Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-05-2024 00:28

General

  • Target

    7b14acdd2c78ba709d852a67397bff21_JaffaCakes118.doc

  • Size

    463KB

  • MD5

    7b14acdd2c78ba709d852a67397bff21

  • SHA1

    d0b4e491f2146ccfd0582f3b2e0f9e908c1ae754

  • SHA256

    1a4a4b5d6693f128bbf914b561028ff0dc78bcfdd3b0bc745848ac5149d741b1

  • SHA512

    7807f829588f2f33353ad8062f5c0f805f159ae7705c0775f8267eed1e546ce2038dc91c7f7e81292014991ff53f9e6406de0f317f9e1f4b55131c2578d4593c

  • SSDEEP

    12288:2Hm/N6x98z5HPMGNVbt+OF8zL8ynnzoADdgRD1v7:2Hmsx9810GN98OFqJnn+RV

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7b14acdd2c78ba709d852a67397bff21_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1448

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1448-0-0x00007FFA6D310000-0x00007FFA6D320000-memory.dmp

    Filesize

    64KB

  • memory/1448-2-0x00007FFA6D310000-0x00007FFA6D320000-memory.dmp

    Filesize

    64KB

  • memory/1448-4-0x00007FFAAD32D000-0x00007FFAAD32E000-memory.dmp

    Filesize

    4KB

  • memory/1448-3-0x00007FFA6D310000-0x00007FFA6D320000-memory.dmp

    Filesize

    64KB

  • memory/1448-6-0x00007FFA6D310000-0x00007FFA6D320000-memory.dmp

    Filesize

    64KB

  • memory/1448-5-0x00007FFAAD290000-0x00007FFAAD485000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-1-0x00007FFA6D310000-0x00007FFA6D320000-memory.dmp

    Filesize

    64KB

  • memory/1448-7-0x00007FFAAD290000-0x00007FFAAD485000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-9-0x00007FFAAD290000-0x00007FFAAD485000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-8-0x00007FFAAD290000-0x00007FFAAD485000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-11-0x00007FFAAD290000-0x00007FFAAD485000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-10-0x00007FFAAD290000-0x00007FFAAD485000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-16-0x00007FFAAD290000-0x00007FFAAD485000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-15-0x00007FFAAD290000-0x00007FFAAD485000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-14-0x00007FFAAD290000-0x00007FFAAD485000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-17-0x00007FFA6AC90000-0x00007FFA6ACA0000-memory.dmp

    Filesize

    64KB

  • memory/1448-18-0x00007FFAAD290000-0x00007FFAAD485000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-13-0x00007FFAAD290000-0x00007FFAAD485000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-20-0x00007FFAAD290000-0x00007FFAAD485000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-19-0x00007FFAAD290000-0x00007FFAAD485000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-12-0x00007FFAAD290000-0x00007FFAAD485000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-21-0x00007FFA6AC90000-0x00007FFA6ACA0000-memory.dmp

    Filesize

    64KB

  • memory/1448-54-0x00007FFAAD290000-0x00007FFAAD485000-memory.dmp

    Filesize

    2.0MB

  • memory/1448-161-0x00007FFAAD290000-0x00007FFAAD485000-memory.dmp

    Filesize

    2.0MB