Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-06-2024 13:48

General

  • Target

    1639529b874fd4542fe764723a409756_JaffaCakes118.doc

  • Size

    242KB

  • MD5

    1639529b874fd4542fe764723a409756

  • SHA1

    e9b5c172ebe286d1c9f86f728491b789dd0198da

  • SHA256

    3598a4e8f79938a5e94f6c7274d60d0f4670dc73856243ffd915c56094db2126

  • SHA512

    ac574977a296574501e09ad4ce1821e698667b2fa3f088de5313f6edd74d966cfef5f4e9ec60698c0d6d5b18d745be5a893490eba3bfc0cb3df69fc9a0e6c4b9

  • SSDEEP

    1536:9terTkw9HnXPJguq73/IKB5Kby0gchHrTPryiK/dRYpmXWDapCi9iy:9vw9HXPJguq73/IKBWy6ydS0GDk5N

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\1639529b874fd4542fe764723a409756_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:2680
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4716

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

    Filesize

    2KB

    MD5

    23d741b98ac495727afe58fa449c2c21

    SHA1

    80d610de11a2814b3a12ae613ecdcf0f846d3f6c

    SHA256

    f6363140878654e85081158acd1206693da03bcf71a2083500466f78be0b405b

    SHA512

    851afbb5ebc3786ed08518b1f34c0707769dfa2a802d1619636631f09187f33401fcd7a220fe4426251a95ad75f6e0454a86d4e9ebf66f2d6e08d88095d2b402

  • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

    Filesize

    2KB

    MD5

    9a30c24cab12d05f39b6bae121dba340

    SHA1

    d1bc90e587b70bc85c7704ec0270b275af556c5b

    SHA256

    9d0aad9dae588972a3614131f8eea46ba6feee0dcd45d94473c944c27770201d

    SHA512

    849b6644ac67060a7982422203beb40ef51f277d05f964b7101e17ba8c2b796548c9187741a4332942fb53b7f95af153475c09c67dc21b982c20cd8427cab00f

  • C:\Users\Admin\AppData\Local\Temp\TCD8073.tmp\iso690.xsl

    Filesize

    263KB

    MD5

    ff0e07eff1333cdf9fc2523d323dd654

    SHA1

    77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

    SHA256

    3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

    SHA512

    b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

  • memory/2680-10-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/2680-15-0x00007FFBD3FE0000-0x00007FFBD3FF0000-memory.dmp

    Filesize

    64KB

  • memory/2680-6-0x00007FFBD62B0000-0x00007FFBD62C0000-memory.dmp

    Filesize

    64KB

  • memory/2680-4-0x00007FFBD62B0000-0x00007FFBD62C0000-memory.dmp

    Filesize

    64KB

  • memory/2680-7-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/2680-8-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/2680-9-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/2680-2-0x00007FFBD62B0000-0x00007FFBD62C0000-memory.dmp

    Filesize

    64KB

  • memory/2680-14-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/2680-5-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/2680-13-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/2680-12-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/2680-11-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/2680-16-0x00007FFBD3FE0000-0x00007FFBD3FF0000-memory.dmp

    Filesize

    64KB

  • memory/2680-0-0x00007FFBD62B0000-0x00007FFBD62C0000-memory.dmp

    Filesize

    64KB

  • memory/2680-510-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/2680-565-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB

  • memory/2680-1-0x00007FFBD62B0000-0x00007FFBD62C0000-memory.dmp

    Filesize

    64KB

  • memory/2680-3-0x00007FFC162CD000-0x00007FFC162CE000-memory.dmp

    Filesize

    4KB

  • memory/2680-1068-0x00007FFC16230000-0x00007FFC16425000-memory.dmp

    Filesize

    2.0MB