f9837300e493105799fa49c903a25b3cc6ddf5ae59a4211692d4e9dd6747e7c0

General

Target

69411b4517419f6398aa36d7ec7634db_JaffaCakes118.docm
Size

89KB
MD5

69411b4517419f6398aa36d7ec7634db
SHA1

e0cf13c48d8a9e3d362de6cf15a036037b7d6138
SHA256

f9837300e493105799fa49c903a25b3cc6ddf5ae59a4211692d4e9dd6747e7c0
SHA512

7ad7199daa74716ed4c732938b276f574f9a084a02179bea7971df9a75e758c6c0070e2ece507eff87f609099a897b425370fefdf8992ce9beccea29ce58e8a1
SSDEEP

1536:zP67+jDPFvNsnJ1kPxNZIbxpIe8k+ong3n37wPwGuyUZX6fPxQ0JRB:zi7+jrtQ8pbIrf8Ug3n3iuJxOxZJRB

Score

10^/10

execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

WScript.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	628	2476	WScript.exe	WINWORD.EXE

Blocklisted process makes network request 3 IoCs

Processes:

WScript.exe

flow pid process

25 628 WScript.exe
27 628 WScript.exe
32 628 WScript.exe
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

flow	pid	process
25	628	WScript.exe
27	628	WScript.exe
32	628	WScript.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

2476 WINWORD.EXE
2476 WINWORD.EXE
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

2476 WINWORD.EXE
2476 WINWORD.EXE
2476 WINWORD.EXE
2476 WINWORD.EXE
2476 WINWORD.EXE
2476 WINWORD.EXE
2476 WINWORD.EXE

pid	process
2476	WINWORD.EXE
2476	WINWORD.EXE

pid	process
2476	WINWORD.EXE
2476	WINWORD.EXE
2476	WINWORD.EXE
2476	WINWORD.EXE
2476	WINWORD.EXE
2476	WINWORD.EXE
2476	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WINWORD.EXE

description	pid	process	target process
PID 2476 wrote to memory of 628	2476	WINWORD.EXE	WScript.exe
PID 2476 wrote to memory of 628	2476	WINWORD.EXE	WScript.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\69411b4517419f6398aa36d7ec7634db_JaffaCakes118.docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\0.7055475.jse"
2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
PID:628

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0.7055475.jse
Filesize
24KB

MD5
732bf1882da58af70dd108f68fd7a8b2

SHA1
666e18a147522e70eecefe5dbcc29b04f5401661

SHA256
30d09dcfafa6947d64b277076b445178d3e50f355c9ed6931aabbf751b3f5d2d

SHA512
337acb54eafcda5ef272d0fbe50a00f544a67b689fe92dce58e59089b49d9f967d4453db37cbbb3ca2f3d322dba145b10be1fc3616161d8137b326469f2faad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCDB5FA.tmp\iso690.xsl
Filesize
263KB

MD5
ff0e07eff1333cdf9fc2523d323dd654

SHA1
77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

SHA256
3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

SHA512
b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

Download Submit
memory/2476-34-0x00007FFAA3690000-0x00007FFAA3885000-memory.dmp

Filesize
2.0MB

Download
memory/2476-6-0x00007FFA63710000-0x00007FFA63720000-memory.dmp

Filesize
64KB

Download
memory/2476-35-0x00007FFAA3690000-0x00007FFAA3885000-memory.dmp

Filesize
2.0MB

Download
memory/2476-7-0x00007FFAA3690000-0x00007FFAA3885000-memory.dmp

Filesize
2.0MB

Download
memory/2476-4-0x00007FFAA372D000-0x00007FFAA372E000-memory.dmp

Filesize
4KB

Download
memory/2476-5-0x00007FFAA3690000-0x00007FFAA3885000-memory.dmp

Filesize
2.0MB

Download
memory/2476-9-0x00007FFAA3690000-0x00007FFAA3885000-memory.dmp

Filesize
2.0MB

Download
memory/2476-11-0x00007FFAA3690000-0x00007FFAA3885000-memory.dmp

Filesize
2.0MB

Download
memory/2476-10-0x00007FFAA3690000-0x00007FFAA3885000-memory.dmp

Filesize
2.0MB

Download
memory/2476-13-0x00007FFAA3690000-0x00007FFAA3885000-memory.dmp

Filesize
2.0MB

Download
memory/2476-12-0x00007FFAA3690000-0x00007FFAA3885000-memory.dmp

Filesize
2.0MB

Download
memory/2476-14-0x00007FFA61360000-0x00007FFA61370000-memory.dmp

Filesize
64KB

Download
memory/2476-8-0x00007FFAA3690000-0x00007FFAA3885000-memory.dmp

Filesize
2.0MB

Download
memory/2476-15-0x00007FFA61360000-0x00007FFA61370000-memory.dmp

Filesize
64KB

Download
memory/2476-586-0x00007FFAA3690000-0x00007FFAA3885000-memory.dmp

Filesize
2.0MB

Download
memory/2476-1-0x00007FFA63710000-0x00007FFA63720000-memory.dmp

Filesize
64KB

Download
memory/2476-64-0x00007FFAA3690000-0x00007FFAA3885000-memory.dmp

Filesize
2.0MB

Download
memory/2476-65-0x00007FFAA3690000-0x00007FFAA3885000-memory.dmp

Filesize
2.0MB

Download
memory/2476-2-0x00007FFA63710000-0x00007FFA63720000-memory.dmp

Filesize
64KB

Download
memory/2476-77-0x00007FFAA3690000-0x00007FFAA3885000-memory.dmp

Filesize
2.0MB

Download
memory/2476-3-0x00007FFA63710000-0x00007FFA63720000-memory.dmp

Filesize
64KB

Download
memory/2476-555-0x00007FFAA3690000-0x00007FFAA3885000-memory.dmp

Filesize
2.0MB

Download
memory/2476-556-0x00007FFAA3690000-0x00007FFAA3885000-memory.dmp

Filesize
2.0MB

Download
memory/2476-557-0x00007FFAA3690000-0x00007FFAA3885000-memory.dmp

Filesize
2.0MB

Download
memory/2476-558-0x00007FFAA3690000-0x00007FFAA3885000-memory.dmp

Filesize
2.0MB

Download
memory/2476-585-0x00007FFA63710000-0x00007FFA63720000-memory.dmp

Filesize
64KB

Download
memory/2476-584-0x00007FFA63710000-0x00007FFA63720000-memory.dmp

Filesize
64KB

Download
memory/2476-583-0x00007FFA63710000-0x00007FFA63720000-memory.dmp

Filesize
64KB

Download
memory/2476-582-0x00007FFA63710000-0x00007FFA63720000-memory.dmp

Filesize
64KB

Download
memory/2476-0-0x00007FFA63710000-0x00007FFA63720000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads