Analysis
-
max time kernel
136s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 21:47
Static task
static1
Behavioral task
behavioral1
Sample
6fe45f14b8979c44af50fb66d899dc17_JaffaCakes118.rtf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6fe45f14b8979c44af50fb66d899dc17_JaffaCakes118.rtf
Resource
win10v2004-20240508-en
General
-
Target
6fe45f14b8979c44af50fb66d899dc17_JaffaCakes118.rtf
-
Size
857KB
-
MD5
6fe45f14b8979c44af50fb66d899dc17
-
SHA1
b373d5208689c21928d124df0bb2cef405f2f77e
-
SHA256
a8833208d6a934b15334a02ecaee6df9939786f469be1a8d3944a43a53571a43
-
SHA512
f6836a57d8a8ab7096807ab12c4d89c655796803911764576b66fb29e69309e7320f4908b93a2d24ff681475b9d676698b5f00d6abb4fb47c5b4b5f1aced142f
-
SSDEEP
12288:IXcp2r+s25xYf8Hb0oLAarHDaYdIZqUrz3s2aXcp2r7:IXcp2Cs25bvpdIv3s2aXcp2H
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
NTFS ADS 5 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Temp\{0BE0882A-1176-4039-A48D-16660B836CF0}\2nd.bat:Zone.Identifier WINWORD.EXE File opened for modification C:\Users\Admin\AppData\Local\Temp\{0BE0882A-1176-4039-A48D-16660B836CF0}\inteldriverupd1.sct:Zone.Identifier WINWORD.EXE File opened for modification C:\Users\Admin\AppData\Local\Temp\{0BE0882A-1176-4039-A48D-16660B836CF0}\decoy.doc:Zone.Identifier WINWORD.EXE File opened for modification C:\Users\Admin\AppData\Local\Temp\{0BE0882A-1176-4039-A48D-16660B836CF0}\task.bat:Zone.Identifier WINWORD.EXE File opened for modification C:\Users\Admin\AppData\Local\Temp\{0BE0882A-1176-4039-A48D-16660B836CF0}\exe.exe:Zone.Identifier WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 1088 WINWORD.EXE 1088 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 1088 WINWORD.EXE 1088 WINWORD.EXE 1088 WINWORD.EXE 1088 WINWORD.EXE 1088 WINWORD.EXE 1088 WINWORD.EXE 1088 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\6fe45f14b8979c44af50fb66d899dc17_JaffaCakes118.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\{0BE0882A-1176-4039-A48D-16660B836CF0}\inteldriverupd1.sct:Zone.IdentifierFilesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
memory/1088-13-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/1088-0-0x00007FF7F44B0000-0x00007FF7F44C0000-memory.dmpFilesize
64KB
-
memory/1088-12-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/1088-16-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/1088-4-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/1088-6-0x00007FF7F44B0000-0x00007FF7F44C0000-memory.dmpFilesize
64KB
-
memory/1088-7-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/1088-8-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/1088-11-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/1088-10-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/1088-9-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/1088-3-0x00007FF8344CD000-0x00007FF8344CE000-memory.dmpFilesize
4KB
-
memory/1088-79-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/1088-2-0x00007FF7F44B0000-0x00007FF7F44C0000-memory.dmpFilesize
64KB
-
memory/1088-5-0x00007FF7F44B0000-0x00007FF7F44C0000-memory.dmpFilesize
64KB
-
memory/1088-18-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/1088-19-0x00007FF7F1D00000-0x00007FF7F1D10000-memory.dmpFilesize
64KB
-
memory/1088-17-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/1088-15-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/1088-1-0x00007FF7F44B0000-0x00007FF7F44C0000-memory.dmpFilesize
64KB
-
memory/1088-46-0x00007FF834430000-0x00007FF834625000-memory.dmpFilesize
2.0MB
-
memory/1088-76-0x00007FF7F44B0000-0x00007FF7F44C0000-memory.dmpFilesize
64KB
-
memory/1088-77-0x00007FF7F44B0000-0x00007FF7F44C0000-memory.dmpFilesize
64KB
-
memory/1088-78-0x00007FF7F44B0000-0x00007FF7F44C0000-memory.dmpFilesize
64KB
-
memory/1088-75-0x00007FF7F44B0000-0x00007FF7F44C0000-memory.dmpFilesize
64KB
-
memory/1088-14-0x00007FF7F1D00000-0x00007FF7F1D10000-memory.dmpFilesize
64KB