Analysis
-
max time kernel
144s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20/05/2024, 00:53
Static task
static1
Behavioral task
behavioral1
Sample
5c595e6e7a518e6e59781233b9f0a0fa_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5c595e6e7a518e6e59781233b9f0a0fa_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
data1748814.rtf
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
data1748814.rtf
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
data2607577.xls
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
data2607577.xls
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
data865134.pdf
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
data865134.pdf
Resource
win10v2004-20240508-en
General
-
Target
data1748814.rtf
-
Size
838KB
-
MD5
c7f5c3a2511cb98c24d3dd96692dd9d1
-
SHA1
230e58a20d409c0625533a29cf3256e9b342d239
-
SHA256
6f7bd92726a05557f40bcc6fe2d1cedd37f1fb0d484739d369ed787003d845b8
-
SHA512
564f7493606f05bddcf5c5945a008fa950113cb9926acae16545d085e3232c4a87b77f55485f8e70cc6e57112881f4fd6ac491df8cf96bc483b0cdfbd73f35d0
-
SSDEEP
24576:2fVMB4bd69Xzl3U1zwNivZ1lqy4njfyzEFuLtI8:2tMB4bd6ZzeGiRqy8fyFBI8
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 376 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 376 WINWORD.EXE 376 WINWORD.EXE 376 WINWORD.EXE 376 WINWORD.EXE 376 WINWORD.EXE 376 WINWORD.EXE 376 WINWORD.EXE 376 WINWORD.EXE 376 WINWORD.EXE 376 WINWORD.EXE 376 WINWORD.EXE 376 WINWORD.EXE 376 WINWORD.EXE 376 WINWORD.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\data1748814.rtf"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:376