Analysis
-
max time kernel
99s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 07:46
Static task
static1
Behavioral task
behavioral1
Sample
910000e74e3b0954d2ce23c2c5883350_JaffaCakes118.xlsx
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
910000e74e3b0954d2ce23c2c5883350_JaffaCakes118.xlsx
Resource
win10v2004-20240508-en
General
-
Target
910000e74e3b0954d2ce23c2c5883350_JaffaCakes118.xlsx
-
Size
45KB
-
MD5
910000e74e3b0954d2ce23c2c5883350
-
SHA1
99d010e702f7740e7dbac6806e157fb68c50c087
-
SHA256
9efe3fed36b906153b16a349abdd040028cb1446fae20b3c6b63b4723a2edbdc
-
SHA512
e0ed4c9094bee754ec1a788c73f867e27f1bdd1af2da9a52cae09e1ce511661c0d16e0aa9d6931c748f900c654fbbb4d1fa4c8a92c0e4a74128b337aef777e55
-
SSDEEP
768:v7Rxvj9E7OGOE7x/2G7Y1SHT6/TarhxMpOXzqIvLKzgbgqmorTdMXG5Y84Jm:vFx7+JldYoHk2hx7jboCpDn
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4228 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4228 EXCEL.EXE 4228 EXCEL.EXE 4228 EXCEL.EXE 4228 EXCEL.EXE 4228 EXCEL.EXE 4228 EXCEL.EXE 4228 EXCEL.EXE 4228 EXCEL.EXE 4228 EXCEL.EXE 4228 EXCEL.EXE 4228 EXCEL.EXE 4228 EXCEL.EXE -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\910000e74e3b0954d2ce23c2c5883350_JaffaCakes118.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4228