6eb00c5fee11ba0e5f5237689915f837dfb76a790a544255df4d1533d08d5c01

General

Target

f44a4e2d5fe0ef1d7e24afc0ea452031_JaffaCakes118.xlsb
Size

352KB
MD5

f44a4e2d5fe0ef1d7e24afc0ea452031
SHA1

225d774ceebd6d2cc7cf2c8f07de51eca7338f38
SHA256

6eb00c5fee11ba0e5f5237689915f837dfb76a790a544255df4d1533d08d5c01
SHA512

82261670afd3dc6fb2b5bf26c57fde56263dc0c46989e9a91094d77ad847ea9d376ee17773af06ed3306b6c7f6bb13bff17a6561680baf487ab58a492d8b560f
SSDEEP

6144:ogAL6Lsn1YNP2LohOGYw6CC5jTT453mjEIbWiGVAKSLFN+YInSCRvuPsxNR:ZA2LsSNOL2OGY/TTy2jEIJc6FNu3uPmr

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

wmic.exemshta.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2044	4948	wmic.exe	EXCEL.EXE
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3676	3952	mshta.exe

Blocklisted process makes network request 3 IoCs

Processes:

mshta.exe

flow pid process

28 3676 mshta.exe
30 3676 mshta.exe
32 3676 mshta.exe

flow	pid	process
28	3676	mshta.exe
30	3676	mshta.exe
32	3676	mshta.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

4948 EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 42 IoCs

Processes:

wmic.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2044	wmic.exe
Token: SeSecurityPrivilege	2044	wmic.exe
Token: SeTakeOwnershipPrivilege	2044	wmic.exe
Token: SeLoadDriverPrivilege	2044	wmic.exe
Token: SeSystemProfilePrivilege	2044	wmic.exe
Token: SeSystemtimePrivilege	2044	wmic.exe
Token: SeProfSingleProcessPrivilege	2044	wmic.exe
Token: SeIncBasePriorityPrivilege	2044	wmic.exe
Token: SeCreatePagefilePrivilege	2044	wmic.exe
Token: SeBackupPrivilege	2044	wmic.exe
Token: SeRestorePrivilege	2044	wmic.exe
Token: SeShutdownPrivilege	2044	wmic.exe
Token: SeDebugPrivilege	2044	wmic.exe
Token: SeSystemEnvironmentPrivilege	2044	wmic.exe
Token: SeRemoteShutdownPrivilege	2044	wmic.exe
Token: SeUndockPrivilege	2044	wmic.exe
Token: SeManageVolumePrivilege	2044	wmic.exe
Token: 33	2044	wmic.exe
Token: 34	2044	wmic.exe
Token: 35	2044	wmic.exe
Token: 36	2044	wmic.exe
Token: SeIncreaseQuotaPrivilege	2044	wmic.exe
Token: SeSecurityPrivilege	2044	wmic.exe
Token: SeTakeOwnershipPrivilege	2044	wmic.exe
Token: SeLoadDriverPrivilege	2044	wmic.exe
Token: SeSystemProfilePrivilege	2044	wmic.exe
Token: SeSystemtimePrivilege	2044	wmic.exe
Token: SeProfSingleProcessPrivilege	2044	wmic.exe
Token: SeIncBasePriorityPrivilege	2044	wmic.exe
Token: SeCreatePagefilePrivilege	2044	wmic.exe
Token: SeBackupPrivilege	2044	wmic.exe
Token: SeRestorePrivilege	2044	wmic.exe
Token: SeShutdownPrivilege	2044	wmic.exe
Token: SeDebugPrivilege	2044	wmic.exe
Token: SeSystemEnvironmentPrivilege	2044	wmic.exe
Token: SeRemoteShutdownPrivilege	2044	wmic.exe
Token: SeUndockPrivilege	2044	wmic.exe
Token: SeManageVolumePrivilege	2044	wmic.exe
Token: 33	2044	wmic.exe
Token: 34	2044	wmic.exe
Token: 35	2044	wmic.exe
Token: 36	2044	wmic.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

4948 EXCEL.EXE
4948 EXCEL.EXE

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

EXCEL.EXE

pid	process
4948	EXCEL.EXE
4948	EXCEL.EXE
4948	EXCEL.EXE
4948	EXCEL.EXE
4948	EXCEL.EXE
4948	EXCEL.EXE
4948	EXCEL.EXE
4948	EXCEL.EXE
4948	EXCEL.EXE
4948	EXCEL.EXE
4948	EXCEL.EXE
4948	EXCEL.EXE
4948	EXCEL.EXE
4948	EXCEL.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

EXCEL.EXE

description pid process target process

PID 4948 wrote to memory of 2044 4948 EXCEL.EXE wmic.exe
PID 4948 wrote to memory of 2044 4948 EXCEL.EXE wmic.exe

description	pid	process	target process
PID 4948 wrote to memory of 2044	4948	EXCEL.EXE	wmic.exe
PID 4948 wrote to memory of 2044	4948	EXCEL.EXE	wmic.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\f44a4e2d5fe0ef1d7e24afc0ea452031_JaffaCakes118.xlsb"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4948

