Analysis
-
max time kernel
107s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
22-05-2024 13:26
General
-
Target
676922539240c0d6bd398047c1cbe8d7_JaffaCakes118.xls
-
Size
279KB
-
MD5
676922539240c0d6bd398047c1cbe8d7
-
SHA1
ed5d52bd83409a2f8ff464619adf44776a3f1f3b
-
SHA256
1d0ded5dbc6d2996e273f518bdab013ba9217ed76e197c44e7ef00f536967b9a
-
SHA512
274fe4bab14177555237e50f8244faca1bd82eaaa6a5674c98e36f587c0e5d66589ac0eb0792be4943841850bd47eef9e6e3e7597acc942adfabf9c77ba63fa2
-
SSDEEP
6144:1NoClbz7R41azKaSk3hOdsylKlgryzc4bNhZF+E+W/gEpIrcNaOwMmF7OCt:FVR442iIVhF7zt
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 27 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\676922539240c0d6bd398047c1cbe8d7_JaffaCakes118.xls"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
150KB
MD50ec8b5f53e39f10fcdee8d5fdbb6d5f4
SHA1859f1ebef09451fff18ee69abc0ab92b1c5e0e68
SHA2560572a2228abcb669538c71b6c75483121238b0ddd00af4a983a9d78ee127902c
SHA5129c5e3ff6b7f7eaab505d5c2b9472822b302818aad2fbfe672026cc9827c7cd23a4b87d160fafeaa4c96f5908b869997fe26e62db5aaf80fd3684c7641a85fcb1
-
Filesize
67KB
MD5c14b962b8f828dba43305542b722b48b
SHA139f750689b5d865936e6f5e6cc4fe8877065fca1
SHA256511ecf63f0bce7287c1ed6c931a94761b9425f3def1aea3398cb1765cd472166
SHA512c52e1cf0bb453dbe8901133f370f1a05a7e9489940843bb4e33c91a0b6e989e42e2bee73a329aa91174c42066b6c97942cc1b9c1931e71e91bbbb7df5f7d589b
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB