Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 11:33
Behavioral task
behavioral1
Sample
0de852111e504d62a603e39da02986d7_JaffaCakes118.doc
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
0de852111e504d62a603e39da02986d7_JaffaCakes118.doc
Resource
win10v2004-20240508-en
General
-
Target
0de852111e504d62a603e39da02986d7_JaffaCakes118.doc
-
Size
35KB
-
MD5
0de852111e504d62a603e39da02986d7
-
SHA1
eea12326ed082262ab32e21b58ca00b0c8ea4dc7
-
SHA256
9a2b75bf3f8cbb2426ba5fb6fc7f36634244f198bc41c10260a9d1cdc1ddaadf
-
SHA512
95e31a1962947db8596f419a279c9e2cd19cea3dd14549a8856b4472a28057971309fcdd75fe6385f073de472a3287a92bbab2413f054adcf0c24336c07c993c
-
SSDEEP
384:FMKrwDvut2R/n/z5GiqCfb7jlzHgMjMzJZt:eUwDRRv75Giq2QN
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 6000 WINWORD.EXE 6000 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 6000 WINWORD.EXE 6000 WINWORD.EXE 6000 WINWORD.EXE 6000 WINWORD.EXE 6000 WINWORD.EXE 6000 WINWORD.EXE 6000 WINWORD.EXE 6000 WINWORD.EXE 6000 WINWORD.EXE 6000 WINWORD.EXE 6000 WINWORD.EXE 6000 WINWORD.EXE 6000 WINWORD.EXE 6000 WINWORD.EXE 6000 WINWORD.EXE 6000 WINWORD.EXE 6000 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0de852111e504d62a603e39da02986d7_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:6000
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
30KB
MD54c1aec1fe1b72673b87eb5673ec08af7
SHA1bd4c0b8fef53eee83792923dd02a26b8aea88eba
SHA256eb234adae3c0f0c17997e7e20dbd3c1072833cbada61115b2ccf26991be56a5d
SHA5128c981cc712d71fb101a405173f9ffc55bce6546f5ce7c5bf1b36a1ec695f7267a0d925b017e1e198e5ea044e19c8767f34a08c1eb35a968b6d4e0638aab8fd2d