Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
03-07-2024 09:07
Behavioral task
behavioral1
Sample
21ce00d622877fc17ab7474e2cc53c1f_JaffaCakes118.doc
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
21ce00d622877fc17ab7474e2cc53c1f_JaffaCakes118.doc
Resource
win10v2004-20240611-en
General
-
Target
21ce00d622877fc17ab7474e2cc53c1f_JaffaCakes118.doc
-
Size
242KB
-
MD5
21ce00d622877fc17ab7474e2cc53c1f
-
SHA1
80127c722fb316526e25cb8ee8aaf2c91b314b6c
-
SHA256
cedbcfc1e63f7b97831c6dc4a3b01be92d7223597b622fc41bfb64301a026de8
-
SHA512
b952e8f7c2e8d8c275583d80893d26c71714889e50dc97fa2aab1f17dee2a76cb7e0edd87a5dd80721a62c7178c42c06a4bcbf56f396b5c0ef1d68ae176dc9b8
-
SSDEEP
3072:Cvw9HXPJguq73/IKBWyfUdSiPEhXe/gvM:CvKHXPJi73wA2UHhOyM
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEEXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 6 IoCs
Processes:
EXCEL.EXEWINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4652 WINWORD.EXE 4652 WINWORD.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
EXCEL.EXEdescription pid process Token: SeAuditPrivilege 4480 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
WINWORD.EXEEXCEL.EXEpid process 4652 WINWORD.EXE 4652 WINWORD.EXE 4652 WINWORD.EXE 4652 WINWORD.EXE 4652 WINWORD.EXE 4652 WINWORD.EXE 4652 WINWORD.EXE 4480 EXCEL.EXE 4480 EXCEL.EXE 4480 EXCEL.EXE 4480 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\21ce00d622877fc17ab7474e2cc53c1f_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4652
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4480
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\F8119FA5-2540-479A-87E8-8DF6455301F5
Filesize168KB
MD5c10d85522c9b54b166d60d450fde3d7c
SHA16d4cbbea0df6be28a8af5dfa829e3f9008ded5e9
SHA256eba91c3ac01bafa8b6f5bf99ac5e0cbfca41a1955a63fddbdedb8954b5cb39a0
SHA512389bbfa4977e35c3c2b3ceab2f4227e5f8950e6d6648b7fac5979cd6c9c243f3ea22b13c880167310e5b5b1a22e15f8cf7dda52ea764d7a2135d271205e09705
-
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Filesize2KB
MD5bd633821a007a91f605fc491a57fe3cf
SHA1d9858eaf220ea3aac67705ece116123a0f6aca17
SHA256ff567c8202ce2ff15783daf82c03c1e3a6a46afe85861b64e9856b5fa8f04b91
SHA51298ebf0ad725db6d4ce5e81e017bcd152974e535129e17f55f407b042d5a4cd825006be3ed9df90bf80c6b9bfb1490f3425209e1e2f2b415853c2906a2d4db7ee
-
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
Filesize2KB
MD5e925d6ec33e5cd744d5193d9eb0a3260
SHA1d206f754a13a229f5b8b1f891723281c00176e54
SHA256aa11cf4869e3027ad07b06924a563c3bb34473af6cbb799dd8e096d528feab57
SHA512a6a135d59b2b536105729cb7838bda7ac0ae76eee3ac96c23173a1b717460b0905b48a25f91aa9e416cf48ea64a7c6040e22ffafe63a68acbba1040033188c11
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e