Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-06-2024 11:33

General

  • Target

    0de852111e504d62a603e39da02986d7_JaffaCakes118.doc

  • Size

    35KB

  • MD5

    0de852111e504d62a603e39da02986d7

  • SHA1

    eea12326ed082262ab32e21b58ca00b0c8ea4dc7

  • SHA256

    9a2b75bf3f8cbb2426ba5fb6fc7f36634244f198bc41c10260a9d1cdc1ddaadf

  • SHA512

    95e31a1962947db8596f419a279c9e2cd19cea3dd14549a8856b4472a28057971309fcdd75fe6385f073de472a3287a92bbab2413f054adcf0c24336c07c993c

  • SSDEEP

    384:FMKrwDvut2R/n/z5GiqCfb7jlzHgMjMzJZt:eUwDRRv75Giq2QN

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0de852111e504d62a603e39da02986d7_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:6000

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCDB969.tmp\iso690.xsl

    Filesize

    263KB

    MD5

    ff0e07eff1333cdf9fc2523d323dd654

    SHA1

    77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

    SHA256

    3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

    SHA512

    b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

  • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

    Filesize

    30KB

    MD5

    4c1aec1fe1b72673b87eb5673ec08af7

    SHA1

    bd4c0b8fef53eee83792923dd02a26b8aea88eba

    SHA256

    eb234adae3c0f0c17997e7e20dbd3c1072833cbada61115b2ccf26991be56a5d

    SHA512

    8c981cc712d71fb101a405173f9ffc55bce6546f5ce7c5bf1b36a1ec695f7267a0d925b017e1e198e5ea044e19c8767f34a08c1eb35a968b6d4e0638aab8fd2d

  • memory/6000-17-0x00007FFA4D910000-0x00007FFA4D920000-memory.dmp

    Filesize

    64KB

  • memory/6000-606-0x00007FFA4FF10000-0x00007FFA4FF20000-memory.dmp

    Filesize

    64KB

  • memory/6000-1-0x00007FFA4FF10000-0x00007FFA4FF20000-memory.dmp

    Filesize

    64KB

  • memory/6000-5-0x00007FFA8FF2D000-0x00007FFA8FF2E000-memory.dmp

    Filesize

    4KB

  • memory/6000-6-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

    Filesize

    2.0MB

  • memory/6000-10-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

    Filesize

    2.0MB

  • memory/6000-13-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

    Filesize

    2.0MB

  • memory/6000-12-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

    Filesize

    2.0MB

  • memory/6000-11-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

    Filesize

    2.0MB

  • memory/6000-9-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

    Filesize

    2.0MB

  • memory/6000-8-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

    Filesize

    2.0MB

  • memory/6000-7-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

    Filesize

    2.0MB

  • memory/6000-607-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

    Filesize

    2.0MB

  • memory/6000-0-0x00007FFA4FF10000-0x00007FFA4FF20000-memory.dmp

    Filesize

    64KB

  • memory/6000-53-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

    Filesize

    2.0MB

  • memory/6000-14-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

    Filesize

    2.0MB

  • memory/6000-18-0x00007FFA4D910000-0x00007FFA4D920000-memory.dmp

    Filesize

    64KB

  • memory/6000-54-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

    Filesize

    2.0MB

  • memory/6000-15-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

    Filesize

    2.0MB

  • memory/6000-61-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

    Filesize

    2.0MB

  • memory/6000-62-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

    Filesize

    2.0MB

  • memory/6000-4-0x00007FFA4FF10000-0x00007FFA4FF20000-memory.dmp

    Filesize

    64KB

  • memory/6000-3-0x00007FFA4FF10000-0x00007FFA4FF20000-memory.dmp

    Filesize

    64KB

  • memory/6000-604-0x00007FFA4FF10000-0x00007FFA4FF20000-memory.dmp

    Filesize

    64KB

  • memory/6000-605-0x00007FFA4FF10000-0x00007FFA4FF20000-memory.dmp

    Filesize

    64KB

  • memory/6000-16-0x00007FFA8FE90000-0x00007FFA90085000-memory.dmp

    Filesize

    2.0MB

  • memory/6000-603-0x00007FFA4FF10000-0x00007FFA4FF20000-memory.dmp

    Filesize

    64KB

  • memory/6000-2-0x00007FFA4FF10000-0x00007FFA4FF20000-memory.dmp

    Filesize

    64KB