edd7f442f0c78778862182c07d7b806945e8fb608a762f7315238feae5c204be

General

Target

7571d9ebe44a17948813969147243a5d_JaffaCakes118.docm
Size

380KB
MD5

7571d9ebe44a17948813969147243a5d
SHA1

3311297aa96c9ed1a9898d4da9457c09bb5e0cf0
SHA256

edd7f442f0c78778862182c07d7b806945e8fb608a762f7315238feae5c204be
SHA512

02ec09b665b1aa8f7cc4699eb9017b11b5443b8e0784e50a2296f2cd145055bc9c347d27620ee6ae4cfeaefd7db7967de143463b08eef6109bad5553d032330a
SSDEEP

6144:Zyil1s8HsDsXAYeTkpoCz7JQ/Qn0uTSuSxUaymnfhZO+dfOfnprGM12q:kaBYs1pok7q/Qn0ubDGf5OfprB1/

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\http:\bit.ly\loadingxxxx	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4432	WINWORD.EXE
4432	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeAuditPrivilege	4432	WINWORD.EXE

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4432	WINWORD.EXE
4432	WINWORD.EXE
4432	WINWORD.EXE
4432	WINWORD.EXE
4432	WINWORD.EXE
4432	WINWORD.EXE
4432	WINWORD.EXE
4432	WINWORD.EXE
4432	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 1548	4432	WINWORD.EXE	100
PID 4432 wrote to memory of 1548	4432	WINWORD.EXE	100

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7571d9ebe44a17948813969147243a5d_JaffaCakes118.docm" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\BD9EA503.emf

Filesize
98KB

MD5
5a83cc27028087dda93558981e3471a9

SHA1
a4403d949067b68a31b711e392a71f436f8f923c

SHA256
1820c56f574d4b82afd79417b6237a97056497d0811a6de08ddc478d45dcc1a3

SHA512
4c5d1b28248441687271a3aa634bc791975ae2a497e5cfeceb32d25683e200238e06bdf1a5406e50d9cd36942ad5bbc58f01a27c8f8140c4082eb51e9daad0b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MDMHN06X\loadingxxxx[1].htm

Filesize
5KB

MD5
caaa86e2e815c1258e9e76ac42f12b88

SHA1
5b227fe8a62e681b474fdaec0e726d3114a0f1b4

SHA256
79f421ab2115223b265dfacfb5a5b61f09e631c9b281db463984409273954c38

SHA512
cd8a1ea09b69b1be6afa184c0e8dbb76c13a77225b7425f44f28c1459e132ff179d04cea8c9c636c1e56c22b960e88a598854b307d855a93bacc4ad873a78797

Download Submit
C:\Users\Admin\AppData\Local\Temp\TCDB96D.tmp\sist02.xsl

Filesize
245KB

MD5
f883b260a8d67082ea895c14bf56dd56

SHA1
7954565c1f243d46ad3b1e2f1baf3281451fc14b

SHA256
ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

SHA512
d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Filesize
16B

MD5
d29962abc88624befc0135579ae485ec

SHA1
e40a6458296ec6a2427bcb280572d023a9862b31

SHA256
a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

SHA512
4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
3KB

MD5
73f766c47a3c53f0143488b07d3d520b

SHA1
13361e9e45e7b733bf05d6796f57bc067011e87f

SHA256
656792e4a43da56584a069f5b749a0870dc9b47006823e23508f6d7093d58d4c

SHA512
79ea5b4518a6b1dd404bc4c48f98ef2ea198f90f702634b7646487cf93eb4f192c4a2167729d9e05bbc528231af1c7a3bed79ae11527487444411b873031f6d6

Download Submit
memory/4432-10-0x00007FF851570000-0x00007FF851765000-memory.dmp

Filesize
2.0MB

Download
memory/4432-12-0x00007FF851570000-0x00007FF851765000-memory.dmp

Filesize
2.0MB

Download
memory/4432-0-0x00007FF8115F0000-0x00007FF811600000-memory.dmp

Filesize
64KB

Download
memory/4432-9-0x00007FF851570000-0x00007FF851765000-memory.dmp

Filesize
2.0MB

Download
memory/4432-7-0x00007FF851570000-0x00007FF851765000-memory.dmp

Filesize
2.0MB

Download
memory/4432-6-0x00007FF851570000-0x00007FF851765000-memory.dmp

Filesize
2.0MB

Download
memory/4432-5-0x00007FF8115F0000-0x00007FF811600000-memory.dmp

Filesize
64KB

Download
memory/4432-13-0x00007FF851570000-0x00007FF851765000-memory.dmp

Filesize
2.0MB

Download
memory/4432-14-0x00007FF851570000-0x00007FF851765000-memory.dmp

Filesize
2.0MB

Download
memory/4432-16-0x00007FF80F2F0000-0x00007FF80F300000-memory.dmp

Filesize
64KB

Download
memory/4432-15-0x00007FF851570000-0x00007FF851765000-memory.dmp

Filesize
2.0MB

Download
memory/4432-11-0x00007FF851570000-0x00007FF851765000-memory.dmp

Filesize
2.0MB

Download
memory/4432-17-0x00007FF80F2F0000-0x00007FF80F300000-memory.dmp

Filesize
64KB

Download
memory/4432-8-0x00007FF851570000-0x00007FF851765000-memory.dmp

Filesize
2.0MB

Download
memory/4432-48-0x00007FF851570000-0x00007FF851765000-memory.dmp

Filesize
2.0MB

Download
memory/4432-4-0x00007FF8115F0000-0x00007FF811600000-memory.dmp

Filesize
64KB

Download
memory/4432-3-0x00007FF85160D000-0x00007FF85160E000-memory.dmp

Filesize
4KB

Download
memory/4432-1-0x00007FF8115F0000-0x00007FF811600000-memory.dmp

Filesize
64KB

Download
memory/4432-2-0x00007FF8115F0000-0x00007FF811600000-memory.dmp

Filesize
64KB

Download
memory/4432-251-0x00007FF8115F0000-0x00007FF811600000-memory.dmp

Filesize
64KB

Download
memory/4432-250-0x00007FF8115F0000-0x00007FF811600000-memory.dmp

Filesize
64KB

Download
memory/4432-252-0x00007FF8115F0000-0x00007FF811600000-memory.dmp

Filesize
64KB

Download
memory/4432-253-0x00007FF8115F0000-0x00007FF811600000-memory.dmp

Filesize
64KB

Download
memory/4432-254-0x00007FF851570000-0x00007FF851765000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads