Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25-06-2024 12:41
Behavioral task
behavioral1
Sample
0e1dac656c1e1819e5403d1c3f4561a8_JaffaCakes118.xls
Resource
win7-20240220-en
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
0e1dac656c1e1819e5403d1c3f4561a8_JaffaCakes118.xls
Resource
win10v2004-20240226-en
6 signatures
150 seconds
General
-
Target
0e1dac656c1e1819e5403d1c3f4561a8_JaffaCakes118.xls
-
Size
36KB
-
MD5
0e1dac656c1e1819e5403d1c3f4561a8
-
SHA1
65aa1c7af2b69ada1aa0dd8bbf81c2889daabb0d
-
SHA256
8d1dd4ccaa4417e2276bdf2aeafe9b660fdf8b45514e15b429914d3ae0b06e8d
-
SHA512
210836ccfe5848fb5a770269ef3c86dcc91ae41433da195ce8697a29f99d060efbe37d4f4c322c25863766099c41705442bbe8cdfff99ff95e94afbf24b8d72c
-
SSDEEP
384:j2xZPerxzlRueaDhBcwsjfdvybRxlEI2AT:yrPer9lRueaDhBcwsjfdvS2
Score
1/10
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 648 EXCEL.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 648 EXCEL.EXE 648 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE 648 EXCEL.EXE -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 648 wrote to memory of 1408 648 EXCEL.EXE 95 PID 648 wrote to memory of 1408 648 EXCEL.EXE 95
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0e1dac656c1e1819e5403d1c3f4561a8_JaffaCakes118.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1408
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵PID:4608
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵PID:4804