Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-06-2024 23:08

General

  • Target

    13d329065149845e3706de293c4a183a_JaffaCakes118.doc

  • Size

    242KB

  • MD5

    13d329065149845e3706de293c4a183a

  • SHA1

    8177857ff56b180159ff3a2083f6541a84d0ed33

  • SHA256

    ad11eefe614775a7e5473a13cb875d527a669771dd977f015ee1cfb5cdcd2d42

  • SHA512

    aaa2bbf24422216e7b5ffa991764d88c84b2be4bc5b4a493501fd10fa25e03f32784c3f1c6e1836bfd615633fde3bbb78a9e5610a1b09f78c824dbce6a0fdab0

  • SSDEEP

    1536:8terTkw9HnXPJguq73/IKB5Kby0gPFHrTPDyqK/dRYvb+/O7IS+TN0QV2y+N7yzK:8vw9HXPJguq73/IKBWyDydSD+A+Zwr

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\13d329065149845e3706de293c4a183a_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:668
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2264

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

    Filesize

    471B

    MD5

    00c48aa819dbe137d55dde5b2009f124

    SHA1

    f834727c83fa0d07ae014d59592147b32f946055

    SHA256

    3ea61c94b6decd0f5b15fe9503e0de17b33dff1d29d31dc74a9ceab76fe265d9

    SHA512

    340927c0089b4fb3aff2ed918fd0cd101bfe4f0d0ab21d5e277ff1762b753af4490a6e21ce55c75ab019b880cba56ef9ec80b377de09667bea674884ceee5a6e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187

    Filesize

    412B

    MD5

    f9635881058598008ce39073865f2672

    SHA1

    c6a004c80ed28445acb9780f393911a48999fed6

    SHA256

    5b1d44e1c35f143cbb3fa655880b8b34c3e7f4a70427df54470b04455e99ced0

    SHA512

    153a70644067fdc371cfa2bc1aba3fabff8783e213eaff57420081e2860add81d65897d7e2faee0b9801a64d96e1143192f3af79e6d9249d2a967976a4f4a578

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\FCFF30E2-354F-47F3-B89D-2783D727A80C

    Filesize

    168KB

    MD5

    274d9b2cbe840c9026f84c4be2a71459

    SHA1

    1d3d4be6c23c5b59bf4b1c5b01d10ae992f8a86c

    SHA256

    4d691f06cd0b833440e0836145c28739f7fdf174a98c83f52b63783f3981b177

    SHA512

    ee0e7502a3e656d5b87841f5bc419840cf7b7b298d74c966e4adc3402ea703eb11f6b1bc31b48bb58e0354b9c2cd83f0023df309a1ab55f9d0e262c19eed2c27

  • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

    Filesize

    2KB

    MD5

    efe3b625694c288f70c10bdd21426684

    SHA1

    97b74604ab26d11fb6b1eadb4719ba9c406980c7

    SHA256

    392bc9100c9cd1f0359dbecfe2b5b0bd00cf9e1e83f779e7cc7d5587dd5b53c7

    SHA512

    1f24458b18ab7fc6343594a0f6d1a2ef5f05c973509343fddf34616dc988e9bc3d0f9a7b74f659f7d2a37910597bed5483e4c697cf75871536a14de445336454

  • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

    Filesize

    2KB

    MD5

    77cdbc6836d884c9c20756699c257257

    SHA1

    64feec4fed7bf5561fb25b55c3d4d858b5599c52

    SHA256

    d3e33b47545ef7f58468b5caa7462f0953f1787b74d7f88cb0e6346ad2669583

    SHA512

    1d8d3e640dc619f4ad25a65632317db76ab3d023dc5d8e1d1c54fd9a244e3bdad311b17764450fa26162ddbe33d3894502567e4a2acba4b56a5f812b62e3369e

  • C:\Users\Admin\AppData\Local\Temp\TCD85E3.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • memory/668-16-0x00007FFEDFBC0000-0x00007FFEDFBD0000-memory.dmp

    Filesize

    64KB

  • memory/668-22-0x00007FFF22130000-0x00007FFF22325000-memory.dmp

    Filesize

    2.0MB

  • memory/668-10-0x00007FFF22130000-0x00007FFF22325000-memory.dmp

    Filesize

    2.0MB

  • memory/668-9-0x00007FFF22130000-0x00007FFF22325000-memory.dmp

    Filesize

    2.0MB

  • memory/668-8-0x00007FFF22130000-0x00007FFF22325000-memory.dmp

    Filesize

    2.0MB

  • memory/668-14-0x00007FFEDFBC0000-0x00007FFEDFBD0000-memory.dmp

    Filesize

    64KB

  • memory/668-13-0x00007FFF22130000-0x00007FFF22325000-memory.dmp

    Filesize

    2.0MB

  • memory/668-12-0x00007FFF22130000-0x00007FFF22325000-memory.dmp

    Filesize

    2.0MB

  • memory/668-11-0x00007FFF22130000-0x00007FFF22325000-memory.dmp

    Filesize

    2.0MB

  • memory/668-15-0x00007FFF22130000-0x00007FFF22325000-memory.dmp

    Filesize

    2.0MB

  • memory/668-1-0x00007FFEE21B0000-0x00007FFEE21C0000-memory.dmp

    Filesize

    64KB

  • memory/668-19-0x00007FFF22130000-0x00007FFF22325000-memory.dmp

    Filesize

    2.0MB

  • memory/668-20-0x00007FFF22130000-0x00007FFF22325000-memory.dmp

    Filesize

    2.0MB

  • memory/668-7-0x00007FFF22130000-0x00007FFF22325000-memory.dmp

    Filesize

    2.0MB

  • memory/668-21-0x00007FFF22130000-0x00007FFF22325000-memory.dmp

    Filesize

    2.0MB

  • memory/668-18-0x00007FFF22130000-0x00007FFF22325000-memory.dmp

    Filesize

    2.0MB

  • memory/668-17-0x00007FFF22130000-0x00007FFF22325000-memory.dmp

    Filesize

    2.0MB

  • memory/668-6-0x00007FFF22130000-0x00007FFF22325000-memory.dmp

    Filesize

    2.0MB

  • memory/668-516-0x00007FFF22130000-0x00007FFF22325000-memory.dmp

    Filesize

    2.0MB

  • memory/668-571-0x00007FFF22130000-0x00007FFF22325000-memory.dmp

    Filesize

    2.0MB

  • memory/668-5-0x00007FFF221CD000-0x00007FFF221CE000-memory.dmp

    Filesize

    4KB

  • memory/668-4-0x00007FFEE21B0000-0x00007FFEE21C0000-memory.dmp

    Filesize

    64KB

  • memory/668-3-0x00007FFEE21B0000-0x00007FFEE21C0000-memory.dmp

    Filesize

    64KB

  • memory/668-0-0x00007FFEE21B0000-0x00007FFEE21C0000-memory.dmp

    Filesize

    64KB

  • memory/668-2-0x00007FFEE21B0000-0x00007FFEE21C0000-memory.dmp

    Filesize

    64KB

  • memory/668-1073-0x00007FFF22130000-0x00007FFF22325000-memory.dmp

    Filesize

    2.0MB