Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17-04-2024 06:39
Behavioral task
behavioral1
Sample
f5343e1827bb270cb9b058d5cfa9ca03_JaffaCakes118.xls
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f5343e1827bb270cb9b058d5cfa9ca03_JaffaCakes118.xls
Resource
win10v2004-20240412-en
General
-
Target
f5343e1827bb270cb9b058d5cfa9ca03_JaffaCakes118.xls
-
Size
29KB
-
MD5
f5343e1827bb270cb9b058d5cfa9ca03
-
SHA1
8cf2b30c81329ad5da0babbf53fed4c9b2dd82fe
-
SHA256
69b13a5299f6a53ca34ea295cfd2f8b4fed452e29163d1c50a79e453270fa381
-
SHA512
75bd1e259d9ba71a9d4c5e9932852078a7a70cb1d92f6c750f2db9e5601306228900d9c8a57cd7017ac89758355429abbcb7f7e4007a90829beaa596c3cdbc12
-
SSDEEP
768:bddddB5c9R2DO0uSzJ95Oa4A0M/aiPmnUaRTQuc4mIZPU:bddddB5cd0uSFOaP
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1056 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 64 IoCs
Processes:
EXCEL.EXEpid process 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE 1056 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\f5343e1827bb270cb9b058d5cfa9ca03_JaffaCakes118.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1056-0-0x00007FFE72330000-0x00007FFE72340000-memory.dmpFilesize
64KB
-
memory/1056-1-0x00007FFE72330000-0x00007FFE72340000-memory.dmpFilesize
64KB
-
memory/1056-2-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-3-0x00007FFE72330000-0x00007FFE72340000-memory.dmpFilesize
64KB
-
memory/1056-6-0x00007FFE72330000-0x00007FFE72340000-memory.dmpFilesize
64KB
-
memory/1056-5-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-7-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-4-0x00007FFE72330000-0x00007FFE72340000-memory.dmpFilesize
64KB
-
memory/1056-8-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-9-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-10-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-12-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-13-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-14-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-11-0x00007FFE6FEC0000-0x00007FFE6FED0000-memory.dmpFilesize
64KB
-
memory/1056-15-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-16-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-18-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-17-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-20-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-19-0x00007FFE6FEC0000-0x00007FFE6FED0000-memory.dmpFilesize
64KB
-
memory/1056-29-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-30-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-31-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-32-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-34-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-35-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-33-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-37-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-38-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-36-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB
-
memory/1056-39-0x00007FFEB22B0000-0x00007FFEB24A5000-memory.dmpFilesize
2.0MB