Analysis

  • max time kernel
    102s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-07-2024 16:27

General

  • Target

    6c2823f90322d1f0f6bccda71490485a_JaffaCakes118.doc

  • Size

    44KB

  • MD5

    6c2823f90322d1f0f6bccda71490485a

  • SHA1

    faecd289e11103cb2c4b3f2ce03933ba348d764a

  • SHA256

    a0e4e73ae659b896893702a2f0f2ed251a89103cf2d0fc8235dc4d639f63fe1e

  • SHA512

    65d14ad30072f2dda8a0473d096fe76abe76cafc2ff41a6985bfa3ec4c79b080119996b9cc649fef8e158f436decb7e7fde589e5ad6940bd4fee885097957d38

  • SSDEEP

    384:lxwHTZzB1vdBmrb3ilC5mijXjfk0t6VV:lcTZB1vdArriA5mYk1

Malware Config

Signatures

  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

  • Deletes itself 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\6c2823f90322d1f0f6bccda71490485a_JaffaCakes118.doc" /o ""
    1⤵
    • Deletes itself
    • Checks processor information in registry
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4652

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B13BBA2F.wmf

    Filesize

    880B

    MD5

    0522d8dcdc9860ea7f4b9966c5d466b9

    SHA1

    7dd16a4d0159a3c2bc81fdb7893a0ebdf925bdc1

    SHA256

    80742dade91f8c7521277ea827aa93e8a13d100997a24f9afb4e3568224cb8d0

    SHA512

    0ab2c5abbf5823d36d452440d1f0d8dd1e0f297855dbb8536de9eccad29e62c2585f81fd2f3f6e804221421f011482b10f402645ae0784dd550269452c5c6c08

  • C:\Users\Admin\AppData\Local\Temp\TCDEE4F.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • C:\Users\Admin\AppData\Local\Temp\~WRD0002.tmp

    Filesize

    49KB

    MD5

    8dced94f1a50bd9930af23ff6d334064

    SHA1

    31245be06bf6a61003bccf462a355e3a86d8f8f5

    SHA256

    9d416e977dbb4de19ecedbac21f1ffc5e2523d4debbf41834dc255ca3a5c9fba

    SHA512

    2a0d869cdba147b35c0580eee104005d5a74a9ba230e4fd2686078fc1dcab2b9f4ce76a42adbcfd22212bce802875e93e1121ccb39d11b8459d67fdfc6dbf02f

  • C:\Users\Admin\AppData\Local\Temp\~WRD0004.tmp

    Filesize

    50KB

    MD5

    a43fdb2e31fb314aca78134b478830e5

    SHA1

    583fea9d0f142bdaba9a5cfaaa972fc0d118fd01

    SHA256

    947fcff569c7db5ff1a4afee14a794782e76b620a612d7f3a7ec2ba5885c423e

    SHA512

    5be9d321ddb3382f4811a4b0e73527a7e417e82b0a02bcaea2a782d06502431f84bd6f6d4b3960683a0783defc47abcd4a8b806bcf03a1acdc0a01571f413f71

  • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

    Filesize

    24KB

    MD5

    d78e920fae880b5d06a1d5cfc4f5df71

    SHA1

    4537ba8ce40a18f083a14f36ca0d412784b4c3fe

    SHA256

    4ae18bd6d42caa69143b60732c0cc00ab8e96772811154c14292bcf73ca72842

    SHA512

    497144b23d1734ea8ab4dfbec415217d6ce0ed178e97ad292c4e9909109328af60c6753bf91874294d551f28d008665832fec6e1ff2b9204421f725f2cfe16f2

  • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\~WRD3054.tmp

    Filesize

    27KB

    MD5

    61e9996bcebb8ef3c3ff30b9b659dd6e

    SHA1

    63c294fea04986068b6ad3b481753b94923c2ef6

    SHA256

    a8f3eb3a0568623f8f9635cb793032398ac0c6f5c143e387e8e3257ea8288472

    SHA512

    90fb346ff7d193ac78b1ded3dc822e9732a2a1a74649503aad649f2baa4c7f8e25b8675a83f80685dd03abb5906c230cbbb75fa57926bee2e359492aa51c66e7

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

    Filesize

    4KB

    MD5

    dc7a588575aeed7e2cd7581c050c49fd

    SHA1

    81b1a059724af7f27d5bc8321df0692095825b04

    SHA256

    2e7efc952be8dd4e5d09a171a219e0386376118a1920aa1fdb370f56eb77f634

    SHA512

    318e3e524c7b3d30f6de842ca58e3ebfe2ec4a205c543e0872b99c55beda4b04fc9bacc4fe2659d5741335e9d9533ce65a3c0377050ec31c4983da715fed4ea1

  • memory/4652-6-0x00007FFAEFF90000-0x00007FFAF0185000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-9-0x00007FFAEFF90000-0x00007FFAF0185000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-14-0x00007FFAEFF90000-0x00007FFAF0185000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-15-0x00007FFAEFF90000-0x00007FFAF0185000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-13-0x00007FFAEFF90000-0x00007FFAF0185000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-16-0x00007FFAAD8F0000-0x00007FFAAD900000-memory.dmp

    Filesize

    64KB

  • memory/4652-18-0x00007FFAEFF90000-0x00007FFAF0185000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-17-0x00007FFAEFF90000-0x00007FFAF0185000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-12-0x00007FFAEFF90000-0x00007FFAF0185000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-11-0x00007FFAEFF90000-0x00007FFAF0185000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-8-0x00007FFAEFF90000-0x00007FFAF0185000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-2-0x00007FFAB0010000-0x00007FFAB0020000-memory.dmp

    Filesize

    64KB

  • memory/4652-19-0x00007FFAAD8F0000-0x00007FFAAD900000-memory.dmp

    Filesize

    64KB

  • memory/4652-45-0x00007FFAEFF90000-0x00007FFAF0185000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-61-0x00007FFAEFF90000-0x00007FFAF0185000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-10-0x00007FFAEFF90000-0x00007FFAF0185000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-7-0x00007FFAEFF90000-0x00007FFAF0185000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-5-0x00007FFAF002D000-0x00007FFAF002E000-memory.dmp

    Filesize

    4KB

  • memory/4652-4-0x00007FFAB0010000-0x00007FFAB0020000-memory.dmp

    Filesize

    64KB

  • memory/4652-3-0x00007FFAB0010000-0x00007FFAB0020000-memory.dmp

    Filesize

    64KB

  • memory/4652-229-0x00007FFAEFF90000-0x00007FFAF0185000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-230-0x00007FFAEFF90000-0x00007FFAF0185000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-231-0x00007FFAEFF90000-0x00007FFAF0185000-memory.dmp

    Filesize

    2.0MB

  • memory/4652-0-0x00007FFAB0010000-0x00007FFAB0020000-memory.dmp

    Filesize

    64KB

  • memory/4652-1-0x00007FFAB0010000-0x00007FFAB0020000-memory.dmp

    Filesize

    64KB

  • memory/4652-393-0x00007FFAB0010000-0x00007FFAB0020000-memory.dmp

    Filesize

    64KB

  • memory/4652-392-0x00007FFAB0010000-0x00007FFAB0020000-memory.dmp

    Filesize

    64KB

  • memory/4652-395-0x00007FFAB0010000-0x00007FFAB0020000-memory.dmp

    Filesize

    64KB

  • memory/4652-394-0x00007FFAB0010000-0x00007FFAB0020000-memory.dmp

    Filesize

    64KB

  • memory/4652-396-0x00007FFAEFF90000-0x00007FFAF0185000-memory.dmp

    Filesize

    2.0MB