Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-06-2024 08:49

General

  • Target

    0d6f6cbad616b72c7cfd40c24b96918d_JaffaCakes118.doc

  • Size

    55KB

  • MD5

    0d6f6cbad616b72c7cfd40c24b96918d

  • SHA1

    75b5e3dfeb240e3cbc06ae6410714e39ab4392ad

  • SHA256

    c2d7d20322bd367644204e7a2f396150b9200fff08324f5de1bd0dd59b79e563

  • SHA512

    5acb3d23d902af6f016987ad40aa12b82bd92e6d48a00ef519883023c23e43fadbad2475114a9a67506d3c7c809246e0e2e44f709559406d4914df4cb3fd1bc6

  • SSDEEP

    768:Ehd9JQo5w8+p3/pRP0H1m0w9hVZzZri6Af2phso:chQj88Rd+wPVZzZm5f2ph

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0d6f6cbad616b72c7cfd40c24b96918d_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:3084

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCD78B0.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • C:\Users\Admin\AppData\Local\Temp\VB3E80.tmp

    Filesize

    4KB

    MD5

    9141c18fb9a2e421cc99d94fbc3eb21c

    SHA1

    354e3e9af116264d472e53c98765cee6c098f18c

    SHA256

    d081571240c58162cf207ce683df704a61ee1350cd9276fc3695bc25fd855905

    SHA512

    90aabd66a03b458f4dfc9f5e10da4afb5e1d59a42e60219bfaab84d3dfd720ccd2c57a6bb83ede6850ecc9ecbd07368524feb726fa4035048c0ce8bb0f0be26b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

    Filesize

    41KB

    MD5

    b09bd2d93b1ca957d66b16992befb3bd

    SHA1

    341e0bffa9a13fb822dd7020127dd914d6942492

    SHA256

    2d394dad4399fe7980e32f807ae3c34d3a9dae1df51ff6cf8cacacd758d257c7

    SHA512

    8e4e7e1d92c7c6dec516ba438f67b93096a7f41f85568c122accaf761e5899091500239058d9df050685087815a8b233934613e04969d540db55c6da76e4dd42

  • memory/3084-11-0x00007FFADD340000-0x00007FFADD350000-memory.dmp

    Filesize

    64KB

  • memory/3084-595-0x00007FFADF7D0000-0x00007FFADF7E0000-memory.dmp

    Filesize

    64KB

  • memory/3084-5-0x00007FFB1F7ED000-0x00007FFB1F7EE000-memory.dmp

    Filesize

    4KB

  • memory/3084-7-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-9-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-10-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-8-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-0-0x00007FFADF7D0000-0x00007FFADF7E0000-memory.dmp

    Filesize

    64KB

  • memory/3084-33-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-13-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-14-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-15-0x00007FFADD340000-0x00007FFADD350000-memory.dmp

    Filesize

    64KB

  • memory/3084-17-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-16-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-12-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-20-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-19-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-18-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-6-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-4-0x00007FFADF7D0000-0x00007FFADF7E0000-memory.dmp

    Filesize

    64KB

  • memory/3084-80-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-52-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-53-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-62-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-1-0x00007FFADF7D0000-0x00007FFADF7E0000-memory.dmp

    Filesize

    64KB

  • memory/3084-51-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-81-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-3-0x00007FFADF7D0000-0x00007FFADF7E0000-memory.dmp

    Filesize

    64KB

  • memory/3084-550-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-560-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-561-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-562-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-2-0x00007FFADF7D0000-0x00007FFADF7E0000-memory.dmp

    Filesize

    64KB

  • memory/3084-596-0x00007FFADF7D0000-0x00007FFADF7E0000-memory.dmp

    Filesize

    64KB

  • memory/3084-597-0x00007FFADF7D0000-0x00007FFADF7E0000-memory.dmp

    Filesize

    64KB

  • memory/3084-598-0x00007FFADF7D0000-0x00007FFADF7E0000-memory.dmp

    Filesize

    64KB

  • memory/3084-36-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB

  • memory/3084-599-0x00007FFB1F750000-0x00007FFB1F945000-memory.dmp

    Filesize

    2.0MB