Analysis
-
max time kernel
144s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15/09/2024, 11:42
Static task
static1
Behavioral task
behavioral1
Sample
e2661327475800ec74823601cb2ee6d5_JaffaCakes118.rtf
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
e2661327475800ec74823601cb2ee6d5_JaffaCakes118.rtf
Resource
win10v2004-20240802-en
General
-
Target
e2661327475800ec74823601cb2ee6d5_JaffaCakes118.rtf
-
Size
576KB
-
MD5
e2661327475800ec74823601cb2ee6d5
-
SHA1
81a64e6ea587209bffb37195a8902fc4274fb455
-
SHA256
84272f3db52c7bb9ee53e93405dfb329bf67db0cd171b7f1d28a41b741584271
-
SHA512
da12590fd3d9cffd007729854d260c0c2aae712edddc4a18150a2958e7fe5331e505b1bcf20918cd3fec51acf6c1996d2a54e6cbd562d246fc49c8b1b74a5c83
-
SSDEEP
12288:HplTPjplTPsplTP2plTPeplTPkplTP4plTPQplTP/:HHTLHTkHTOHT2HTMHTQHToHT3
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2484 WINWORD.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2484 WINWORD.EXE 2484 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2484 WINWORD.EXE 2484 WINWORD.EXE 2096 EXCEL.EXE 2096 EXCEL.EXE 2096 EXCEL.EXE 2484 WINWORD.EXE 2096 EXCEL.EXE 2096 EXCEL.EXE 2096 EXCEL.EXE 2096 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2484 wrote to memory of 2308 2484 WINWORD.EXE 30 PID 2484 wrote to memory of 2308 2484 WINWORD.EXE 30 PID 2484 wrote to memory of 2308 2484 WINWORD.EXE 30 PID 2484 wrote to memory of 2308 2484 WINWORD.EXE 30
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\e2661327475800ec74823601cb2ee6d5_JaffaCakes118.rtf"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2308
-
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" -Embedding1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:2096