Analysis
-
max time kernel
140s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26-08-2024 07:42
Behavioral task
behavioral1
Sample
c28eb6e085af9f054731592297598211_JaffaCakes118.doc
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
c28eb6e085af9f054731592297598211_JaffaCakes118.doc
Resource
win10v2004-20240802-en
General
-
Target
c28eb6e085af9f054731592297598211_JaffaCakes118.doc
-
Size
38KB
-
MD5
c28eb6e085af9f054731592297598211
-
SHA1
faf9ee2b95edf94a531162a4337f6e37164aed8b
-
SHA256
e621ba0ba3faccdd9a821f8139aa31f05e65168a5d7da40b820ec953437e3ae2
-
SHA512
ca684a7d36b0bed254c354c31ddf1c637ccba083d556046a8e93004a01062d68af1945482d2d4f340f0d5b685d9349e0821f3ee3f5b43c87dc4dc3ad74a8d546
-
SSDEEP
384:3wHTZzB1MdBmr2PhCTCQqgR1JsHEj2VjiBHZntODXMep:KTZB1MdArOC5mVji9O5
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 4456 WINWORD.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\~WRD0000.tmp\:Zone.Identifier:$DATA WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4456 WINWORD.EXE 4456 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 4456 WINWORD.EXE 4456 WINWORD.EXE 4456 WINWORD.EXE 4456 WINWORD.EXE 4456 WINWORD.EXE 4456 WINWORD.EXE 4456 WINWORD.EXE 4456 WINWORD.EXE 4456 WINWORD.EXE 4456 WINWORD.EXE 4456 WINWORD.EXE 4456 WINWORD.EXE 4456 WINWORD.EXE 4456 WINWORD.EXE 4456 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\c28eb6e085af9f054731592297598211_JaffaCakes118.doc" /o ""1⤵
- Deletes itself
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4456
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
880B
MD50522d8dcdc9860ea7f4b9966c5d466b9
SHA17dd16a4d0159a3c2bc81fdb7893a0ebdf925bdc1
SHA25680742dade91f8c7521277ea827aa93e8a13d100997a24f9afb4e3568224cb8d0
SHA5120ab2c5abbf5823d36d452440d1f0d8dd1e0f297855dbb8536de9eccad29e62c2585f81fd2f3f6e804221421f011482b10f402645ae0784dd550269452c5c6c08
-
Filesize
3KB
MD5f249804021fdd5a000cea484e1b573fd
SHA1d8aab88a32a74cfa6cd23be7d193dd3cbf5c37fe
SHA256f5f2e0bdbb84568cb0a1503fe3d2f2742c13b2f3f41c6884f6fd61ee6beb8d44
SHA5125aaeca8265ec8c84eaf296a84fcfc6f932df7d25e209ef5d36d6fbadb108a9d9078c1b35575909cedce954667ac7758914ca5891ad1e7840470694c53fba7d5f
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
45KB
MD59ead638f3501a0040e20b9f1d09d9a5e
SHA14f272c224541bd310717cf1ae8ddd15139673599
SHA256ccf1cdf1686286a166dcdb3411f2488f2f902025b95ca288e1b36aa26ad86d38
SHA512e298e282b8e281af94a390b53be53b5c6dfb554fa4fc41ad9596b22420a7e41b9e1237ee01e66e1bedc080f5d793d1d2e011c0c1bd23190cc8b651114fab9768
-
Filesize
26KB
MD53e6ef18f3ce887c4f8d6eee6d0b354c2
SHA1dd4d0fa403215f2373d9be09691fa0f890592e26
SHA256fbfaedef25caeea7766e8bcd355468d06d637c8208d955dfa714f4478f585e61
SHA512316d0b30081a4ea56808d2327cf545b0b3e1e6d412196da11e94c125a1c6e5ef546f5b6ca7a21b1d4b44fdea8794bfbd93482ac0d189479444d28f72dc8cab9e
-
Filesize
16B
MD5d29962abc88624befc0135579ae485ec
SHA1e40a6458296ec6a2427bcb280572d023a9862b31
SHA256a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
SHA5124311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize3KB
MD580b20eed3d0eacc4db07243374a43bcc
SHA1aeef4abd40e46d9056856a7aea7529e434359337
SHA25635ae253c036374be9c37e7c2eab46698a246bef9945b710090e935baa180beec
SHA512ae63b7134127f5881396bece5972fad21d75bcd49c91613a70d38569e3e5b9ed5b55274803a7f1f8d55e83ad51eaf024c15b2af22706289fafe3e6bb4e2ba071