Analysis
- max time kernel
151s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
01/04/2024, 11:16
General
- Target 7084f767b00212d57626aa3653f384ca_JaffaCakes118.xls
- Size 36KB
- Sample240401-nc5qvsch51
- SHA256 ca43051a15b2c90ae35d1942ab70bec2db9bf25c35af6a24c1ee56db55469b18
Malware Config
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\7084f767b00212d57626aa3653f384ca_JaffaCakes118.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe C:\Users\Public\Documents\PCKsLK.vbs2⤵
- Process spawned unexpected child process
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\PCKsLK.vbs"2⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3488 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
PCKsLK.vbs
memory/3480-12-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp
memory/3480-9-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp
memory/3480-1-0x00007FFFB6D30000-0x00007FFFB6D40000-memory.dmp
memory/3480-4-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp
memory/3480-5-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp
memory/3480-7-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp
memory/3480-6-0x00007FFFB6D30000-0x00007FFFB6D40000-memory.dmp
memory/3480-13-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp
memory/3480-0-0x00007FFFB6D30000-0x00007FFFB6D40000-memory.dmp
memory/3480-10-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp
memory/3480-3-0x00007FFFB6D30000-0x00007FFFB6D40000-memory.dmp
memory/3480-11-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp
memory/3480-8-0x00007FFFB6D30000-0x00007FFFB6D40000-memory.dmp
memory/3480-14-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp
memory/3480-15-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp
memory/3480-17-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp
memory/3480-16-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp
memory/3480-18-0x00007FFFB4610000-0x00007FFFB4620000-memory.dmp
memory/3480-19-0x00007FFFB4610000-0x00007FFFB4620000-memory.dmp
memory/3480-2-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp
memory/3480-31-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp
memory/3480-32-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp
memory/3480-33-0x00007FFFF6CB0000-0x00007FFFF6EA5000-memory.dmp