Malware Analysis Report

2025-03-15 07:58

Sample ID 240816-t3mkvsvejb
Target 9f22824d8ae8bef36a655835e0d88bff_JaffaCakes118
SHA256 06f81bfdf847b3ac7bd86b12d5ccdba75190eb87766e735eb114857e2c7a7d11
Tags
macro macro_on_action discovery
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

06f81bfdf847b3ac7bd86b12d5ccdba75190eb87766e735eb114857e2c7a7d11

Threat Level: Likely malicious

The file 9f22824d8ae8bef36a655835e0d88bff_JaffaCakes118 was found to be: Likely malicious.

Malicious Activity Summary

macro macro_on_action discovery

Suspicious Office macro

Office macro that triggers on suspicious action

Deletes itself

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Office loads VBA resources, possible macro or embedded object present

Checks processor information in registry

Enumerates system info in registry

NTFS ADS

Suspicious use of SetWindowsHookEx

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: RenamesItself

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-16 16:35

Signatures

Office macro that triggers on suspicious action

macro macro_on_action
Description Indicator Process Target
N/A N/A N/A N/A

Suspicious Office macro

macro
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-16 16:35

Reported

2024-08-16 16:37

Platform

win10v2004-20240802-en

Max time kernel

136s

Max time network

138s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\9f22824d8ae8bef36a655835e0d88bff_JaffaCakes118.xls"

Signatures

Office macro that triggers on suspicious action

macro macro_on_action
Description Indicator Process Target
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Microsoft Office\Root\Office16\Library\Analysis\97B75E00 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
File opened for modification C:\Program Files\Microsoft Office\Root\Office16\Library\Analysis\rom.xla C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Temp\08B75E00\:Zone.Identifier:$DATA C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\9f22824d8ae8bef36a655835e0d88bff_JaffaCakes118.xls"

Network

Country Destination Domain Proto
US 8.8.8.8:53 roaming.officeapps.live.com udp
GB 52.109.28.47:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 18.89.109.52.in-addr.arpa udp
US 8.8.8.8:53 47.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 103.242.123.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 147.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 90.16.208.104.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 99.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 52.111.229.48:443 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp

Files

memory/3952-1-0x00007FFEADECD000-0x00007FFEADECE000-memory.dmp

memory/3952-0-0x00007FFE6DEB0000-0x00007FFE6DEC0000-memory.dmp

memory/3952-4-0x00007FFE6DEB0000-0x00007FFE6DEC0000-memory.dmp

memory/3952-3-0x00007FFE6DEB0000-0x00007FFE6DEC0000-memory.dmp

memory/3952-5-0x00007FFE6DEB0000-0x00007FFE6DEC0000-memory.dmp

memory/3952-9-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-13-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-12-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-14-0x00007FFE6BCF0000-0x00007FFE6BD00000-memory.dmp

memory/3952-11-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-10-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-15-0x00007FFE6BCF0000-0x00007FFE6BD00000-memory.dmp

memory/3952-8-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-16-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-20-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-22-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-21-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-19-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-18-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-17-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-7-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-6-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-2-0x00007FFE6DEB0000-0x00007FFE6DEC0000-memory.dmp

memory/3952-46-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-47-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-48-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-45-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-50-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-53-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

MD5 2742b4a39934d0b4e60ae3ae67e5443d
SHA1 7ee5724aba8686de504d696467aa9833951d009b
SHA256 b6681cc43030c007c878c57c4d33cfa693aa409127ef89ff55a5854925663065
SHA512 699516a8ebb0b3c0043bce078d6d7c86cc64e64964396f24f94b6fb065db9f66ba48eeae862ccbe77eac3519e0f64d8b9ac38605a53388c2f4c956b2b880da82

memory/3952-68-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9f22824d8ae8bef36a655835e0d88bff_JaffaCakes118.xls

