Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
27-08-2024 09:16
General
-
Target
c4b5c435640c8d3ff617c26aedc1ec71_JaffaCakes118.rtf
-
Size
2.0MB
-
MD5
c4b5c435640c8d3ff617c26aedc1ec71
-
SHA1
7e0fb054a5e79c923de01262b603d3bf3da06c25
-
SHA256
8cc49c2ec80f755f0301768a32fd5ba3ba84d21d9a5c4737137f5d1c28211c4e
-
SHA512
f83687805172194210e8aff9a9bf32d968a6cedf79159be75bbb9b239260bbd605a08056d2424023aa547b36d7f994ae2257ca5c46fd5a37e8a186fb6aded944
-
SSDEEP
24576:gopSTEOUpl4BSSJQ3x1JKzpYP9zr7gR4mRSc02IcFN8pKKx72vQ7Tt2tQRn1f6MQ:2
Malware Config
Signatures
-
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 5 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\c4b5c435640c8d3ff617c26aedc1ec71_JaffaCakes118.rtf" /o ""1⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
Filesize
1KB
MD57802b6c1ffd07514467504062358bf88
SHA116c504b7728c05502462ef05222c6db222230c99
SHA2560572256114f523ad666a9a87f6c4f5a161f3faf1217ab7cfe76a436b24fdd4bb
SHA512ae401e18425a7514fc5ae53b99fe6cf98a9bd421c67865879ff2c47ba54e7eb3ed0e67b6e9f2cd2ede64991689e1c1faaecdef652791161746a7bff791382fc3
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB