Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    24-07-2024 20:29

General

  • Target

    6ca9f5d9b0304bc3a8246cf86e6db21f_JaffaCakes118.doc

  • Size

    239KB

  • MD5

    6ca9f5d9b0304bc3a8246cf86e6db21f

  • SHA1

    7df607ec1c90746aa90f3ea2555dd4cae9f61766

  • SHA256

    d4654f010021371fe8cb182fc484cdece66f681ed7335e79befa145a21ef3079

  • SHA512

    e20dcb927ba4071afd16043ab40b6052aed1e8dd69f73a1303e2fa8e1c89d33970c19b9cd1a941d5b99889eeebbfe2864c34bb27641bc556fae7c72e476c387a

  • SSDEEP

    3072:X/wDvWETOgnHJcIKBs7iEdSqctNi7n4mwL:X/avWETrHJ9AGUNt074mK

Score
7/10

Malware Config

Signatures

  • Abuses OpenXML format to download file from external location 4 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Office loads VBA resources, possible macro or embedded object present
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\6ca9f5d9b0304bc3a8246cf86e6db21f_JaffaCakes118.doc"
    1⤵
    • Abuses OpenXML format to download file from external location
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2772
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
      1⤵
      • Abuses OpenXML format to download file from external location
      • System Location Discovery: System Language Discovery
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:320
    • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
      1⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:2976
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
      1⤵
      • Abuses OpenXML format to download file from external location
      • System Location Discovery: System Language Discovery
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1296
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
      1⤵
      • Abuses OpenXML format to download file from external location
      • System Location Discovery: System Language Discovery
      • Enumerates system info in registry
      • Suspicious use of SetWindowsHookEx
      PID:2632

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD

      Filesize

      128KB

      MD5

      8fc152567be194945b5c85e4c5fa8dd2

      SHA1

      347f08e5e629515ee8070d6fd72bcf15b4b64255

      SHA256

      97500d2645250df28478f3e5807cfe2407cbca04720b6a0cd76a24d08edae32a

      SHA512

      b065b8baf2a536510e6ec5a589c35dbabdb2d217e04f0aa07e7d5fcf293b39007d37cf9458ed7bc7e923df6a882ed589a1a4b14fa8406974614d20a5561bde7e

    • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{50091F95-9968-48BE-B165-E1C3126FECAD}.FSD

      Filesize

      128KB

      MD5

      7b806de852ca2d405b8fab032436a95c

      SHA1

      38139c7209b5f3fbc66f8c0382c52b94470e4e97

      SHA256

      7bf86b1ab3ae3e11521e477d69d99b24fb61fac964ca2b46b2f74f2126e558c6

      SHA512

      9334387e75be22b97a01171ad9d3d8ba0a0921cc66a7bf90d7cc8fba8e234260a7002859cf8176edadef67a2e45b340ad189af32150b3c4cda7d67c112625322

    • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{50091F95-9968-48BE-B165-E1C3126FECAD}.FSD

      Filesize

      128KB

      MD5

      cfed8878710af2c3a794834333c8b94b

      SHA1

      766111a646fbd14a484b8f204d492807c88b7a60

      SHA256

      2ccdd7d6c8b55702a01b29ed8765e7280d69fe0b23ac9079df9d11fb3ba79187

      SHA512

      36e55a319fed2508843f9a85416b13e2e675da191e9190557baefc24d636f3def7331f7c236df059f3882a595acf4f59948a32faf8509895caa317e955d4e9ec

    • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSF-CTBL.FSF

      Filesize

      114B

      MD5

      ed1d14aa4d104a7234f041e969cf6503

      SHA1

      f5a3002e6dc1967e49b9cdd704c8d510181c5e0a

      SHA256

      6cc0567b202d3ff0c91be8cc4a49e7e4b3d56a2d947b4b46a97f829e7b7e1e5d

      SHA512

      e1aedafc9b85f415359a762d31a61133ef5101589ce8c8340ef059bdc5fea69c30047572c2b820cb4f0bc2176368378e3e59e8026ce4d03997dc4583cd8c566a

    • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

      Filesize

      128KB

      MD5

      70c8782e6c59dcb0ad04178f52965f15

      SHA1

      9b277a632776f41471f4c345442b3d70d1ff5f0e

      SHA256

      ee673b50a66d38019fa8ee6a73126fd46d0b3ca34b52b5b73e5437318316ef24

      SHA512

      9280ed3ba34e69413effc52ea8827311d62510eb1be17998a90bbe6266c37a92c1d1996f72d14fbffda12a6492059325479f14fabccfbb63b846c5c39a98e5b3

    • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{E7CCAB87-1EBF-40CC-B369-A0AC2AE62791}.FSD

      Filesize

      128KB

      MD5

      198b4e4507a6a2d6ac60839a151b2440

      SHA1

      c2a4fad42a7e838e595e7d4484721f8814cdc508

      SHA256

      deaf212a0cf081278c837430b9fd1e8668949246e18d111e831a5a3875f5a148

      SHA512

      067521f069a7b8a7e735f781383395c477cf2ee0605a777d4a4092e9d4762bad5d310de1b0b645510cd544c7d66727af1a0659bf49b9e4ba853ceac5ce888169

    • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF

      Filesize

      114B

      MD5

      caf3905139a89d52df068db99b054286

      SHA1

      4a4cb6259c2f0c73deb35a035d88d9cd8697ea38

      SHA256

      73d1d3156053113eb6d5a5cd11029f2affeb539535aacefb0a7bf1d92db446db

      SHA512

      f103a144298bd12b01a1d33a53640f484e5df8e7d01b11a4e48bda6c61ed74663d02b709a37db655706ac4a95fe053242e10a730130b11c758ae49008b3280aa

    • C:\Users\Admin\AppData\Local\Temp\VBE\MSForms.exd

      Filesize

      143KB

      MD5

      baf1633f41fac72e12dbdcbc945b646c

      SHA1

      82e780354743eb8c3b133062c686a522989fed7b

      SHA256

      beafd18163b1ea4206e50ca430cedd20ded752d3a1dda3334aa41b7ff0542641

      SHA512

      87c7847d0c95979f27be1934397ec54b649c875ff6b17c28e74771ec5a5b3b07ecf4388a0f72385056066593e9f470cc07581ce43e2acd7fc6ac9c667272f862

    • C:\Users\Admin\AppData\Local\Temp\{A3B09262-5167-4FA4-9659-E11B0CA72DBC}

      Filesize

      128KB

      MD5

      0b4d749e6ae7971c5af524b6692a2652

      SHA1

      d659ea836815d5185b0e9d4564f468b79c8a9d0d

      SHA256

      d99b284a7e0ea0e2aa87e1c1f5768730a8fa9782c81915af59c14f2972a8c572

      SHA512

      89e1839765d9744eaad2b40e52b4bba6a0e9b2aea3251caca28119216c7b78081b1aee56f2949190fffc9e1a0aa453e7683c1a1919c8d5ce31041b0057b9dfd5

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      19KB

      MD5

      8c292fdc43801c05cab09d54fee85599

      SHA1

      d08718712f434bdd1503f693abeab29b3f9f6e41

      SHA256

      5daa49f1b0c2d6d1764b5f38e3c23148b3a16b67d33ecb0e680f26f4c637dca3

      SHA512

      b5d8d2f16f030bdef2633f2a5516fde324b299b8fa64b7aef3ef45778cdcf0ec4804492d18c833c7f720881b2803136d091eb402bda6665a8471305f54ab5aae

    • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

      Filesize

      2B

      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    • memory/2316-57-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-69-0x0000000010930000-0x0000000010A30000-memory.dmp

      Filesize

      1024KB

    • memory/2316-66-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-65-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-64-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-62-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-61-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-60-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-55-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-54-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-53-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-52-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-36-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-24-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-23-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-63-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-84-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-70-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-68-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-59-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-58-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-22-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-56-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-51-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-50-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-49-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-48-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-67-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-47-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-46-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-45-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-44-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-43-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-42-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-41-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-40-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-39-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-38-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-37-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-35-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-34-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-33-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-32-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-31-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-30-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-29-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-20-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-21-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-18-0x0000000070A9D000-0x0000000070AA8000-memory.dmp

      Filesize

      44KB

    • memory/2316-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2316-2-0x0000000070A9D000-0x0000000070AA8000-memory.dmp

      Filesize

      44KB

    • memory/2316-0-0x000000002F9E1000-0x000000002F9E2000-memory.dmp

      Filesize

      4KB

    • memory/2316-28-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-27-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-26-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB

    • memory/2316-25-0x0000000000350000-0x0000000000450000-memory.dmp

      Filesize

      1024KB