f357668862a1af4f388eeca8868bd3c502d2a51ac80a9c8c4f92d4c61247769b

General

Target

e96dbde934e068285ea1959a4793663a_JaffaCakes118.xlsb
Size

373KB
MD5

e96dbde934e068285ea1959a4793663a
SHA1

f2bfa5c9982691f9e46553899f27e9dd7ff6d2d1
SHA256

f357668862a1af4f388eeca8868bd3c502d2a51ac80a9c8c4f92d4c61247769b
SHA512

ca2896f04b19a570302be17dc6997c03672c8dfb051b8dfae256a1ba4da550691801ae154ec8e38a740327215c82b2195bf5eef4d476f4ce3f4462a6bce728f6
SSDEEP

6144:o6enNkfdjqKveug2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNTA:XeNgWKGuHL2OGY/TTy2jEIJc6FNu3uPL

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

wmic.exemshta.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	4404	3520	wmic.exe	EXCEL.EXE
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3672	3016	mshta.exe

Blocklisted process makes network request 3 IoCs

Processes:

mshta.exe

flow pid process

39 3672 mshta.exe
41 3672 mshta.exe
44 3672 mshta.exe

flow	pid	process
39	3672	mshta.exe
41	3672	mshta.exe
44	3672	mshta.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3520 EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 42 IoCs

Processes:

wmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4404	wmic.exe
Token: SeSecurityPrivilege	4404	wmic.exe
Token: SeTakeOwnershipPrivilege	4404	wmic.exe
Token: SeLoadDriverPrivilege	4404	wmic.exe
Token: SeSystemProfilePrivilege	4404	wmic.exe
Token: SeSystemtimePrivilege	4404	wmic.exe
Token: SeProfSingleProcessPrivilege	4404	wmic.exe
Token: SeIncBasePriorityPrivilege	4404	wmic.exe
Token: SeCreatePagefilePrivilege	4404	wmic.exe
Token: SeBackupPrivilege	4404	wmic.exe
Token: SeRestorePrivilege	4404	wmic.exe
Token: SeShutdownPrivilege	4404	wmic.exe
Token: SeDebugPrivilege	4404	wmic.exe
Token: SeSystemEnvironmentPrivilege	4404	wmic.exe
Token: SeRemoteShutdownPrivilege	4404	wmic.exe
Token: SeUndockPrivilege	4404	wmic.exe
Token: SeManageVolumePrivilege	4404	wmic.exe
Token: 33	4404	wmic.exe
Token: 34	4404	wmic.exe
Token: 35	4404	wmic.exe
Token: 36	4404	wmic.exe
Token: SeIncreaseQuotaPrivilege	4404	wmic.exe
Token: SeSecurityPrivilege	4404	wmic.exe
Token: SeTakeOwnershipPrivilege	4404	wmic.exe
Token: SeLoadDriverPrivilege	4404	wmic.exe
Token: SeSystemProfilePrivilege	4404	wmic.exe
Token: SeSystemtimePrivilege	4404	wmic.exe
Token: SeProfSingleProcessPrivilege	4404	wmic.exe
Token: SeIncBasePriorityPrivilege	4404	wmic.exe
Token: SeCreatePagefilePrivilege	4404	wmic.exe
Token: SeBackupPrivilege	4404	wmic.exe
Token: SeRestorePrivilege	4404	wmic.exe
Token: SeShutdownPrivilege	4404	wmic.exe
Token: SeDebugPrivilege	4404	wmic.exe
Token: SeSystemEnvironmentPrivilege	4404	wmic.exe
Token: SeRemoteShutdownPrivilege	4404	wmic.exe
Token: SeUndockPrivilege	4404	wmic.exe
Token: SeManageVolumePrivilege	4404	wmic.exe
Token: 33	4404	wmic.exe
Token: 34	4404	wmic.exe
Token: 35	4404	wmic.exe
Token: 36	4404	wmic.exe

Suspicious use of SetWindowsHookEx 16 IoCs

Processes:

EXCEL.EXE

pid	process
3520	EXCEL.EXE
3520	EXCEL.EXE
3520	EXCEL.EXE
3520	EXCEL.EXE
3520	EXCEL.EXE
3520	EXCEL.EXE
3520	EXCEL.EXE
3520	EXCEL.EXE
3520	EXCEL.EXE
3520	EXCEL.EXE
3520	EXCEL.EXE
3520	EXCEL.EXE
3520	EXCEL.EXE
3520	EXCEL.EXE
3520	EXCEL.EXE
3520	EXCEL.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

