Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
24-07-2024 12:42
Behavioral task
behavioral1
Sample
6b8ba0608e180d21c6a6a1211767308e_JaffaCakes118.xls
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6b8ba0608e180d21c6a6a1211767308e_JaffaCakes118.xls
Resource
win10v2004-20240709-en
General
-
Target
6b8ba0608e180d21c6a6a1211767308e_JaffaCakes118.xls
-
Size
25KB
-
MD5
6b8ba0608e180d21c6a6a1211767308e
-
SHA1
ab851257b0128cbe9416ec86fc22c6b7b5121e66
-
SHA256
f70cec7467c9a84306e788e0455391c7c4126bd51afb8290599fe28bfc9b233a
-
SHA512
3386d186fffb2f781edd1fd8958d1faf7a9702569092c4b8af3eba30e795e9e7935c5e916615e7e28cdabdf8286b8fcd6ce86c85c9bf85abea452c43e1b89f58
-
SSDEEP
384:X6M6v1us6Zz+4+9WBE/FzKdz1MdhsK/gpdbE2dymeeUyg:KM6v1uhZz+4+e8s2DIpddzg
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2368 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2368 EXCEL.EXE 2368 EXCEL.EXE 2368 EXCEL.EXE
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\6b8ba0608e180d21c6a6a1211767308e_JaffaCakes118.xls1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2368