Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
21/04/2024, 17:22
General
-
Target
ffc881191b9d0891dc45709b5f2b2a4d_JaffaCakes118.xls
-
Size
36KB
-
MD5
ffc881191b9d0891dc45709b5f2b2a4d
-
SHA1
e51e1f566aad276a19412d85ad8c9b50a0c2b069
-
SHA256
3a64f774b996ea2c2e9ae641174756ccf892ea8b74860d04d23d916a5b76ed46
-
SHA512
8b0e2230a169c73ff126deadf00917fb0c3bfe1eb2748716359abca89f64092b9bc0dd83d31c8a315081f0a918a4b42e4138e74d112a6343bebe241ff3423f2c
-
SSDEEP
768:GPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJeypD++AeiXTEc/Sg4WMPTm:6ok3hbdlylKsgqopeJBWhZFGkE+cL2N9
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 2 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ffc881191b9d0891dc45709b5f2b2a4d_JaffaCakes118.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe C:\Users\Public\Documents\shEV7A.vbs2⤵
- Process spawned unexpected child process
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\shEV7A.vbs"2⤵
- Blocklisted process makes network request
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
544B
MD5512bea476b7ded519947b568fcf4d7a4
SHA1f8972284a1a11e5ea8a8ccf027a76566010dd204
SHA2564529c1d2d37eddcd2797729a7c45c2c32c6d92996aa0228c773a3c9f3daa6636
SHA5128668d6a368e369abe976c0741d1fa48cb2aedbb35b806e6c1bb55e1e7610a195dd2f33368c50c037f41ffed76bb45b3d56ebde139d9d3d6be4e0185606965e94
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB