0d8ad63d513a9b6f03056a3134b3c258610771388215e2c5e7b08233bf2b1ad6

General

Target

db1dda0772c81f143e71e55da4564d95_JaffaCakes118.doc
Size

109KB
MD5

db1dda0772c81f143e71e55da4564d95
SHA1

7217dd2c9da7dd0129fefaecd65a98561a3c4010
SHA256

0d8ad63d513a9b6f03056a3134b3c258610771388215e2c5e7b08233bf2b1ad6
SHA512

ba1f07d19e025ab42187af56f04e0b7d7dcfe74d805ded5a725acb1f4b7277ed8e791704e6876b51e6aecc9b80181c89d8e363ec898c76f45eaf2818017e571d
SSDEEP

768:p3th9csVk6tWdmUx7mOUPwAy91LSi4TSUaThfFlNGD0xz99EQ:p3pZkscv7mvPw5qi4TSlThDNGD03C

Score

6^/10

Malware Config

Signatures

Process spawned suspicious child process 1 IoCs

This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process	3284	744	DW20.EXE	82

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dwwin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dwwin.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dwwin.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dwwin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwwin.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
744	WINWORD.EXE
744	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
744	WINWORD.EXE
744	WINWORD.EXE
744	WINWORD.EXE
744	WINWORD.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
744	WINWORD.EXE
744	WINWORD.EXE
744	WINWORD.EXE
744	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 3284	744	WINWORD.EXE	88
PID 744 wrote to memory of 3284	744	WINWORD.EXE	88
PID 3284 wrote to memory of 2708	3284	DW20.EXE	89
PID 3284 wrote to memory of 2708	3284	DW20.EXE	89

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\db1dda0772c81f143e71e55da4564d95_JaffaCakes118.doc" /o ""
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:744
- C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
  "C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 4576
  2⤵
  - Process spawned suspicious child process
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\system32\dwwin.exe
    C:\Windows\system32\dwwin.exe -x -s 4576
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-7-0x00007FF986590000-0x00007FF986785000-memory.dmp

Filesize
2.0MB

Download
memory/744-19-0x00007FF986590000-0x00007FF986785000-memory.dmp

Filesize
2.0MB

Download
memory/744-3-0x00007FF946610000-0x00007FF946620000-memory.dmp

Filesize
64KB

Download
memory/744-2-0x00007FF946610000-0x00007FF946620000-memory.dmp

Filesize
64KB

Download
memory/744-4-0x00007FF946610000-0x00007FF946620000-memory.dmp

Filesize
64KB

Download
memory/744-5-0x00007FF946610000-0x00007FF946620000-memory.dmp

Filesize
64KB

Download
memory/744-6-0x00007FF986590000-0x00007FF986785000-memory.dmp

Filesize
2.0MB

Download
memory/744-8-0x00007FF986590000-0x00007FF986785000-memory.dmp

Filesize
2.0MB

Download
memory/744-9-0x00007FF986590000-0x00007FF986785000-memory.dmp

Filesize
2.0MB

Download
memory/744-12-0x00007FF986590000-0x00007FF986785000-memory.dmp

Filesize
2.0MB

Download
memory/744-14-0x00007FF986590000-0x00007FF986785000-memory.dmp

Filesize
2.0MB

Download
memory/744-13-0x00007FF943DA0000-0x00007FF943DB0000-memory.dmp

Filesize
64KB

Download
memory/744-11-0x00007FF986590000-0x00007FF986785000-memory.dmp

Filesize
2.0MB

Download
memory/744-10-0x00007FF986590000-0x00007FF986785000-memory.dmp

Filesize
2.0MB

Download
memory/744-0-0x00007FF946610000-0x00007FF946620000-memory.dmp

Filesize
64KB

Download
memory/744-20-0x00007FF943DA0000-0x00007FF943DB0000-memory.dmp

Filesize
64KB

Download
memory/744-1-0x00007FF98662D000-0x00007FF98662E000-memory.dmp

Filesize
4KB

Download
memory/744-22-0x00007FF986590000-0x00007FF986785000-memory.dmp

Filesize
2.0MB

Download
memory/744-21-0x00007FF986590000-0x00007FF986785000-memory.dmp

Filesize
2.0MB

Download
memory/744-17-0x00007FF986590000-0x00007FF986785000-memory.dmp

Filesize
2.0MB

Download
memory/744-18-0x00007FF986590000-0x00007FF986785000-memory.dmp

Filesize
2.0MB

Download
memory/744-16-0x00007FF986590000-0x00007FF986785000-memory.dmp

Filesize
2.0MB

Download
memory/744-15-0x00007FF986590000-0x00007FF986785000-memory.dmp

Filesize
2.0MB

Download
memory/744-32-0x00007FF986590000-0x00007FF986785000-memory.dmp

Filesize
2.0MB

Download
memory/744-54-0x00007FF986590000-0x00007FF986785000-memory.dmp

Filesize
2.0MB

Download
memory/3284-53-0x00007FF946610000-0x00007FF946620000-memory.dmp

Filesize
64KB

Download
memory/3284-51-0x00007FF946610000-0x00007FF946620000-memory.dmp

Filesize
64KB

Download
memory/3284-50-0x00007FF946610000-0x00007FF946620000-memory.dmp

Filesize
64KB

Download
memory/3284-52-0x00007FF946610000-0x00007FF946620000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads