Analysis

  • max time kernel
    144s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-07-2024 09:07

General

  • Target

    21ce00d622877fc17ab7474e2cc53c1f_JaffaCakes118.doc

  • Size

    242KB

  • MD5

    21ce00d622877fc17ab7474e2cc53c1f

  • SHA1

    80127c722fb316526e25cb8ee8aaf2c91b314b6c

  • SHA256

    cedbcfc1e63f7b97831c6dc4a3b01be92d7223597b622fc41bfb64301a026de8

  • SHA512

    b952e8f7c2e8d8c275583d80893d26c71714889e50dc97fa2aab1f17dee2a76cb7e0edd87a5dd80721a62c7178c42c06a4bcbf56f396b5c0ef1d68ae176dc9b8

  • SSDEEP

    3072:Cvw9HXPJguq73/IKBWyfUdSiPEhXe/gvM:CvKHXPJi73wA2UHhOyM

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\21ce00d622877fc17ab7474e2cc53c1f_JaffaCakes118.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4652
  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4480

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\F8119FA5-2540-479A-87E8-8DF6455301F5

    Filesize

    168KB

    MD5

    c10d85522c9b54b166d60d450fde3d7c

    SHA1

    6d4cbbea0df6be28a8af5dfa829e3f9008ded5e9

    SHA256

    eba91c3ac01bafa8b6f5bf99ac5e0cbfca41a1955a63fddbdedb8954b5cb39a0

    SHA512

    389bbfa4977e35c3c2b3ceab2f4227e5f8950e6d6648b7fac5979cd6c9c243f3ea22b13c880167310e5b5b1a22e15f8cf7dda52ea764d7a2135d271205e09705

  • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

    Filesize

    2KB

    MD5

    bd633821a007a91f605fc491a57fe3cf

    SHA1

    d9858eaf220ea3aac67705ece116123a0f6aca17

    SHA256

    ff567c8202ce2ff15783daf82c03c1e3a6a46afe85861b64e9856b5fa8f04b91

    SHA512

    98ebf0ad725db6d4ce5e81e017bcd152974e535129e17f55f407b042d5a4cd825006be3ed9df90bf80c6b9bfb1490f3425209e1e2f2b415853c2906a2d4db7ee

  • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

    Filesize

    2KB

    MD5

    e925d6ec33e5cd744d5193d9eb0a3260

    SHA1

    d206f754a13a229f5b8b1f891723281c00176e54

    SHA256

    aa11cf4869e3027ad07b06924a563c3bb34473af6cbb799dd8e096d528feab57

    SHA512

    a6a135d59b2b536105729cb7838bda7ac0ae76eee3ac96c23173a1b717460b0905b48a25f91aa9e416cf48ea64a7c6040e22ffafe63a68acbba1040033188c11

  • C:\Users\Admin\AppData\Local\Temp\TCD863A.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • memory/4652-14-0x00007FFB365B0000-0x00007FFB367A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-21-0x00007FFB365B0000-0x00007FFB367A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-6-0x00007FFB365B0000-0x00007FFB367A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-7-0x00007FFB365B0000-0x00007FFB367A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-8-0x00007FFB365B0000-0x00007FFB367A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-9-0x00007FFB365B0000-0x00007FFB367A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-11-0x00007FFB365B0000-0x00007FFB367A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-10-0x00007FFAF3E50000-0x00007FFAF3E60000-memory.dmp

    Filesize

    64KB

  • memory/4652-12-0x00007FFAF3E50000-0x00007FFAF3E60000-memory.dmp

    Filesize

    64KB

  • memory/4652-13-0x00007FFB365B0000-0x00007FFB367A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-1-0x00007FFAF6630000-0x00007FFAF6640000-memory.dmp

    Filesize

    64KB

  • memory/4652-16-0x00007FFB365B0000-0x00007FFB367A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-18-0x00007FFB365B0000-0x00007FFB367A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-5-0x00007FFB3664D000-0x00007FFB3664E000-memory.dmp

    Filesize

    4KB

  • memory/4652-20-0x00007FFB365B0000-0x00007FFB367A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-19-0x00007FFB365B0000-0x00007FFB367A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-15-0x00007FFB365B0000-0x00007FFB367A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-17-0x00007FFB365B0000-0x00007FFB367A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-38-0x00007FFB365B0000-0x00007FFB367A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-4-0x00007FFAF6630000-0x00007FFAF6640000-memory.dmp

    Filesize

    64KB

  • memory/4652-570-0x00007FFB365B0000-0x00007FFB367A5000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-0-0x00007FFAF6630000-0x00007FFAF6640000-memory.dmp

    Filesize

    64KB

  • memory/4652-3-0x00007FFAF6630000-0x00007FFAF6640000-memory.dmp

    Filesize

    64KB

  • memory/4652-2-0x00007FFAF6630000-0x00007FFAF6640000-memory.dmp

    Filesize

    64KB

  • memory/4652-1074-0x00007FFB365B0000-0x00007FFB367A5000-memory.dmp

    Filesize

    2.0MB