Analysis
-
max time kernel
125s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2024, 02:25
Static task
static1
Behavioral task
behavioral1
Sample
a7b51ae6ba9c677c31e77dcad8312b7f_JaffaCakes118.doc
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a7b51ae6ba9c677c31e77dcad8312b7f_JaffaCakes118.doc
Resource
win10v2004-20240611-en
General
-
Target
a7b51ae6ba9c677c31e77dcad8312b7f_JaffaCakes118.doc
-
Size
683KB
-
MD5
a7b51ae6ba9c677c31e77dcad8312b7f
-
SHA1
bb051315e819a5d164633879a139341a6972845b
-
SHA256
6239a3175ddeb6187d2a0fbd6d3a6e9b9a671594f670fa32e783c700e5230aeb
-
SHA512
d75d4f0e06366c881da55532e4f32d5cd55f171f159e2cd30f1791b28d09462f0117e0fc65b3514cc05bf3387f15ed06f142bce65ce055bccf3f2390d0f571bd
-
SSDEEP
3072:xXXhV77w8GrxdZuKb58UYyZLCqKu60Og43jIjpJAon7E0hU952Tdosrplh0i1SCB:d7NUBJZuqKfMdnFI8docXh08SpX
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4540 WINWORD.EXE 4540 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 4540 WINWORD.EXE 4540 WINWORD.EXE 4540 WINWORD.EXE 4540 WINWORD.EXE 4540 WINWORD.EXE 4540 WINWORD.EXE 4540 WINWORD.EXE 4540 WINWORD.EXE 4540 WINWORD.EXE 4540 WINWORD.EXE 4540 WINWORD.EXE 4540 WINWORD.EXE 4540 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\a7b51ae6ba9c677c31e77dcad8312b7f_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4540
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1276,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:81⤵PID:3204
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e