Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-06-2024 04:40

General

  • Target

    14b6e358fa83990ded4e40dea72748ac_JaffaCakes118.doc

  • Size

    241KB

  • MD5

    14b6e358fa83990ded4e40dea72748ac

  • SHA1

    7279cc1d21130efd443a0b4e5b12f65b1ee3d69f

  • SHA256

    740e3991a1d9178a251a1f0fa3733182207382cc077818cfe1db2302849b9ff9

  • SHA512

    8cb5eeb514497a783d88c1d5bd011ece7e12073cebd8eaef7eeb35db96deedced08985e5e92fdd50c6fd06e7b5ecd33d5c16ecf248b338dbfd414052fb39f9e1

  • SSDEEP

    3072:Svw9HXPJguq73/IKBWySSdSAG4AaODz4wfyAVZ:SvKHXPJi73wAHUAG4if4KyAVZ

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\14b6e358fa83990ded4e40dea72748ac_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1520
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3316

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\8363E098-82D6-4E81-B97E-01C296AB69FC

    Filesize

    168KB

    MD5

    7edbc540f87790faae94e29f7c9d15eb

    SHA1

    37d76638a198d2640b8b76a9cac32051692d7ff8

    SHA256

    118e515ce8394d35ca70a82742482d12580ff40bed73760fd05e49f0599986e4

    SHA512

    fd0b357ff5c592815432820ddce29ed5eb5a50cda2b12fce566551d6be267c612f732ddd48fc680c11ab0e8272f9b981917f375361d39424f1c74692cd57c10e

  • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

    Filesize

    2KB

    MD5

    664f3472b57679776730008dde296e13

    SHA1

    5e8a5ecd1a1e5d6177c3f128d9a9672750913656

    SHA256

    9412614eba3226480d7148d979a42c718db1fc55042fef2e03e4a09767150e99

    SHA512

    e07bd660f9c1742a8ebd5a26f0c11702e758ad49e95b94a3d8d55d1413a092910e5999704b88b4954ffb49a4c10603c4a218bceafa7839d64f5ec0964b36eb60

  • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

    Filesize

    2KB

    MD5

    55e82e57fac258007e92774c55e01219

    SHA1

    abc76b37cca7c0443a838df971e75f2ed90c7ba7

    SHA256

    040fe7e36e788261f9eef93bb94be6167c98ececf2531ea2876a6dbfc2d9b17d

    SHA512

    e30798f57e32a5b6fcce0a47cef6a71bc606a2fc07472fff00a35398436d27cace5d37ae1b98615b8666ec7df561e179613ae33ca11c9e7ac29145e65ffc8d7f

  • C:\Users\Admin\AppData\Local\Temp\TCD95EE.tmp\gb.xsl

    Filesize

    262KB

    MD5

    51d32ee5bc7ab811041f799652d26e04

    SHA1

    412193006aa3ef19e0a57e16acf86b830993024a

    SHA256

    6230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97

    SHA512

    5fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810

  • memory/1520-20-0x00007FFAF94D0000-0x00007FFAF96C5000-memory.dmp

    Filesize

    2.0MB

  • memory/1520-21-0x00007FFAB6E80000-0x00007FFAB6E90000-memory.dmp

    Filesize

    64KB

  • memory/1520-6-0x00007FFAB9550000-0x00007FFAB9560000-memory.dmp

    Filesize

    64KB

  • memory/1520-8-0x00007FFAF94D0000-0x00007FFAF96C5000-memory.dmp

    Filesize

    2.0MB

  • memory/1520-7-0x00007FFAF94D0000-0x00007FFAF96C5000-memory.dmp

    Filesize

    2.0MB

  • memory/1520-10-0x00007FFAF94D0000-0x00007FFAF96C5000-memory.dmp

    Filesize

    2.0MB

  • memory/1520-9-0x00007FFAF94D0000-0x00007FFAF96C5000-memory.dmp

    Filesize

    2.0MB

  • memory/1520-11-0x00007FFAB6E80000-0x00007FFAB6E90000-memory.dmp

    Filesize

    64KB

  • memory/1520-13-0x00007FFAF94D0000-0x00007FFAF96C5000-memory.dmp

    Filesize

    2.0MB

  • memory/1520-12-0x00007FFAF94D0000-0x00007FFAF96C5000-memory.dmp

    Filesize

    2.0MB

  • memory/1520-17-0x00007FFAF94D0000-0x00007FFAF96C5000-memory.dmp

    Filesize

    2.0MB

  • memory/1520-18-0x00007FFAF94D0000-0x00007FFAF96C5000-memory.dmp

    Filesize

    2.0MB

  • memory/1520-0-0x00007FFAB9550000-0x00007FFAB9560000-memory.dmp

    Filesize

    64KB

  • memory/1520-5-0x00007FFAF94D0000-0x00007FFAF96C5000-memory.dmp

    Filesize

    2.0MB

  • memory/1520-19-0x00007FFAF94D0000-0x00007FFAF96C5000-memory.dmp

    Filesize

    2.0MB

  • memory/1520-16-0x00007FFAF94D0000-0x00007FFAF96C5000-memory.dmp

    Filesize

    2.0MB

  • memory/1520-15-0x00007FFAF94D0000-0x00007FFAF96C5000-memory.dmp

    Filesize

    2.0MB

  • memory/1520-14-0x00007FFAF94D0000-0x00007FFAF96C5000-memory.dmp

    Filesize

    2.0MB

  • memory/1520-2-0x00007FFAB9550000-0x00007FFAB9560000-memory.dmp

    Filesize

    64KB

  • memory/1520-515-0x00007FFAF94D0000-0x00007FFAF96C5000-memory.dmp

    Filesize

    2.0MB

  • memory/1520-517-0x00007FFAF94D0000-0x00007FFAF96C5000-memory.dmp

    Filesize

    2.0MB

  • memory/1520-516-0x00007FFAF956D000-0x00007FFAF956E000-memory.dmp

    Filesize

    4KB

  • memory/1520-518-0x00007FFAF94D0000-0x00007FFAF96C5000-memory.dmp

    Filesize

    2.0MB

  • memory/1520-573-0x00007FFAF94D0000-0x00007FFAF96C5000-memory.dmp

    Filesize

    2.0MB

  • memory/1520-1-0x00007FFAF956D000-0x00007FFAF956E000-memory.dmp

    Filesize

    4KB

  • memory/1520-3-0x00007FFAB9550000-0x00007FFAB9560000-memory.dmp

    Filesize

    64KB

  • memory/1520-4-0x00007FFAB9550000-0x00007FFAB9560000-memory.dmp

    Filesize

    64KB

  • memory/1520-1076-0x00007FFAF94D0000-0x00007FFAF96C5000-memory.dmp

    Filesize

    2.0MB