Analysis
-
max time kernel
139s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
17-05-2024 17:47
General
-
Target
50b64ba34366fad2adb945ed87c4911d_JaffaCakes118.xls
-
Size
279KB
-
MD5
50b64ba34366fad2adb945ed87c4911d
-
SHA1
370be8397eb051e0a7b53000479b3fd6d72eb031
-
SHA256
5267210ae28394fdb5718e7304bb5840057d7d09b80a901964953078f46cd776
-
SHA512
2b568a5f43e9bea054dd081dd8030fc088c9c62616173b97b144017418484ce54fa072f4ce55131afe7f8822239ae0736af5de193e5adc54a552029c13d7531a
-
SSDEEP
6144:EJ/2oYVsOpIlo8WRVNgOk3hOdsylKlgryzc4bNhZF+E+W/gEaiKkJgia16cC5fJ4:qz2hmlfmpiHWiP4
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 18 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\50b64ba34366fad2adb945ed87c4911d_JaffaCakes118.xls"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
MD54a2754ca49d1d595f43d6d8c3ddaf024
SHA1b214e5adcd53004303b25b7de8b4006245ab5d8b
SHA25612d075a57c9a9f0893129aff4811af59726d0ae1265d9721556e73a77fde79e3
SHA5120d3cbd61682a59eaa4e8bc33b0d5bcc21ecac92a13b8c9fb6b718f28112872f4456700d8a17341302dd26aa24c6c4b1bae740e8f779acac6cf4985e3d4fd6469
-
Filesize
64KB
MD55467e81b6c5417af0dcc566605b13481
SHA1eeecc25656f290630dcfe30218cdb69bb0f316aa
SHA256257bee57c5cac49ce0b5f9b160a3aaafde703ecc036cf4cf32975fc08c7f445e
SHA512baf888cd4fcd929b973fedbb791d5e1e320fd4fff0aa15372fa94a0d898e9942ac80bf8965caa5dc8565077ee9928aa6fa3997d7ab114914a08bd863a8789c48
-
Filesize
2.0MB
-
Filesize
120KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
120KB
-
Filesize
2.0MB
-
Filesize
2.0MB