Analysis

  • max time kernel
    136s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-05-2024 23:57

General

  • Target

    5c273824b89a437bde9fedfb82f75eee_JaffaCakes118.doc

  • Size

    235KB

  • MD5

    5c273824b89a437bde9fedfb82f75eee

  • SHA1

    9abac4c3fb224ad97c6156aca3fa07db05d15ce6

  • SHA256

    85d2ba3f12877bf7e531ec1970909f2ea20f55ba17d27f4a5b65e8e8dc493909

  • SHA512

    35f191df6272b0c979bb73397a76ac060e30471846fd303aa2c8b6a5a18b9208f626c4b75558dfc7390a6a198c9cb4e15b06ab734212a002fd947a9e43862658

  • SSDEEP

    6144:Gb6WbgilSNobMNRzUG8eQBAPMaOBq6Vd/nV/RRwq:8bqoYNZ6eiat6Vd/nV/RRwq

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5c273824b89a437bde9fedfb82f75eee_JaffaCakes118.doc" /o ""
    1⤵
    • Suspicious use of SetThreadContext
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1440
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\SysWOW64\svchost.exe"
      2⤵
      • Process spawned unexpected child process
      • Suspicious behavior: EnumeratesProcesses
      PID:3188

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCDC05C.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • memory/1440-52-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-6-0x00007FFA27E70000-0x00007FFA27E80000-memory.dmp

    Filesize

    64KB

  • memory/1440-2-0x00007FFA27E70000-0x00007FFA27E80000-memory.dmp

    Filesize

    64KB

  • memory/1440-0-0x00007FFA27E70000-0x00007FFA27E80000-memory.dmp

    Filesize

    64KB

  • memory/1440-5-0x00007FFA27E70000-0x00007FFA27E80000-memory.dmp

    Filesize

    64KB

  • memory/1440-1-0x00007FFA27E70000-0x00007FFA27E80000-memory.dmp

    Filesize

    64KB

  • memory/1440-7-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-8-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-10-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-9-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-11-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-12-0x00007FFA259F0000-0x00007FFA25A00000-memory.dmp

    Filesize

    64KB

  • memory/1440-13-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-14-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-16-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-50-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-18-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-17-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-19-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-33-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-572-0x00007FFA27E70000-0x00007FFA27E80000-memory.dmp

    Filesize

    64KB

  • memory/1440-4-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-15-0x00007FFA259F0000-0x00007FFA25A00000-memory.dmp

    Filesize

    64KB

  • memory/1440-574-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-53-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-44-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-54-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-56-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-55-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-34-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-66-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-67-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-68-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-3-0x00007FFA67E8D000-0x00007FFA67E8E000-memory.dmp

    Filesize

    4KB

  • memory/1440-546-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-547-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-548-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-549-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/1440-570-0x00007FFA27E70000-0x00007FFA27E80000-memory.dmp

    Filesize

    64KB

  • memory/1440-571-0x00007FFA27E70000-0x00007FFA27E80000-memory.dmp

    Filesize

    64KB

  • memory/1440-573-0x00007FFA27E70000-0x00007FFA27E80000-memory.dmp

    Filesize

    64KB

  • memory/3188-57-0x00007FFA67DF0000-0x00007FFA67FE5000-memory.dmp

    Filesize

    2.0MB

  • memory/3188-51-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB