Analysis

  • max time kernel
    100s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/05/2024, 06:47

General

  • Target

    44f4f3e0503ab088376786143ad490a4_JaffaCakes118.doc

  • Size

    36KB

  • MD5

    44f4f3e0503ab088376786143ad490a4

  • SHA1

    080a9d1a758576155aa95395d9412c894a8a35a7

  • SHA256

    a5f4eb89df7b620e076c432b92e4bb659a909f096ce3957839befc5cda1392fb

  • SHA512

    290d691132461c1be4de9450526d0dd991de0a2a200c586fbcfbb1a1f07341f27495ebbd3265da0a110ea09d91cb8de6097a00195ba00e4139188b1cdc33d216

  • SSDEEP

    192:escrIAxHLUWoWLHWgYxx78lWpAQ4wbvpx+7G7Z0jIkHtWn9XsUQl1Da:eDqjuyn7Ec/7Z0jIUti9X

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\44f4f3e0503ab088376786143ad490a4_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2124

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\TCD8B81.tmp\iso690.xsl

          Filesize

          263KB

          MD5

          ff0e07eff1333cdf9fc2523d323dd654

          SHA1

          77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

          SHA256

          3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

          SHA512

          b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

        • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

          Filesize

          26KB

          MD5

          c4ac0fc2b29dd3180fc8e899e6a00fb0

          SHA1

          c9d38d319ce482c0d49ed3452e3ee707a76aa2f7

          SHA256

          260b4f8d36a000b135c4060cb34bb254f258936c80424c4945abcf32408add8b

          SHA512

          5bcbd7e4053018db07eaf63af87a06518b118ef76a2e176b9e0170de756899433ccb2ca92a66b751e5d881b98f0e8bf6a487076c5038141ea0c63eb0f19f9fc3

        • memory/2124-11-0x00007FFAB5A90000-0x00007FFAB5AA0000-memory.dmp

          Filesize

          64KB

        • memory/2124-19-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

          Filesize

          2.0MB

        • memory/2124-4-0x00007FFAB8090000-0x00007FFAB80A0000-memory.dmp

          Filesize

          64KB

        • memory/2124-5-0x00007FFAB8090000-0x00007FFAB80A0000-memory.dmp

          Filesize

          64KB

        • memory/2124-6-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

          Filesize

          2.0MB

        • memory/2124-7-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

          Filesize

          2.0MB

        • memory/2124-9-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

          Filesize

          2.0MB

        • memory/2124-8-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

          Filesize

          2.0MB

        • memory/2124-13-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

          Filesize

          2.0MB

        • memory/2124-15-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

          Filesize

          2.0MB

        • memory/2124-14-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

          Filesize

          2.0MB

        • memory/2124-16-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

          Filesize

          2.0MB

        • memory/2124-12-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

          Filesize

          2.0MB

        • memory/2124-17-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

          Filesize

          2.0MB

        • memory/2124-1-0x00007FFAB8090000-0x00007FFAB80A0000-memory.dmp

          Filesize

          64KB

        • memory/2124-18-0x00007FFAB5A90000-0x00007FFAB5AA0000-memory.dmp

          Filesize

          64KB

        • memory/2124-3-0x00007FFAF80AD000-0x00007FFAF80AE000-memory.dmp

          Filesize

          4KB

        • memory/2124-21-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

          Filesize

          2.0MB

        • memory/2124-20-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

          Filesize

          2.0MB

        • memory/2124-10-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

          Filesize

          2.0MB

        • memory/2124-45-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

          Filesize

          2.0MB

        • memory/2124-44-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

          Filesize

          2.0MB

        • memory/2124-46-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

          Filesize

          2.0MB

        • memory/2124-0-0x00007FFAB8090000-0x00007FFAB80A0000-memory.dmp

          Filesize

          64KB

        • memory/2124-520-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

          Filesize

          2.0MB

        • memory/2124-530-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

          Filesize

          2.0MB

        • memory/2124-531-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

          Filesize

          2.0MB

        • memory/2124-2-0x00007FFAB8090000-0x00007FFAB80A0000-memory.dmp

          Filesize

          64KB

        • memory/2124-579-0x00007FFAB8090000-0x00007FFAB80A0000-memory.dmp

          Filesize

          64KB

        • memory/2124-580-0x00007FFAB8090000-0x00007FFAB80A0000-memory.dmp

          Filesize

          64KB

        • memory/2124-581-0x00007FFAB8090000-0x00007FFAB80A0000-memory.dmp

          Filesize

          64KB

        • memory/2124-578-0x00007FFAB8090000-0x00007FFAB80A0000-memory.dmp

          Filesize

          64KB

        • memory/2124-582-0x00007FFAF8010000-0x00007FFAF8205000-memory.dmp

          Filesize

          2.0MB