Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 10:00
Behavioral task
behavioral1
Sample
0da5c7a1740cdd66e88a17b629e656b5_JaffaCakes118.xls
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0da5c7a1740cdd66e88a17b629e656b5_JaffaCakes118.xls
Resource
win10v2004-20240508-en
General
-
Target
0da5c7a1740cdd66e88a17b629e656b5_JaffaCakes118.xls
-
Size
167KB
-
MD5
0da5c7a1740cdd66e88a17b629e656b5
-
SHA1
fe58b2a6caaa9f515b7cb7872646486a21b684f6
-
SHA256
d2a85dd92404f17d5d2d6f1ae175dd9dadde770db28619c31feb66a9170dc4da
-
SHA512
cba37df0756d5b9db426408ab58ef0960f58be01d73339fd6ff4859451730624117b70e330fae9d20a52f28896d4f0154563f6c91236190d8f97f75620f9234c
-
SSDEEP
3072:SgxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAs8fbBW66CQt+RmaiIT54rLyBm8hwNSk:9xEtjPOtioVjDGUU1qfDlavx+W2QnAPS
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4600 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 4600 EXCEL.EXE 4600 EXCEL.EXE 4600 EXCEL.EXE 4600 EXCEL.EXE 4600 EXCEL.EXE 4600 EXCEL.EXE 4600 EXCEL.EXE 4600 EXCEL.EXE 4600 EXCEL.EXE 4600 EXCEL.EXE 4600 EXCEL.EXE 4600 EXCEL.EXE 4600 EXCEL.EXE 4600 EXCEL.EXE 4600 EXCEL.EXE 4600 EXCEL.EXE 4600 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0da5c7a1740cdd66e88a17b629e656b5_JaffaCakes118.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4600