Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25-06-2024 02:03

General

  • Target

    0bf45415a162cbd321400798c98ca964_JaffaCakes118.docm

  • Size

    18KB

  • MD5

    0bf45415a162cbd321400798c98ca964

  • SHA1

    73e751656116f4ad3f567e3c412a4449194b757e

  • SHA256

    c5f67c3a7b9ae729cfb9412642066808e210a5a73507ba20da43d6290271a8fa

  • SHA512

    8a7d3363bab3bc61c92bd10edaf14550b5e465f14191e530fad7e3d658de1a0dd597f58b350c6e1be5dffda46ec29eb7cc7eaabddd937b83d7ecedc0829266e4

  • SSDEEP

    384:/imtzOrgmvETsF0uIfodcn0i13L8N5pWSX6Ujnw+3Ak3YW:/LCt7Fly5v13EazH+3jj

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0bf45415a162cbd321400798c98ca964_JaffaCakes118.docm"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2760
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1372
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
      1⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2600

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      a73c28dd2a2338f3d4cc8e635c4ed45e

      SHA1

      74a843992958673537015b85f5a5c5d993dd37f1

      SHA256

      ebd97f768e027c7e12ad95612492b165a28d16816bb35cef74ee0598277101d8

      SHA512

      10b7fc7bcdbd8265b078b2264a2de2692706abe44a22655ad2eb793f88367e4d9d965ddc7960ebafa1ff5edb2af5ecf42922f26384c941e24def5fec9b731ca6

    • memory/2600-10-0x00000000712CD000-0x00000000712D8000-memory.dmp

      Filesize

      44KB

    • memory/2600-18-0x00000000712CD000-0x00000000712D8000-memory.dmp

      Filesize

      44KB

    • memory/2600-16-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2760-8-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/2760-6-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/2760-0-0x000000002FE21000-0x000000002FE22000-memory.dmp

      Filesize

      4KB

    • memory/2760-15-0x0000000005400000-0x0000000005500000-memory.dmp

      Filesize

      1024KB

    • memory/2760-5-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/2760-2-0x00000000712CD000-0x00000000712D8000-memory.dmp

      Filesize

      44KB

    • memory/2760-20-0x00000000712CD000-0x00000000712D8000-memory.dmp

      Filesize

      44KB

    • memory/2760-21-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB

    • memory/2760-22-0x0000000005400000-0x0000000005500000-memory.dmp

      Filesize

      1024KB

    • memory/2760-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2760-41-0x00000000712CD000-0x00000000712D8000-memory.dmp

      Filesize

      44KB

    • memory/2760-42-0x0000000000360000-0x0000000000460000-memory.dmp

      Filesize

      1024KB