Analysis
-
max time kernel
144s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-09-2024 15:03
Behavioral task
behavioral1
Sample
f6458b3f7c15a53012b8ccbd67a7eaff_JaffaCakes118.doc
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f6458b3f7c15a53012b8ccbd67a7eaff_JaffaCakes118.doc
Resource
win10v2004-20240802-en
General
-
Target
f6458b3f7c15a53012b8ccbd67a7eaff_JaffaCakes118.doc
-
Size
35KB
-
MD5
f6458b3f7c15a53012b8ccbd67a7eaff
-
SHA1
33865f6e7fc10b1d265a369cc829bfba5970bdf3
-
SHA256
12443a3ac7b23228ff69e2e88ad770295ca1f027d5975cf858873cea87f52772
-
SHA512
a0515320904b851c5642564578858c043c0bb50327f9d864afc36f8fea09d46628cb0d7dbca69e97c5c0d50bb995b1682b9f014d735a09f92e26c1f5792d966b
-
SSDEEP
768:ubT7HiqJ3QNLLTd2CyjViZFgnX/hfxN6RLQ1OlN5R:uvZ5U2jVfX/hXcQkXT
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1192 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 20 IoCs
pid Process 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE 1192 WINWORD.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f6458b3f7c15a53012b8ccbd67a7eaff_JaffaCakes118.doc"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1192