Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09-04-2024 04:08
Behavioral task
behavioral1
Sample
e92fd00aa2cb0855e9843741e5bf3229_JaffaCakes118.xls
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e92fd00aa2cb0855e9843741e5bf3229_JaffaCakes118.xls
Resource
win10v2004-20240226-en
General
-
Target
e92fd00aa2cb0855e9843741e5bf3229_JaffaCakes118.xls
-
Size
36KB
-
MD5
e92fd00aa2cb0855e9843741e5bf3229
-
SHA1
bbace7bd1bf5e5566c7de70aae70dd888c2ee836
-
SHA256
112cfc5f00859b28bbbeee3f7175e0ea4c2139701e3279769d29b3a95c2c5217
-
SHA512
f785a3d1a6500d1a7bfada26b0f88ad92cb2368846fbb4f66ff96f89e0d3ec1429a77f0045026d4be15270566d96317df73c6fbf44b2785775a78fd5f124fdf7
-
SSDEEP
768:IPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJg2LO8A1RGyyc:kok3hbdlylKsgqopeJBWhZFGkE+cL2NZ
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
explorer.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process 2904 1400 explorer.exe EXCEL.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1400 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
EXCEL.EXEpid process 1400 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
EXCEL.EXEpid process 1400 EXCEL.EXE 1400 EXCEL.EXE 1400 EXCEL.EXE 1400 EXCEL.EXE 1400 EXCEL.EXE 1400 EXCEL.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
EXCEL.EXEexplorer.exedescription pid process target process PID 1400 wrote to memory of 2904 1400 EXCEL.EXE explorer.exe PID 1400 wrote to memory of 2904 1400 EXCEL.EXE explorer.exe PID 4908 wrote to memory of 4508 4908 explorer.exe WScript.exe PID 4908 wrote to memory of 4508 4908 explorer.exe WScript.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e92fd00aa2cb0855e9843741e5bf3229_JaffaCakes118.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe C:\Users\Public\Documents\bCv.vbs2⤵
- Process spawned unexpected child process
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\bCv.vbs"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Documents\bCv.vbsFilesize
566B
MD54335844de1247a6f6b61536a19362258
SHA1f7a974a810868a0f42fc6b9cb45ae9c9168c4f97
SHA2567c8ccf3943ca3d72d6f1be89879a6fbc7eaa52e807fc0b13ec3498c85b16baf5
SHA512d6ab62d46756af8dc3e40bf3a31c75dfc9b5a82311e0f2b04bbbfe8178150c0aa7712c30a29cf04495d5239b834061c16766e6348ae5341dad18b2d0e9790b9a
-
memory/1400-10-0x00007FFF06980000-0x00007FFF06990000-memory.dmpFilesize
64KB
-
memory/1400-3-0x00007FFF08C30000-0x00007FFF08C40000-memory.dmpFilesize
64KB
-
memory/1400-12-0x00007FFF48BB0000-0x00007FFF48DA5000-memory.dmpFilesize
2.0MB
-
memory/1400-4-0x00007FFF48BB0000-0x00007FFF48DA5000-memory.dmpFilesize
2.0MB
-
memory/1400-6-0x00007FFF08C30000-0x00007FFF08C40000-memory.dmpFilesize
64KB
-
memory/1400-5-0x00007FFF08C30000-0x00007FFF08C40000-memory.dmpFilesize
64KB
-
memory/1400-7-0x00007FFF48BB0000-0x00007FFF48DA5000-memory.dmpFilesize
2.0MB
-
memory/1400-8-0x00007FFF48BB0000-0x00007FFF48DA5000-memory.dmpFilesize
2.0MB
-
memory/1400-13-0x00007FFF48BB0000-0x00007FFF48DA5000-memory.dmpFilesize
2.0MB
-
memory/1400-0-0x00007FFF08C30000-0x00007FFF08C40000-memory.dmpFilesize
64KB
-
memory/1400-32-0x00007FFF48BB0000-0x00007FFF48DA5000-memory.dmpFilesize
2.0MB
-
memory/1400-1-0x00007FFF08C30000-0x00007FFF08C40000-memory.dmpFilesize
64KB
-
memory/1400-9-0x00007FFF48BB0000-0x00007FFF48DA5000-memory.dmpFilesize
2.0MB
-
memory/1400-14-0x00007FFF06980000-0x00007FFF06990000-memory.dmpFilesize
64KB
-
memory/1400-16-0x00007FFF48BB0000-0x00007FFF48DA5000-memory.dmpFilesize
2.0MB
-
memory/1400-15-0x00007FFF48BB0000-0x00007FFF48DA5000-memory.dmpFilesize
2.0MB
-
memory/1400-17-0x00007FFF48BB0000-0x00007FFF48DA5000-memory.dmpFilesize
2.0MB
-
memory/1400-18-0x00007FFF48BB0000-0x00007FFF48DA5000-memory.dmpFilesize
2.0MB
-
memory/1400-19-0x00007FFF48BB0000-0x00007FFF48DA5000-memory.dmpFilesize
2.0MB
-
memory/1400-20-0x00007FFF48BB0000-0x00007FFF48DA5000-memory.dmpFilesize
2.0MB
-
memory/1400-2-0x00007FFF48BB0000-0x00007FFF48DA5000-memory.dmpFilesize
2.0MB
-
memory/1400-11-0x00007FFF48BB0000-0x00007FFF48DA5000-memory.dmpFilesize
2.0MB