C:\Windows\System32\Wbem\wmic.exe
wmic process call create 'mshta C:\ProgramData\Wcdsi.sct'
2⤵
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
PID:2044

C:\Windows\system32\mshta.exe
mshta C:\ProgramData\Wcdsi.sct
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
PID:3676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3708 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:1248

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Wcdsi.sct
Filesize
14KB

MD5
7b583f3646b7d03b337b2547863a49e9

SHA1
e5e45793ff7e1713c8979f3c5525347a2d3096a8

SHA256
3a3ad0b68d89617895c9f8070343bd569582848ee87e76bb8a28e0de64332b0e

SHA512
2bcaeebaa1552628d109b20232f96aa3521345c017a3903b1858e0489ffc6f0e98bdb1a04b95b296c9fcde12b995ec12106d6f4e6791f18c47353cf4bfddc917

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D176D8C6759A7C0E40952DD48FB4F430
Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
memory/4948-8-0x00007FFA09AD0000-0x00007FFA09CC5000-memory.dmp

Filesize
2.0MB

Download
memory/4948-78-0x00007FFA09AD0000-0x00007FFA09CC5000-memory.dmp

Filesize
2.0MB

Download
memory/4948-3-0x00007FF9C9B50000-0x00007FF9C9B60000-memory.dmp

Filesize
64KB

Download
memory/4948-6-0x00007FF9C9B50000-0x00007FF9C9B60000-memory.dmp

Filesize
64KB

Download
memory/4948-5-0x00007FFA09AD0000-0x00007FFA09CC5000-memory.dmp

Filesize
2.0MB

Download
memory/4948-7-0x00007FFA09AD0000-0x00007FFA09CC5000-memory.dmp

Filesize
2.0MB

Download
memory/4948-18-0x00007FFA09AD0000-0x00007FFA09CC5000-memory.dmp

Filesize
2.0MB

Download
memory/4948-9-0x00007FFA09AD0000-0x00007FFA09CC5000-memory.dmp

Filesize
2.0MB

Download
memory/4948-10-0x00007FFA09AD0000-0x00007FFA09CC5000-memory.dmp

Filesize
2.0MB

Download
memory/4948-11-0x00007FFA09AD0000-0x00007FFA09CC5000-memory.dmp

Filesize
2.0MB

Download
memory/4948-12-0x00007FFA09AD0000-0x00007FFA09CC5000-memory.dmp

Filesize
2.0MB

Download
memory/4948-13-0x00007FFA09AD0000-0x00007FFA09CC5000-memory.dmp

Filesize
2.0MB

Download
memory/4948-14-0x00007FF9C74B0000-0x00007FF9C74C0000-memory.dmp

Filesize
64KB

Download
memory/4948-15-0x00007FFA09AD0000-0x00007FFA09CC5000-memory.dmp

Filesize
2.0MB

Download
memory/4948-79-0x00007FFA09AD0000-0x00007FFA09CC5000-memory.dmp

Filesize
2.0MB

Download
memory/4948-4-0x00007FFA09AD0000-0x00007FFA09CC5000-memory.dmp

Filesize
2.0MB

Download
memory/4948-0-0x00007FF9C9B50000-0x00007FF9C9B60000-memory.dmp

Filesize
64KB

Download
memory/4948-19-0x00007FFA09AD0000-0x00007FFA09CC5000-memory.dmp

Filesize
2.0MB

Download
memory/4948-20-0x00007FF9C74B0000-0x00007FF9C74C0000-memory.dmp

Filesize
64KB

Download
memory/4948-21-0x00007FFA09AD0000-0x00007FFA09CC5000-memory.dmp

Filesize
2.0MB

Download
memory/4948-22-0x00007FFA09AD0000-0x00007FFA09CC5000-memory.dmp

Filesize
2.0MB

Download
memory/4948-2-0x00007FF9C9B50000-0x00007FF9C9B60000-memory.dmp

Filesize
64KB

Download
memory/4948-1-0x00007FF9C9B50000-0x00007FF9C9B60000-memory.dmp

Filesize
64KB

Download
memory/4948-54-0x00007FFA09AD0000-0x00007FFA09CC5000-memory.dmp

Filesize
2.0MB

Download
memory/4948-72-0x00007FF9C9B50000-0x00007FF9C9B60000-memory.dmp

Filesize
64KB

Download
memory/4948-73-0x00007FF9C9B50000-0x00007FF9C9B60000-memory.dmp

Filesize
64KB

Download
memory/4948-74-0x00007FF9C9B50000-0x00007FF9C9B60000-memory.dmp

Filesize
64KB

Download
memory/4948-75-0x00007FF9C9B50000-0x00007FF9C9B60000-memory.dmp

Filesize
64KB

Download
memory/4948-76-0x00007FFA09AD0000-0x00007FFA09CC5000-memory.dmp

Filesize
2.0MB

Download
memory/4948-17-0x00007FFA09AD0000-0x00007FFA09CC5000-memory.dmp

Filesize
2.0MB

Download
memory/4948-77-0x00007FFA09AD0000-0x00007FFA09CC5000-memory.dmp

Filesize
2.0MB

Download
memory/4948-16-0x00007FFA09AD0000-0x00007FFA09CC5000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads