Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-05-2024 20:51

General

  • Target

    5b6885ebd83a7ac6d4e9ded6017d7032_JaffaCakes118.doc

  • Size

    34KB

  • MD5

    5b6885ebd83a7ac6d4e9ded6017d7032

  • SHA1

    e655f2f8ee392fae26292ce6d3dc8066acdb7906

  • SHA256

    30a49eeed2dfab51b07cf23e948a33c6c2b51fd27c4b2aef506ea16a200ec7bd

  • SHA512

    6030f2d26baeeaaa925ec5426090889e00f475904ba4baf996a0908dc5c61fdb0422887c84a36fe3d328bc8b2fe98625c5335516504eb19b461d6b00ec40fb5f

  • SSDEEP

    384:zA4dzY0WpSbuj/LdPvenCpeJzKoSS3DyJe8oYGBhPEI8368osCg3Tp:ddzY0WcqjjVenFFRDM4YG/hiSsv

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5b6885ebd83a7ac6d4e9ded6017d7032_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4736

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4736-0-0x00007FFF6B290000-0x00007FFF6B2A0000-memory.dmp

    Filesize

    64KB

  • memory/4736-2-0x00007FFF6B290000-0x00007FFF6B2A0000-memory.dmp

    Filesize

    64KB

  • memory/4736-3-0x00007FFF6B290000-0x00007FFF6B2A0000-memory.dmp

    Filesize

    64KB

  • memory/4736-4-0x00007FFF6B290000-0x00007FFF6B2A0000-memory.dmp

    Filesize

    64KB

  • memory/4736-1-0x00007FFF6B290000-0x00007FFF6B2A0000-memory.dmp

    Filesize

    64KB

  • memory/4736-5-0x00007FFFA8A40000-0x00007FFFA8B4B000-memory.dmp

    Filesize

    1.0MB

  • memory/4736-6-0x00007FFF68BB0000-0x00007FFF68BC0000-memory.dmp

    Filesize

    64KB

  • memory/4736-7-0x00007FFF68BB0000-0x00007FFF68BC0000-memory.dmp

    Filesize

    64KB

  • memory/4736-22-0x00007FFFA8A40000-0x00007FFFA8B4B000-memory.dmp

    Filesize

    1.0MB