Overview
overview
7Static
static
32ee36c351e...18.exe
windows7-x64
72ee36c351e...18.exe
windows10-2004-x64
7$PLUGINSDI...LA.rtf
windows7-x64
4$PLUGINSDI...LA.rtf
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ms.rtf
windows7-x64
4$PLUGINSDI...ms.rtf
windows10-2004-x64
1$PLUGINSDI...h1.exe
windows7-x64
7$PLUGINSDI...h1.exe
windows10-2004-x64
7$PLUGINSDI...Ex.dll
windows7-x64
3$PLUGINSDI...Ex.dll
windows10-2004-x64
3$PLUGINSDI...ad.dll
windows7-x64
3$PLUGINSDI...ad.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...es.dll
windows7-x64
3$PLUGINSDI...es.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...ef.dll
windows7-x64
3$PLUGINSDI...ef.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$_34_/exte...st.dll
windows7-x64
1$_34_/exte...st.dll
windows10-2004-x64
1content/facemoods.js
windows7-x64
3content/facemoods.js
windows10-2004-x64
3content/mtstart.js
windows7-x64
3content/mtstart.js
windows10-2004-x64
3Analysis
-
max time kernel
100s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240708-en -
resource tags
arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system -
submitted
09-07-2024 03:45
Static task
static1
Behavioral task
behavioral1
Sample
2ee36c351e2018158b9c56858498ca90_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2ee36c351e2018158b9c56858498ca90_JaffaCakes118.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/EZT_EULA.rtf
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/EZT_EULA.rtf
Resource
win10v2004-20240708-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/facemoods_terms.rtf
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/facemoods_terms.rtf
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/facemoods_w7th1.exe
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/facemoods_w7th1.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/ExtractDLLEx.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/ExtractDLLEx.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/InetLoad.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/InetLoad.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/Processes.dll
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/Processes.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240708-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/chrmPref.dll
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/chrmPref.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral27
Sample
$_34_/extensions/[email protected]/components/FFHst.dll
Resource
win7-20240704-en
Behavioral task
behavioral28
Sample
$_34_/extensions/[email protected]/components/FFHst.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral29
Sample
content/facemoods.js
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
content/facemoods.js
Resource
win10v2004-20240704-en
Behavioral task
behavioral31
Sample
content/mtstart.js
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
content/mtstart.js
Resource
win10v2004-20240704-en
General
-
Target
$PLUGINSDIR/EZT_EULA.rtf
-
Size
62KB
-
MD5
3584a8d7f66ffad1b321d682bdd71c12
-
SHA1
88e7aed78aa695f34200bab80d2686770f8a8d0d
-
SHA256
482a0dc0ecd1099bc772e3021907635ad53164897dcd3c97d86eda4d00a7a719
-
SHA512
48a68cc55c006d4eef7cc4c334ccf3caaa4af2aa966157ba3b08eaaabe4f3093ef05745d5e80e342a37a383be0112bbb28f9031977d9e495ea9e09591dd935b4
-
SSDEEP
384:AGtwgDrN79ozVzEFHQezWf4RnDQg4so6iETJTPwa54vg3Rvjlyb3OEi6rGsNAYAG:AG7QezWwnDQgxPiKvjlc7hAZqCM
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2132 WINWORD.EXE 2132 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2132 WINWORD.EXE 2132 WINWORD.EXE 2132 WINWORD.EXE 2132 WINWORD.EXE 2132 WINWORD.EXE 2132 WINWORD.EXE 2132 WINWORD.EXE 2132 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\EZT_EULA.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2132
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize1KB
MD5f260fa104b3458305de56409d17c848b
SHA150252d41dab7db4837e8b75e427e821511800be9
SHA2568dfbe56eeb112a8be417cbe7b2568a78161ea409af371dc050ded362d212fa6e
SHA5128da4756c062dd227f4425a8e9cb5360979390beeca3ee3d1d3b06ede88e8373d9962055c17ccce5cf7f0a15de052dde3b8845a99669bd12c8f8c27e43b8c3630