MD5 de8db0092f33f4739bd046e40232a1d6
SHA1 6ec51d45270cd716644e2c5a273cf36c15decca5
SHA256 31b5d627a6773ab2055ae01bac92f45d916353bc1e9d81f1d47f6ddad72062a3
SHA512 d2b7036468a342b28fa60ad888e7e437aaddf359f54c0e3b1cf5a5651c57ca06b84a9bf038cf4ac61a7279ff93175c4e254df49d4add765b1a1dc666983a8bf0

memory/3952-94-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-93-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-96-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-95-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-98-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-97-0x00007FFEADECD000-0x00007FFEADECE000-memory.dmp

memory/3952-99-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-100-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-101-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-102-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

memory/3952-110-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

MD5 a4fdceac3a205f05cd7298a6a162d2d0
SHA1 b5ec748f1e8e05e8bb75702e8b53d5215aa2bd0c
SHA256 090a9ec9f4b834b5e76c3a12ea81e5e528e91a36c2454f5fef6c5a58e869e5eb
SHA512 4a66fce9a17e2c7bc77fb2d9ad584ef4faa573665502a080fd8b521552f3c3b85e69df5b7d1eaf0634c52e58499e1168d52a8a022fb4a399bb40759f31102381

memory/3952-141-0x00007FFE6DEB0000-0x00007FFE6DEC0000-memory.dmp

memory/3952-144-0x00007FFE6DEB0000-0x00007FFE6DEC0000-memory.dmp

memory/3952-143-0x00007FFE6DEB0000-0x00007FFE6DEC0000-memory.dmp

memory/3952-142-0x00007FFE6DEB0000-0x00007FFE6DEC0000-memory.dmp

memory/3952-145-0x00007FFEADE30000-0x00007FFEAE025000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-16 16:35

Reported

2024-08-16 16:37

Platform

win7-20240729-en

Max time kernel

122s

Max time network

123s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\9f22824d8ae8bef36a655835e0d88bff_JaffaCakes118.xls

Signatures

Deletes itself

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\1D377F00 C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Library\Analysis\rom.xla C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Office loads VBA resources, possible macro or embedded object present

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

NTFS ADS

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Temp\5D377F00\:Zone.Identifier:$DATA C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Processes

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\9f22824d8ae8bef36a655835e0d88bff_JaffaCakes118.xls

Network

N/A

Files

memory/2868-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2868-1-0x000000007297D000-0x0000000072988000-memory.dmp

memory/2868-8-0x0000000006700000-0x0000000006800000-memory.dmp

memory/2868-4-0x0000000000290000-0x0000000000390000-memory.dmp

memory/2868-5-0x0000000000290000-0x0000000000390000-memory.dmp

memory/2868-6-0x0000000000290000-0x0000000000390000-memory.dmp

memory/2868-9-0x0000000000290000-0x0000000000390000-memory.dmp

memory/2868-7-0x0000000000290000-0x0000000000390000-memory.dmp

memory/2868-11-0x0000000000290000-0x0000000000390000-memory.dmp

memory/2868-21-0x0000000000290000-0x0000000000390000-memory.dmp

memory/2868-10-0x0000000000290000-0x0000000000390000-memory.dmp

memory/2868-13-0x0000000000290000-0x0000000000390000-memory.dmp

memory/2868-14-0x0000000000290000-0x0000000000390000-memory.dmp

memory/2868-12-0x0000000000290000-0x0000000000390000-memory.dmp

memory/2868-59-0x0000000006700000-0x0000000006800000-memory.dmp

memory/2868-60-0x000000007297D000-0x0000000072988000-memory.dmp

memory/2868-61-0x0000000006700000-0x0000000006800000-memory.dmp

memory/2868-62-0x0000000000290000-0x0000000000390000-memory.dmp

memory/2868-73-0x0000000000290000-0x0000000000390000-memory.dmp

memory/2868-72-0x0000000000290000-0x0000000000390000-memory.dmp

memory/2868-74-0x0000000006700000-0x0000000006800000-memory.dmp

memory/2868-85-0x0000000006700000-0x0000000006800000-memory.dmp

memory/2868-86-0x0000000000290000-0x0000000000390000-memory.dmp

memory/2868-87-0x0000000000290000-0x0000000000390000-memory.dmp

memory/2868-88-0x0000000006700000-0x0000000006800000-memory.dmp

memory/2868-89-0x0000000006700000-0x0000000006800000-memory.dmp

memory/2868-90-0x0000000000290000-0x0000000000390000-memory.dmp

memory/2868-91-0x0000000006700000-0x0000000006800000-memory.dmp

memory/2868-95-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2868-96-0x000000007297D000-0x0000000072988000-memory.dmp