Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    25-05-2024 19:21

General

  • Target

    72fe83867deead3af1e60e239be9528f_JaffaCakes118.doc

  • Size

    266KB

  • MD5

    72fe83867deead3af1e60e239be9528f

  • SHA1

    b3e7976c43018f3451004f71598da586e989400e

  • SHA256

    bfb0a7300758df3653084e1826ff18678f5698e294079bb3f9f1777643cfbdd0

  • SHA512

    aa442bf1c33deb743441d95000b0a4b2ffae35fd79e86ead0b495035ce786ab00f991bca6ba9cb5969d888fd0aa243b83442eb2bbd8100eb1ebc120a6394c455

  • SSDEEP

    6144:qco0vaU7wCrc6CbvJAleaOKMnwCtrtk16W0U:Do0nwCA6CjJAsFRkb

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\72fe83867deead3af1e60e239be9528f_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1896
    • C:\Program Files\Java\jre7\bin\javaw.exe
      "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\bScFgym.jar"
      2⤵
      • Process spawned unexpected child process
      PID:1620
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1624

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\bScFgym.jar

      Filesize

      1KB

      MD5

      9c2287e3d32a7ea19092f49b236f49cf

      SHA1

      7554c4cabeee04f1fe924e981bac3dfa8f2122f6

      SHA256

      01049cc8fbe5983ba644ff7ef7b8f3d9150d59ef7ac522ecfc484ea0dea64788

      SHA512

      5803d486bb9cdee2d01360f50807b6a714d57061e73197c314719a63285fbba42b2318ce032b2ab0d387c3830791e306ec1546dcc75602ca1b1c534896b51725

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      1097a0d624be8c8e4acec0898ca0c0cd

      SHA1

      158738c4a6272595376e9479abfdaa7af4338819

      SHA256

      6a328459588923828a702fc92f38a2b886fb305e06225f1605d78e5f482246c7

      SHA512

      389e92d6521b6ae9ac6407182825b4dca6a25a6813e6c47d069a09825af62e6c7ace0c56d163cdcc0e89b39478d3d9c0010738af56ddc337695794d5384e3c8e

    • memory/1896-0-0x000000002F4F1000-0x000000002F4F2000-memory.dmp

      Filesize

      4KB

    • memory/1896-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1896-2-0x0000000070C8D000-0x0000000070C98000-memory.dmp

      Filesize

      44KB

    • memory/1896-23-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-22-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-21-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-20-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-19-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-18-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-17-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-16-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-15-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-14-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-13-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-12-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-11-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-10-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-9-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-8-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-7-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-6-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-5-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-31-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-30-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-29-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-28-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-27-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-26-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-25-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-24-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-65-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-63-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-36-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-35-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-34-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-33-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-32-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-87-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-67-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-66-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-64-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-62-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-61-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-60-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-59-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-58-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-57-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-56-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-55-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-54-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-53-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-52-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-51-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-50-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-49-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-48-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-47-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-46-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-45-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-44-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-43-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-42-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-41-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-40-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-39-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-38-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-37-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-136-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-144-0x0000000070C8D000-0x0000000070C98000-memory.dmp

      Filesize

      44KB

    • memory/1896-145-0x0000000000480000-0x0000000000580000-memory.dmp

      Filesize

      1024KB

    • memory/1896-161-0x0000000070C8D000-0x0000000070C98000-memory.dmp

      Filesize

      44KB