Analysis

  • max time kernel
    107s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-06-2024 01:47

General

  • Target

    105009eac4890719b2811e55feedd52d_JaffaCakes118.doc

  • Size

    132KB

  • MD5

    105009eac4890719b2811e55feedd52d

  • SHA1

    eb1b641c9ec0f4f0fe7e0abee59e5aa187123765

  • SHA256

    30f99223ffd816be005e624575e8b4c1e7cb58951de9eb165e554139fa00e092

  • SHA512

    35e0065dfc4fb856a49b1a019ac1e0d003220d6a74a66e679dab20b7fd994cb830cab73417e774d2cb5ca1b980eea329186c11ad9805346e05f9ba1a2555c007

  • SSDEEP

    768:X6WzhXbXI3Lyb3PodHPTT8By+BFOguu8z0AZxvm8j12ob:d5b6LyzgLTOOgH85vfhb

Malware Config

Signatures

  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

  • Deletes itself 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\105009eac4890719b2811e55feedd52d_JaffaCakes118.doc" /o ""
    1⤵
    • Deletes itself
    • Checks processor information in registry
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCDD324.tmp\gb.xsl

    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

  • C:\Users\Admin\AppData\Local\Temp\~WRD0000.tmp

    Filesize

    151KB

    MD5

    34550d36c85c2d3d4ff5539eea54bf67

    SHA1

    5ff0888f82068ec43736fbad566828a93e218176

    SHA256

    fec08e3e5a6ca0f3328dcf8112978f15a256f6f774f0571131144411fa75ae2b

    SHA512

    c2de7cea5841ca3e4cd09e5dec798d713d0cbda54cebc4c7de194bc5fae2d7ee69e89d4d3046aab3fd30268677c98c8c19eaf0e8aac284ace9a0bb770ddc48c9

  • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\~WRD0002.tmp

    Filesize

    46KB

    MD5

    57cbbcef68b70c4dba6147fb99ff6427

    SHA1

    8f00e69d6702c324bfc8ad79e88fe267f4df5987

    SHA256

    f44198d317f95ba6ad03ba7b4cde60029bc249d69bb81771c48969ed28feb7ee

    SHA512

    688b5ecd160ef8c3fb4a1c278bd904590c9a80570810f31275b81b733b81f935001991ae795eff2d6a1a7ce8672a3f01ebaea893e4b788d6b086ae63acd36564

  • memory/4988-18-0x00007FFEA0370000-0x00007FFEA0380000-memory.dmp

    Filesize

    64KB

  • memory/4988-11-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-5-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

    Filesize

    64KB

  • memory/4988-20-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-8-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-7-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-9-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-19-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-10-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-12-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-13-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-14-0x00007FFEA0370000-0x00007FFEA0380000-memory.dmp

    Filesize

    64KB

  • memory/4988-15-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-37-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-16-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-0-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

    Filesize

    64KB

  • memory/4988-6-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-4-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

    Filesize

    64KB

  • memory/4988-17-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-54-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-60-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-61-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-62-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-63-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-64-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

    Filesize

    2.0MB

  • memory/4988-3-0x00007FFEE23ED000-0x00007FFEE23EE000-memory.dmp

    Filesize

    4KB

  • memory/4988-1-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

    Filesize

    64KB

  • memory/4988-2-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

    Filesize

    64KB

  • memory/4988-607-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

    Filesize

    64KB

  • memory/4988-608-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

    Filesize

    64KB

  • memory/4988-610-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

    Filesize

    64KB

  • memory/4988-609-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

    Filesize

    64KB

  • memory/4988-611-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

    Filesize

    2.0MB