Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-06-2024 11:22
Static task
static1
Behavioral task
behavioral1
Sample
bbaaca3df24ceb257d22854cac390f46_JaffaCakes118.rtf
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
bbaaca3df24ceb257d22854cac390f46_JaffaCakes118.rtf
Resource
win10v2004-20240508-en
General
-
Target
bbaaca3df24ceb257d22854cac390f46_JaffaCakes118.rtf
-
Size
973KB
-
MD5
bbaaca3df24ceb257d22854cac390f46
-
SHA1
42eabeb3ee7475b1a68babe2aa96118c6c3e6e1e
-
SHA256
5c7e88f3840237ba479019cc2c86421db7f695c13dfeffe7f2db121158e42d81
-
SHA512
abc5b31f99bd39862fa6adad60191bcb26f9fcfd72c12bb67dca62dc6064858ee67b4bc8498a2eaf629a820bb2528d0a8a534c3a2375735008c5c4f4223e041e
-
SSDEEP
24576:s4zQaPkDpZdKUUyUn6HaNpKwD0gpV6HwR:J
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
NTFS ADS 4 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Temp\{A578C676-C9F2-4A26-92CB-78390708E118}\inteldriverupd1.sct:Zone.Identifier WINWORD.EXE File opened for modification C:\Users\Admin\AppData\Local\Temp\{A578C676-C9F2-4A26-92CB-78390708E118}\exe.exe:Zone.Identifier WINWORD.EXE File opened for modification C:\Users\Admin\AppData\Local\Temp\{A578C676-C9F2-4A26-92CB-78390708E118}\decoy.doc:Zone.Identifier WINWORD.EXE File opened for modification C:\Users\Admin\AppData\Local\Temp\{A578C676-C9F2-4A26-92CB-78390708E118}\task.bat:Zone.Identifier WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 1436 WINWORD.EXE 1436 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 1436 WINWORD.EXE 1436 WINWORD.EXE 1436 WINWORD.EXE 1436 WINWORD.EXE 1436 WINWORD.EXE 1436 WINWORD.EXE 1436 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\bbaaca3df24ceb257d22854cac390f46_JaffaCakes118.rtf" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1436-0-0x00007FFF45110000-0x00007FFF45120000-memory.dmpFilesize
64KB
-
memory/1436-3-0x00007FFF45110000-0x00007FFF45120000-memory.dmpFilesize
64KB
-
memory/1436-2-0x00007FFF45110000-0x00007FFF45120000-memory.dmpFilesize
64KB
-
memory/1436-4-0x00007FFF45110000-0x00007FFF45120000-memory.dmpFilesize
64KB
-
memory/1436-1-0x00007FFF45110000-0x00007FFF45120000-memory.dmpFilesize
64KB
-
memory/1436-5-0x00007FFF8512D000-0x00007FFF8512E000-memory.dmpFilesize
4KB
-
memory/1436-6-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/1436-7-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/1436-9-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/1436-8-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/1436-10-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/1436-11-0x00007FFF42B60000-0x00007FFF42B70000-memory.dmpFilesize
64KB
-
memory/1436-12-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/1436-13-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/1436-15-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/1436-14-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/1436-20-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/1436-21-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/1436-19-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/1436-18-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/1436-17-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/1436-16-0x00007FFF42B60000-0x00007FFF42B70000-memory.dmpFilesize
64KB
-
memory/1436-39-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB
-
memory/1436-66-0x00007FFF45110000-0x00007FFF45120000-memory.dmpFilesize
64KB
-
memory/1436-67-0x00007FFF45110000-0x00007FFF45120000-memory.dmpFilesize
64KB
-
memory/1436-65-0x00007FFF45110000-0x00007FFF45120000-memory.dmpFilesize
64KB
-
memory/1436-68-0x00007FFF45110000-0x00007FFF45120000-memory.dmpFilesize
64KB
-
memory/1436-69-0x00007FFF85090000-0x00007FFF85285000-memory.dmpFilesize
2.0MB