Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2024, 09:52
Static task
static1
Behavioral task
behavioral1
Sample
412e58acb2250b3740957cb398693633_JaffaCakes118.xls
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
412e58acb2250b3740957cb398693633_JaffaCakes118.xls
Resource
win10v2004-20240709-en
General
-
Target
412e58acb2250b3740957cb398693633_JaffaCakes118.xls
-
Size
26KB
-
MD5
412e58acb2250b3740957cb398693633
-
SHA1
e0e161773ec6560461565755b6506e6aece38085
-
SHA256
1677b4ad7e0c414d00dec04361330eb7b0d7c54184d67b3d9283b96e5d7572a9
-
SHA512
11951a5b2876a11ee43f17ea5c15d5c1810363b540f40068e8a286239789b8ee7e33c1c6e428bfbfcc0bedbbc01839a60c1fb7f557de4b53eea2ba438bb5f9f9
-
SSDEEP
768:K3333TvVnK6s6bR2graqw/nnNpBICmsMnl/j5v:K3333TvVnK6s6frE/mtl/B
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1044 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 14 IoCs
pid Process 1044 EXCEL.EXE 1044 EXCEL.EXE 1044 EXCEL.EXE 1044 EXCEL.EXE 1044 EXCEL.EXE 1044 EXCEL.EXE 1044 EXCEL.EXE 1044 EXCEL.EXE 1044 EXCEL.EXE 1044 EXCEL.EXE 1044 EXCEL.EXE 1044 EXCEL.EXE 1044 EXCEL.EXE 1044 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\412e58acb2250b3740957cb398693633_JaffaCakes118.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1044
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a5d0d0bea4e5ce6f3390e4e26be10a23
SHA1cf142e15bbc9a205d984f2baeb9e6179c6922ed0
SHA2565894baecdb13f4f543ae31a09635af308d921e7b750c1ad92a0e78eb2ac0e55f
SHA51236ff3bb141fd0fd49bc0ba3a8031b00706faae84bbfac691188d05c23eb78b58557a071d02649f5dfa745c7dd4fc136860a4cda07a928c2f447d0de5cc1d3acf
-
Filesize
376B
MD53ca96df53b153fc19bc42a29beaacdb0
SHA1d976843ffa121f95715a32d08801520e2515685e
SHA256e476e007cd445dc595eb6ccc74e759019dabf504254c390c8d1e873648545d37
SHA51246828be714642c7915e01703ec57bd0b8c500e2045c777e40694251b62fa40ee841c54101668c22e5396d31c9eef8e82d4d2e54548b5f7df7a13633a4d98e753