Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-06-2024 17:15

General

  • Target

    0ee3fd78f9b1fa4a91e934b88a7d43e6_JaffaCakes118.doc

  • Size

    36KB

  • MD5

    0ee3fd78f9b1fa4a91e934b88a7d43e6

  • SHA1

    d9482fd4e6998e5f288a3ac6a8578cceab7156c4

  • SHA256

    ae2641920db2a85dbc84be47368d48a8e158d690d6277c605b97197dd243fe11

  • SHA512

    24ae653a864cf03ac565fd490adfd9a569f98afcd9fc9316ae354bd956b18ef1c70d604c8bee4d9bb48af05e39d21b6a3f1cf4b2a64e7affa5059135191d2a2e

  • SSDEEP

    384:YEQUkwHXlmRL5dBOAjTjfq4eu8olz0mO3UO3sjj3at7I41:g8mRl/jTjyAOmN3o

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0ee3fd78f9b1fa4a91e934b88a7d43e6_JaffaCakes118.doc" /o ""
    1⤵
    • Deletes itself
    • Checks processor information in registry
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4480

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~WRD0000.tmp

    Filesize

    39KB

    MD5

    0cb95e2686d4ba33fb79fa597cba79bf

    SHA1

    2441476ce67376d435207224a531687fab07846d

    SHA256

    fc2d346ac320c67ee694d00a331625a5bf960910302b32aefd5d1ee5ec15783c

    SHA512

    0bee02b9754c1a110728ec71c044d9afda9f994a06d744ff9b4d8f2dbbe02c0eccd5fc98d544883419b69b195fc8c1c97fb9579616820a0173ceb5c71b9d04d0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\~WRD0002.tmp

    Filesize

    27KB

    MD5

    92ca62ed4edd8d1008a17265083eacc0

    SHA1

    2ef940ee7239b5e40026018c2ef300be9c623776

    SHA256

    c3c59427800a1d6d8db7d942bddec31710a24c2c1f73812db666a8e2d09338e7

    SHA512

    1e365767b6cf53b6414d45ceefe3cdb84d91be0dd6fedba682fcfa164b5a19e667e6f6738cd170b13652de4a17f16ed85ed14671584c45f012f4ffbc4fc92898

  • memory/4480-42-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-0-0x00007FF95EF90000-0x00007FF95EFA0000-memory.dmp

    Filesize

    64KB

  • memory/4480-3-0x00007FF95EF90000-0x00007FF95EFA0000-memory.dmp

    Filesize

    64KB

  • memory/4480-6-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-9-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-8-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-10-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-7-0x00007FF95EF90000-0x00007FF95EFA0000-memory.dmp

    Filesize

    64KB

  • memory/4480-5-0x00007FF95EF90000-0x00007FF95EFA0000-memory.dmp

    Filesize

    64KB

  • memory/4480-11-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-12-0x00007FF95C9A0000-0x00007FF95C9B0000-memory.dmp

    Filesize

    64KB

  • memory/4480-13-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-16-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-43-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-14-0x00007FF95C9A0000-0x00007FF95C9B0000-memory.dmp

    Filesize

    64KB

  • memory/4480-17-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-18-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-19-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-121-0x00007FF95EF90000-0x00007FF95EFA0000-memory.dmp

    Filesize

    64KB

  • memory/4480-4-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-15-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-44-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-52-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-53-0x00007FF99EFAD000-0x00007FF99EFAE000-memory.dmp

    Filesize

    4KB

  • memory/4480-54-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-56-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-55-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-57-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-58-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-59-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-60-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-77-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-2-0x00007FF95EF90000-0x00007FF95EFA0000-memory.dmp

    Filesize

    64KB

  • memory/4480-41-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB

  • memory/4480-119-0x00007FF95EF90000-0x00007FF95EFA0000-memory.dmp

    Filesize

    64KB

  • memory/4480-120-0x00007FF95EF90000-0x00007FF95EFA0000-memory.dmp

    Filesize

    64KB

  • memory/4480-118-0x00007FF95EF90000-0x00007FF95EFA0000-memory.dmp

    Filesize

    64KB

  • memory/4480-1-0x00007FF99EFAD000-0x00007FF99EFAE000-memory.dmp

    Filesize

    4KB

  • memory/4480-122-0x00007FF99EF10000-0x00007FF99F105000-memory.dmp

    Filesize

    2.0MB