Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
22-05-2024 21:37
General
-
Target
68b7e1b88443f19d5f4c81c3a046f364_JaffaCakes118.rtf
-
Size
430KB
-
MD5
68b7e1b88443f19d5f4c81c3a046f364
-
SHA1
9c7b786ca2b65dca55be9d38118673980885e595
-
SHA256
6f71e7fb265201ec40a614d5739285bf90347be9acb8eb73102a0cd0e0924c3d
-
SHA512
89a5cc2564f8ed6194cdb4ebd99a56882933bb1e2da845b9e973c29d7bb1e9d978b8778df89731d0a2fc80ba157d754ff6e70323f51a398f3ad9d284f412aadf
-
SSDEEP
6144:Wl3ld+Wzl3ld+Wul3ld+Wsl3ld+WAl3ld+WW1:WplTzplTuplTsplTAplTw
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 6 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 54 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\68b7e1b88443f19d5f4c81c3a046f364_JaffaCakes118.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"2⤵
- Process spawned unexpected child process
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
471B
MD5a1ea63317f798b4a8794feed068eb885
SHA189145042b32e863139c8d3b67763d1aaeb84628f
SHA2564cb414ada8d6af38feb16ac9db9da6a1480992aa217560134e02a72fb53a5b0f
SHA512bf7b88fc2c725e62dfa3ee08ff5d246f17fb4397bd745a99546b8083586a8aea334a431275de65c454b8c46b6ab90b9e0053d30b616cba28ccf7593697ff21dd
-
Filesize
412B
MD52e0cb7797defc7209b77ca129f89ffe2
SHA14bea757f85dab1f5679b9583abc3dd05c5ae3387
SHA256844eadd8d63faaefef8f189674b9fdca3804cb12f702d162e830149af796bbda
SHA5128c60e4a2e924fec977c62be7b0fd03691f2664019a729fad7d5d7e400e3bd9f1aadefa983333980ce5e3864df92f963b85f187da038a6273125913493033eeff
-
Filesize
161KB
MD5e347426bd5884efb86e3ff914bae860c
SHA17db46e27bbf17fa6fc54536f88aaa9afd37bfc7b
SHA256b2ed279fe32009aecca1825a2e657d4954fcfd4bdba525c1c55cfa211483b4d1
SHA512f1d9d6d8bda55b9f4b689b9b4b037a867755c8ac8ec17c3a2544db8f36827c36499f8e1af2478ec3aec5357ce1c3adc8ad2fdfc90617ef3b75d73f4ba9b67119
-
Filesize
2KB
MD5c5fd7e88b6751883eed0163d9805deae
SHA10ee6432f2a51ca651c83786c553a491314a3b33d
SHA256fe3ac694001f1158eb7b0dc70f50bb4512ba0e034ecb786dad2d6baae9391844
SHA512a85fb024e752ed34bd05488cdfd557d7aefaae05ca3ebeea71dc7544b9c4a2a946ec6c9487d70ce44db8d6adaa004bb9f1adad8f141a1714bc340a6c2ff4ebe6
-
Filesize
2KB
MD51676fd0b9ee6278638f3e57328ea19f0
SHA1c1617e7fe791ae5428f4270ace77c5aba9edaf05
SHA25657dcb323acf6dbc7ad9773b3c7de6a9310c6cfafdbb4dbfca5aecf1a6a22c015
SHA512c4ff271d737ac1ccbf840450b5523dbcd762749e23eeb635f4a0f402d2a4d03a15871112d2a7b13769a2c4e9c1b8710740782e5106348723ad46f2bc107e8fbe
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB