Analysis
-
max time kernel
141s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
25/05/2024, 22:49
General
-
Target
73828f9d183d9d9004591767ef21da13_JaffaCakes118.xls
-
Size
96KB
-
MD5
73828f9d183d9d9004591767ef21da13
-
SHA1
8ab7fa25e9c8ec1b5cfc275da5592c6068c214fc
-
SHA256
0ebfbcbf8c35ff8cbf36e38799b5129c7b70c6895d5f11d1ab562a511a2ec76e
-
SHA512
8d93a3842e76c07166ab4294bd747233822fb47a78a23872cc426fc392cc733f80302310694cb2324313cf4c7d263485930257f18e32b239b8fb6a7b7a6bb173
-
SSDEEP
1536:olk3hbdlylKsgqopeJBWhZFGkE+cL2NdAxNny/KgoducuZg3qGa2h1//o2JVVHsD:olk3hbdlylKsgqopeJBWhZFGkE+cL2N9
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\73828f9d183d9d9004591767ef21da13_JaffaCakes118.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\iweei.exeC:\Users\Admin\AppData\Roaming\iweei.exe2⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1412 --field-trial-handle=2676,i,447940133669489189,1353734109898858672,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
303B
MD5043237190ec4d14646756b5afe4ddb57
SHA1509430ca42d60453822d3f98213319087fde01f6
SHA2567b7083644c1f1e918fcd1f5d5e07e831a2d3d3f49ab5a5456dee060fa7fd7620
SHA5128f69aa6c5abe183b110663bd862389518d053dc112013bfe77e7832088d2de662153974816e8f65ef62e3ab87cd81fb9a26e4279035bf3c377bb1004fa6e0b68
-
Filesize
3KB
MD50df0331538f0a21c2c160f77d1221fb3
SHA112b853bb37352eeb3ea08d74226b465d73b8a233
SHA256502c4c424c8f435254953c1d32a1f7ae1e67fb88ebd7a31594afc7278dcafde3
SHA512873264231142f679a3cb81af34710fff92f13d71bf2f3f32276897d091ba665a2cd96cfc73f8b63296a8d4770677f21a3a797dfb75dc18c7370678a5508c1397
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
8KB