Analysis
- max time kernel
148s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
17/04/2024, 08:09
General
- Target f556b8ce385fc52e5ab46da5238439bb_JaffaCakes118.xls
- Size 161KB
- Sample240417-j2gm4she55
- SHA256 14d0df467f121adf0e755600e9ff5142551b0ac4cfb8fa0356214d11567a9cc6
Malware Config
Signatures
- Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Suspicious Office macro 1 IoCs
Office document equipped with 4.0 macros.
- Deletes itself 1 IoCs
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 14 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\f556b8ce385fc52e5ab46da5238439bb_JaffaCakes118.xls"1⤵
- Deletes itself
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"3⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Del /F /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"2⤵
- Process spawned unexpected child process
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c RD /S /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"2⤵
- Process spawned unexpected child process
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
f556b8ce385fc52e5ab46da5238439bb_JaffaCakes118.xls
memory/880-1-0x00007FFD57BB0000-0x00007FFD57DA5000-memory.dmp
memory/880-0-0x00007FFD17C30000-0x00007FFD17C40000-memory.dmp
memory/880-2-0x00007FFD17C30000-0x00007FFD17C40000-memory.dmp
memory/880-3-0x00007FFD17C30000-0x00007FFD17C40000-memory.dmp
memory/880-4-0x00007FFD57BB0000-0x00007FFD57DA5000-memory.dmp
memory/880-7-0x00007FFD17C30000-0x00007FFD17C40000-memory.dmp
memory/880-6-0x00007FFD57BB0000-0x00007FFD57DA5000-memory.dmp
memory/880-8-0x00007FFD57BB0000-0x00007FFD57DA5000-memory.dmp
memory/880-5-0x00007FFD17C30000-0x00007FFD17C40000-memory.dmp
memory/880-9-0x00007FFD57BB0000-0x00007FFD57DA5000-memory.dmp
memory/880-10-0x00007FFD15B30000-0x00007FFD15B40000-memory.dmp
memory/880-11-0x00007FFD57BB0000-0x00007FFD57DA5000-memory.dmp
memory/880-12-0x00007FFD57BB0000-0x00007FFD57DA5000-memory.dmp
memory/880-13-0x00007FFD57BB0000-0x00007FFD57DA5000-memory.dmp
memory/880-15-0x00007FFD57BB0000-0x00007FFD57DA5000-memory.dmp
memory/880-16-0x00007FFD57BB0000-0x00007FFD57DA5000-memory.dmp
memory/880-17-0x00007FFD57BB0000-0x00007FFD57DA5000-memory.dmp
memory/880-14-0x00007FFD15B30000-0x00007FFD15B40000-memory.dmp
memory/880-18-0x00007FFD57BB0000-0x00007FFD57DA5000-memory.dmp
memory/880-31-0x000002B5B56C0000-0x000002B5B5EC0000-memory.dmp
memory/880-41-0x000002B5B56C0000-0x000002B5B5EC0000-memory.dmp
memory/880-44-0x000002B5B56C0000-0x000002B5B5EC0000-memory.dmp
memory/880-48-0x000002B5B8410000-0x000002B5B93E0000-memory.dmp
memory/880-53-0x000002B5B8410000-0x000002B5B93E0000-memory.dmp
memory/880-55-0x000002B5B8410000-0x000002B5B93E0000-memory.dmp
memory/880-58-0x000002B5B8410000-0x000002B5B93E0000-memory.dmp
memory/880-61-0x000002B5B8410000-0x000002B5B93E0000-memory.dmp
memory/880-62-0x000002B5B8410000-0x000002B5B93E0000-memory.dmp
memory/880-63-0x000002B5B8410000-0x000002B5B93E0000-memory.dmp
memory/880-67-0x000002B5B8410000-0x000002B5B93E0000-memory.dmp
memory/880-75-0x000002B5B56C0000-0x000002B5B5EC0000-memory.dmp
memory/880-79-0x000002B5B8410000-0x000002B5B93E0000-memory.dmp
memory/880-82-0x000002B5B8410000-0x000002B5B93E0000-memory.dmp
memory/880-97-0x000002B5B8410000-0x000002B5B93E0000-memory.dmp
memory/880-101-0x00007FFD57BB0000-0x00007FFD57DA5000-memory.dmp
memory/880-102-0x000002B5B56C0000-0x000002B5B5EC0000-memory.dmp
memory/880-110-0x00007FFD57BB0000-0x00007FFD57DA5000-memory.dmp
memory/880-111-0x00007FFD57BB0000-0x00007FFD57DA5000-memory.dmp
memory/880-112-0x000002B5B56C0000-0x000002B5B5EC0000-memory.dmp
memory/880-113-0x000002B5B56C0000-0x000002B5B5EC0000-memory.dmp
memory/880-114-0x000002B5B56C0000-0x000002B5B5EC0000-memory.dmp
memory/880-115-0x000002B5B8410000-0x000002B5B93E0000-memory.dmp
memory/880-116-0x000002B5B8410000-0x000002B5B93E0000-memory.dmp
memory/880-119-0x000002B5B8410000-0x000002B5B93E0000-memory.dmp
memory/880-120-0x000002B5B8410000-0x000002B5B93E0000-memory.dmp
memory/880-121-0x000002B5B8410000-0x000002B5B93E0000-memory.dmp
memory/880-122-0x000002B5B8410000-0x000002B5B93E0000-memory.dmp
memory/880-123-0x000002B5B8410000-0x000002B5B93E0000-memory.dmp
memory/880-124-0x000002B5B8410000-0x000002B5B93E0000-memory.dmp
memory/880-125-0x000002B5B56C0000-0x000002B5B5EC0000-memory.dmp
memory/880-126-0x000002B5B8410000-0x000002B5B93E0000-memory.dmp
memory/880-127-0x000002B5B8410000-0x000002B5B93E0000-memory.dmp
memory/880-128-0x000002B5B56C0000-0x000002B5B5EC0000-memory.dmp
memory/880-144-0x00007FFD17C30000-0x00007FFD17C40000-memory.dmp
memory/880-145-0x00007FFD17C30000-0x00007FFD17C40000-memory.dmp
memory/880-146-0x00007FFD17C30000-0x00007FFD17C40000-memory.dmp
memory/880-147-0x00007FFD17C30000-0x00007FFD17C40000-memory.dmp
memory/880-148-0x00007FFD57BB0000-0x00007FFD57DA5000-memory.dmp