EXCEL.EXE

description pid process target process

PID 3520 wrote to memory of 4404 3520 EXCEL.EXE wmic.exe
PID 3520 wrote to memory of 4404 3520 EXCEL.EXE wmic.exe

description	pid	process	target process
PID 3520 wrote to memory of 4404	3520	EXCEL.EXE	wmic.exe
PID 3520 wrote to memory of 4404	3520	EXCEL.EXE	wmic.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e96dbde934e068285ea1959a4793663a_JaffaCakes118.xlsb"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3520

C:\Windows\System32\Wbem\wmic.exe
wmic process call create 'mshta C:\ProgramData\BZKYdqf.sct'
2⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:4404

C:\Windows\system32\mshta.exe
mshta C:\ProgramData\BZKYdqf.sct
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
PID:3672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5132 --field-trial-handle=2228,i,8155065313278028490,17854605419281052753,262144 --variations-seed-version /prefetch:8
1⤵
PID:3604

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\BZKYdqf.sct
Filesize
14KB

MD5
961d178fa067131161386019adc88e27

SHA1
4cad87880d4d62f1338b1c179d9b82dfed0ccd70

SHA256
ab468f5c0118882896a7fa3bb66319f1d9aa39b9b2470ff181415347eac3238f

SHA512
d0defd776208df77b7e11b131032b20329e37d1c08486d76a98a2d1555bbf8c9029cd610a053c3b45209e42e88cede190ce7905108b0f1b4b33bfa9c98e0a985

Download Submit
memory/3520-8-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

Filesize
2.0MB

Download
memory/3520-1-0x00007FFC20FB0000-0x00007FFC20FC0000-memory.dmp

Filesize
64KB

Download
memory/3520-2-0x00007FFC20FB0000-0x00007FFC20FC0000-memory.dmp

Filesize
64KB

Download
memory/3520-4-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

Filesize
2.0MB

Download
memory/3520-18-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

Filesize
2.0MB

Download
memory/3520-7-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

Filesize
2.0MB

Download
memory/3520-5-0x00007FFC20FB0000-0x00007FFC20FC0000-memory.dmp

Filesize
64KB

Download
memory/3520-19-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

Filesize
2.0MB

Download
memory/3520-9-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

Filesize
2.0MB

Download
memory/3520-20-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

Filesize
2.0MB

Download
memory/3520-11-0x00007FFC1EEA0000-0x00007FFC1EEB0000-memory.dmp

Filesize
64KB

Download
memory/3520-12-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

Filesize
2.0MB

Download
memory/3520-13-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

Filesize
2.0MB

Download
memory/3520-14-0x00007FFC1EEA0000-0x00007FFC1EEB0000-memory.dmp

Filesize
64KB

Download
memory/3520-16-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

Filesize
2.0MB

Download
memory/3520-17-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

Filesize
2.0MB

Download
memory/3520-6-0x00007FFC20FB0000-0x00007FFC20FC0000-memory.dmp

Filesize
64KB

Download
memory/3520-3-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

Filesize
2.0MB

Download
memory/3520-10-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

Filesize
2.0MB

Download
memory/3520-21-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

Filesize
2.0MB

Download
memory/3520-22-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

Filesize
2.0MB

Download
memory/3520-15-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

Filesize
2.0MB

Download
memory/3520-23-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

Filesize
2.0MB

Download
memory/3520-0-0x00007FFC20FB0000-0x00007FFC20FC0000-memory.dmp

Filesize
64KB

Download
memory/3520-50-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

Filesize
2.0MB

Download
memory/3520-51-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

Filesize
2.0MB

Download
memory/3520-52-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

Filesize
2.0MB

Download
memory/3520-67-0x00007FFC20FB0000-0x00007FFC20FC0000-memory.dmp

Filesize
64KB

Download
memory/3520-68-0x00007FFC20FB0000-0x00007FFC20FC0000-memory.dmp

Filesize
64KB

Download
memory/3520-69-0x00007FFC20FB0000-0x00007FFC20FC0000-memory.dmp

Filesize
64KB

Download
memory/3520-71-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

Filesize
2.0MB

Download
memory/3520-70-0x00007FFC20FB0000-0x00007FFC20FC0000-memory.dmp

Filesize
64KB

Download
memory/3520-72-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

Filesize
2.0MB

Download
memory/3520-73-0x00007FFC60F30000-0x00007FFC61125000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads