Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-06-2024 18:23

General

  • Target

    0f1404f7e898391cfa97e9a4908d4d03_JaffaCakes118.doc

  • Size

    38KB

  • MD5

    0f1404f7e898391cfa97e9a4908d4d03

  • SHA1

    73d5d757b2dcd626a95f14776514533b0cac62ca

  • SHA256

    ba8755327b6463dd16c3429ea216e39e77d43447a8eca7df9e32526c3a9578db

  • SHA512

    7c36da2479eb41803caf3d603a25bd32363ed3878505ef322d01b218092abeb8cb2e135ab39be40f4add2184a124827fe1c8b7e4f86970dc5fed586287ae1d40

  • SSDEEP

    384:7hELzzFSXyTu9i/3MvuEyTk6uDkqv52Q4Ch:vE/MGEyT1Pqv52Q4

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\0f1404f7e898391cfa97e9a4908d4d03_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

    Filesize

    24KB

    MD5

    76aad785a86c51de203c31bfade50003

    SHA1

    073614a7becf9f35e085362dc83a33fb841b2614

    SHA256

    48ac345b8778cbbb189d1dfc243634b842f83d632f8479e6c7d16419a1e70489

    SHA512

    fd1b0e49ef41edde9ff7cfa8fcf25a28c4352317f045732d75ba44daa15540257a35317ea307fb3711f2625daa055ab7a6289968f9df3d1471f02deeeef47f01

  • memory/4904-22-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-93-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-3-0x00007FF87BDF0000-0x00007FF87BE00000-memory.dmp

    Filesize

    64KB

  • memory/4904-5-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-4-0x00007FF87BDF0000-0x00007FF87BE00000-memory.dmp

    Filesize

    64KB

  • memory/4904-6-0x00007FF87BDF0000-0x00007FF87BE00000-memory.dmp

    Filesize

    64KB

  • memory/4904-7-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-8-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-21-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-9-0x00007FF879D30000-0x00007FF879D40000-memory.dmp

    Filesize

    64KB

  • memory/4904-11-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-12-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-13-0x00007FF879D30000-0x00007FF879D40000-memory.dmp

    Filesize

    64KB

  • memory/4904-15-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-14-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-17-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-19-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-1-0x00007FF8BBE0D000-0x00007FF8BBE0E000-memory.dmp

    Filesize

    4KB

  • memory/4904-10-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-2-0x00007FF87BDF0000-0x00007FF87BE00000-memory.dmp

    Filesize

    64KB

  • memory/4904-45-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-23-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-16-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-46-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-47-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-18-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-65-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-0-0x00007FF87BDF0000-0x00007FF87BE00000-memory.dmp

    Filesize

    64KB

  • memory/4904-83-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-84-0x00007FF8BBE0D000-0x00007FF8BBE0E000-memory.dmp

    Filesize

    4KB

  • memory/4904-85-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-86-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-87-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-88-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-89-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-90-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-20-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB

  • memory/4904-94-0x00007FF8BBD70000-0x00007FF8BBF65000-memory.dmp

    Filesize

    2.0MB