Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-05-2024 03:40

General

  • Target

    5cfee0a5b2a73cbb6a23997d373edfd8_JaffaCakes118.doc

  • Size

    74KB

  • MD5

    5cfee0a5b2a73cbb6a23997d373edfd8

  • SHA1

    d0abee53969be0036fe9fd3f165c28b3c08272df

  • SHA256

    278d0a868bd610c4c04712f7a785d9cca64d1bea4b83b8d3e55233191954385c

  • SHA512

    2c67c659214e15d80ea4bf7c532181b3426db0a3b367c4764b86558926f3d6348c7a4d4af2f3f37c13b2ef3975462394676e7a4916bb4ced3fe9614588645e60

  • SSDEEP

    768:BpJcaUitGAlmrJpmxlzC+w99NBE+1oIo4CkqeW23/rMlnv:BptJlmrJpmxlRw99NBE+aIF1/rI

Score
6/10

Malware Config

Signatures

  • Process spawned suspicious child process 1 IoCs

    This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5cfee0a5b2a73cbb6a23997d373edfd8_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3400
    • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
      "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 4520
      2⤵
      • Process spawned suspicious child process
      • Suspicious use of WriteProcessMemory
      PID:3080
      • C:\Windows\system32\dwwin.exe
        C:\Windows\system32\dwwin.exe -x -s 4520
        3⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        PID:4684

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3080-34-0x00007FFC12690000-0x00007FFC12885000-memory.dmp

    Filesize

    2.0MB

  • memory/3080-57-0x00007FFC12690000-0x00007FFC12885000-memory.dmp

    Filesize

    2.0MB

  • memory/3080-55-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

    Filesize

    64KB

  • memory/3080-54-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

    Filesize

    64KB

  • memory/3080-56-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

    Filesize

    64KB

  • memory/3080-53-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

    Filesize

    64KB

  • memory/3080-38-0x00007FFC12690000-0x00007FFC12885000-memory.dmp

    Filesize

    2.0MB

  • memory/3400-13-0x00007FFC12690000-0x00007FFC12885000-memory.dmp

    Filesize

    2.0MB

  • memory/3400-30-0x00007FFC12690000-0x00007FFC12885000-memory.dmp

    Filesize

    2.0MB

  • memory/3400-10-0x00007FFC12690000-0x00007FFC12885000-memory.dmp

    Filesize

    2.0MB

  • memory/3400-12-0x00007FFC12690000-0x00007FFC12885000-memory.dmp

    Filesize

    2.0MB

  • memory/3400-9-0x00007FFC12690000-0x00007FFC12885000-memory.dmp

    Filesize

    2.0MB

  • memory/3400-1-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

    Filesize

    64KB

  • memory/3400-11-0x00007FFC12690000-0x00007FFC12885000-memory.dmp

    Filesize

    2.0MB

  • memory/3400-14-0x00007FFBD0580000-0x00007FFBD0590000-memory.dmp

    Filesize

    64KB

  • memory/3400-15-0x00007FFBD0580000-0x00007FFBD0590000-memory.dmp

    Filesize

    64KB

  • memory/3400-8-0x00007FFC12690000-0x00007FFC12885000-memory.dmp

    Filesize

    2.0MB

  • memory/3400-31-0x00007FFC12690000-0x00007FFC12885000-memory.dmp

    Filesize

    2.0MB

  • memory/3400-32-0x00007FFC12690000-0x00007FFC12885000-memory.dmp

    Filesize

    2.0MB

  • memory/3400-6-0x00007FFC12690000-0x00007FFC12885000-memory.dmp

    Filesize

    2.0MB

  • memory/3400-7-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

    Filesize

    64KB

  • memory/3400-3-0x00007FFC1272D000-0x00007FFC1272E000-memory.dmp

    Filesize

    4KB

  • memory/3400-5-0x00007FFC12690000-0x00007FFC12885000-memory.dmp

    Filesize

    2.0MB

  • memory/3400-4-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

    Filesize

    64KB

  • memory/3400-0-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

    Filesize

    64KB

  • memory/3400-2-0x00007FFBD2710000-0x00007FFBD2720000-memory.dmp

    Filesize

    64KB

  • memory/3400-58-0x00007FFC12690000-0x00007FFC12885000-memory.dmp

    Filesize

    2.0MB