads