Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
19-10-2024 16:41
General
-
Target
5d97eddf4ce51c5604f97b6a8c37e752_JaffaCakes118.doc
-
Size
289KB
-
MD5
5d97eddf4ce51c5604f97b6a8c37e752
-
SHA1
af5b4b430adb928ae440324f60c0691787846ad4
-
SHA256
d63515b0562d08252069d37a54ecc8edf6c28f06da3a7e937a21e83d25c806d9
-
SHA512
21953cf23b5f79232ad13bea0b0a32160e13571253cb810ab8f5ed28e9064263cc034fde1a21cafa971b1911c1bb351635d1c7b9dc7311eecf016fc03b551036
-
SSDEEP
6144:aT16276Gd37WAmXmpyGc2YBPJQWQcwu2hUGe2LA9mzC6:ac2e8rWZP22PCWX2hb3y6
Malware Config
Signatures
-
Ardamax
A keylogger first seen in 2013.
-
Ardamax main executable 1 IoCs
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 6 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 4 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 64 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\5d97eddf4ce51c5604f97b6a8c37e752_JaffaCakes118.doc"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\tmp.exeC:\tmp.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svshost.exe"C:\Windows\system32\svshost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\svshost.exe > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\tmp.bat2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
-
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD5414c8b88d6119200125d2776cc6f9758
SHA1e1bc34be8fdfd85e51ba41cd761c91237ec682cd
SHA256c0a67c3e5fa5e3cc8af752b7e65ecee49244b6ffb74318688dc4e77f5d98ec81
SHA512351c52b6458887bfd4bdd1724ba6b94e3b36de9efc56cc9a6631d0518b1e90ed5b717bf0411ff27a1a19fa602aa878d27e3a38fcb0c2d5683c5767df8c972ab6
-
Filesize
2KB
MD53fc403723af05bbe1f7c8a9bd433c4e1
SHA138f9e59d3a2942d58934cf85be1a8a6857718f0d
SHA2560e2c985ac5b2b4bd911eb0ffe554003908dd08bd3bea1de5ae7cce58d265cc77
SHA5122ec49396a944fd87bfee388b43c43a622c9345c44252af2c4f88d31a8e5ffb4896ec31281b51d79f7670065e6875bf4e4ed8ca4d398ee0c2865494fd32c76e89
-
Filesize
5KB
MD5751af9fd705f1c046dba80d13dc151f4
SHA1873c556c548f893dd4fdc5aa7f5a53a6966f1f8d
SHA2569f2555ea46c5b4d8c0a8150360609a37f82691dbab5cdb46120da806d614ac50
SHA512b86126932584376e966b8dffa9ef367372627c45199b8f1d5d67cb4c977284ccaf4d026c79952b33157fd211f856783006e5470db05d8ff7c2ff64589336e1a7
-
Filesize
4KB
MD5ce92c6226c4192736c898f6fddc55c82
SHA1c02a50511be7e146e8f9b59ce5c47d75f6d85728
SHA256c963421686c1393fdfeb7838351cd8a95de0837696975f869f6ee75c3751f77d
SHA512e6db4c41f0a606ac0aa9f0afd9849047fc16471cc7d0f4b2abb1f27f75b30ef9af4491911c1694b85b094c34539a85068debdf222651b0ac65dca33a73300106
-
Filesize
68B
MD5e0ccf13efb712acd2cf1b013c9fb395d
SHA181c9a8020011b47c5b1e7b0dd8dcef5da5daa922
SHA2561f5b0a9de7deaead02d853c107351f28aa41d3cabeae49b42823ec9a3db66c06
SHA5125067bebe549a35420285eaac27fa18fd64ff77a1baeb483b36972217ebd1d84e8c9ca99b81e80ab0080f2c0f33b16becc164cd762d61a7a012d658b14f0e5ffa
-
Filesize
168KB
MD58288643770473d70be48f7ea4dcb1f88
SHA1803547bcbf8a7c56fa1aa57d87a61040f9a578aa
SHA256af7c75274b1f259754b286dfdaf6ef3d095e7b673629ed9b6f18afaee7fa53f7
SHA5125f2de7e6ae7e9aea6ccb3294ea62cf348cb88ae5b656049feb827ab2a85decde4fb8578e2e723be94ff470ad81abb54d84771c56f17b1f0027e391c3d2b30747
-
Filesize
4KB
MD575e03e528628f1b435614e2982661c31
SHA1400358a42179c337c01b6b9c7492705853efdc18
SHA256880128dc529da91fc984c5d80feb09342fada3c24a13a5a413bc77fd603ef56c
SHA5126377b296937a2af642d2216ad8583e502b5f2a5925800aca60ee022619683d4e0998b02548b19f860d97b7bdc0f6deb6de0e26898f3bdde7c283ce9550cb62c2
-
Filesize
286KB
MD5b9683df54fd54f5330846c2e0f53a00c
SHA18148b461cfe9192ee89930427b553476e34d5d92
SHA256127760b71ac1fb6cc8539f460cf3dbe5ad6424e282308f8eb4a01f38feb7d7ae
SHA512a738e99f21d973cf88049032e3b7911fb24508431d1beaff3fdaca2be3d45487b8e69c1cd686d231526f6fb0c2ddb6830c730479566d5ce5e45b6569c919d501
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
1024KB