Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15-09-2024 11:42
Static task
static1
Behavioral task
behavioral1
Sample
e2661327475800ec74823601cb2ee6d5_JaffaCakes118.rtf
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
e2661327475800ec74823601cb2ee6d5_JaffaCakes118.rtf
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
e2661327475800ec74823601cb2ee6d5_JaffaCakes118.rtf
-
Size
576KB
-
MD5
e2661327475800ec74823601cb2ee6d5
-
SHA1
81a64e6ea587209bffb37195a8902fc4274fb455
-
SHA256
84272f3db52c7bb9ee53e93405dfb329bf67db0cd171b7f1d28a41b741584271
-
SHA512
da12590fd3d9cffd007729854d260c0c2aae712edddc4a18150a2958e7fe5331e505b1bcf20918cd3fec51acf6c1996d2a54e6cbd562d246fc49c8b1b74a5c83
-
SSDEEP
12288:HplTPjplTPsplTP2plTPeplTPkplTP4plTPQplTP/:HHTLHTkHTOHT2HTMHTQHToHT3
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 4552 2792 taskmgr.exe 81 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2792 WINWORD.EXE 2792 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4552 taskmgr.exe Token: SeSystemProfilePrivilege 4552 taskmgr.exe Token: SeCreateGlobalPrivilege 4552 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe 4552 taskmgr.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2792 WINWORD.EXE 2792 WINWORD.EXE 2792 WINWORD.EXE 636 EXCEL.EXE 636 EXCEL.EXE 636 EXCEL.EXE 636 EXCEL.EXE 2792 WINWORD.EXE 2792 WINWORD.EXE 2792 WINWORD.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2792 wrote to memory of 4552 2792 WINWORD.EXE 98 PID 2792 wrote to memory of 4552 2792 WINWORD.EXE 98 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\e2661327475800ec74823601cb2ee6d5_JaffaCakes118.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"2⤵
- Process spawned unexpected child process
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4552
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
Filesize471B
MD5f4e6062cf17ef3b29dc422c6ca271d21
SHA116562f4043d5356dfdbbd78f38069594f13e7186
SHA2562b8477fc96925ebb10660826dcd6345bad44ef2b2acc268a274f99335ad81403
SHA512711c2cd99b26ef8a9dbcba96ead034ca885ca7df7d3b64a14ca84327df54675df962c10b1ec4ce39add2cd5dafbad4b06f914aebffab0d6a1300edf65893975d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
Filesize412B
MD5aa469e0fd2482cbc79ee2dde41c81e53
SHA13d566f3159e51f1aa785d74bc2afb64f9d6e15e9
SHA2566999c5ed71ee2ea6640d8f9132e6f5c945f986bfe7777f6f59dd317f9a652c60
SHA512c59dcf20b96a784ecfdb9662defcea73813ed878b8e40826e0f00d7c4377adfeffc15d95465a27ad807d19619898888cfca928519017d7e8bfc64f86bbf5f70c
-
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\794D2C0C-9FAE-46CA-820A-CD0400CFAF0F
Filesize171KB
MD5e549fa84452e5bf9d034f8921415086c
SHA1383c01bd7f26d62d5fd7d5efaeec8e02065a2ff4
SHA25609484bada3584240cebc31654581c5cc9f70850b92ea6d6e5b66fd0754e8352f
SHA512edd78b437a069c59c34459904cf58d5c85064fa64c9cf6a187df47c8240123e5a3374271d010e4cb46e76a52766cb84773a9394889d8eeb472af00d061b5ce6a
-
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
Filesize2KB
MD510259855fa9777d07e088455641aefa4
SHA1d32bab12aa292cf24323dfdb8329b6979163b3ca
SHA256d899568ab90d34eeb933bb281937b1e432fb21c71b02fe621225ff984b1010b9
SHA51200edc2d46edcf94f9eb53ea2bcefa3f9efbc85cd987cb500a68cbd7348350737bc39d467c6c2c6afc714b5f9e354d4499672107968edf26fc6f1a37f7b7bf9ed
-
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
Filesize2KB
MD5c57ff308e01e1e7032ef36962e535ef4
SHA1ce3c956e1b64cb6c3be3d92bc5665055d5820ac2
SHA2563680dfa65fbe9bbe169e2b5bc459f448746d2061fd56cb51300e13386ed2cd24
SHA512e0f1c5448011ea17425ec0781f250d30e0feaab8d935cecea4c6e5927ab20fd814dfa049b90e21cdb110b53ab9c7d369f8b8876ff791471770c251b5467f8e86