Analysis
-
max time kernel
100s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 06:47
Static task
static1
Behavioral task
behavioral1
Sample
44f4f3e0503ab088376786143ad490a4_JaffaCakes118.doc
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
44f4f3e0503ab088376786143ad490a4_JaffaCakes118.doc
Resource
win10v2004-20240508-en
General
-
Target
44f4f3e0503ab088376786143ad490a4_JaffaCakes118.doc
-
Size
36KB
-
MD5
44f4f3e0503ab088376786143ad490a4
-
SHA1
080a9d1a758576155aa95395d9412c894a8a35a7
-
SHA256
a5f4eb89df7b620e076c432b92e4bb659a909f096ce3957839befc5cda1392fb
-
SHA512
290d691132461c1be4de9450526d0dd991de0a2a200c586fbcfbb1a1f07341f27495ebbd3265da0a110ea09d91cb8de6097a00195ba00e4139188b1cdc33d216
-
SSDEEP
192:escrIAxHLUWoWLHWgYxx78lWpAQ4wbvpx+7G7Z0jIkHtWn9XsUQl1Da:eDqjuyn7Ec/7Z0jIUti9X
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2124 WINWORD.EXE 2124 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 2124 WINWORD.EXE 2124 WINWORD.EXE 2124 WINWORD.EXE 2124 WINWORD.EXE 2124 WINWORD.EXE 2124 WINWORD.EXE 2124 WINWORD.EXE 2124 WINWORD.EXE 2124 WINWORD.EXE 2124 WINWORD.EXE 2124 WINWORD.EXE 2124 WINWORD.EXE 2124 WINWORD.EXE 2124 WINWORD.EXE 2124 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\44f4f3e0503ab088376786143ad490a4_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2124
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
26KB
MD5c4ac0fc2b29dd3180fc8e899e6a00fb0
SHA1c9d38d319ce482c0d49ed3452e3ee707a76aa2f7
SHA256260b4f8d36a000b135c4060cb34bb254f258936c80424c4945abcf32408add8b
SHA5125bcbd7e4053018db07eaf63af87a06518b118ef76a2e176b9e0170de756899433ccb2ca92a66b751e5d881b98f0e8bf6a487076c5038141ea0c63eb0f19f9fc3