Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-09-2024 06:13

General

  • Target

    d14185b59ad9d69f08574eb6d332360c_JaffaCakes118.xls

  • Size

    110KB

  • MD5

    d14185b59ad9d69f08574eb6d332360c

  • SHA1

    4ef20704cfe855d18bcc4c053f132133d82b0ded

  • SHA256

    f6079cde5ac52325578ee54cb2d3353f35ff3a727e453097656812864fb83260

  • SHA512

    7f7e781cf2cc160010fe9b7826c49f591bb03d99b0e99d1ab7be99944e94979ad54869a8910adbd8304d8804bb19485eaa26524c4d88de47ed02d6813fcc4228

  • SSDEEP

    3072:9/7uDphYHceXVhca+fMHLtyeGxcl8/dgj6YsFmDJEFB6cn4p55wY5pcz8hd:57uDphYHceXVhca+fMHLty/xcl8/dgiu

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

http://bartstoppel.com/rqfardzsgihu/555555555.png

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d14185b59ad9d69f08574eb6d332360c_JaffaCakes118.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1244

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    4KB

    MD5

    3a839828d1507b6b6001ca2670ca15d0

    SHA1

    deb3f1553006d8305e38f7807c9adb72b5eebd69

    SHA256

    49ef7a4c3222c1917e3c929b016ad785fadeb937cc8c2b91eb841eeb16a8596b

    SHA512

    aed434af98dd5c67db962d7249b0bdd323ad1c9be9a5c043ce4e4c516b737dd5f0523472e4c72a9fa23097a9ef27c66c3274f23babd144a57fb27aa3e7eeb324

  • memory/1244-12-0x00007FFB2D540000-0x00007FFB2D550000-memory.dmp

    Filesize

    64KB

  • memory/1244-0-0x00007FFB2FE50000-0x00007FFB2FE60000-memory.dmp

    Filesize

    64KB

  • memory/1244-5-0x00007FFB2FE50000-0x00007FFB2FE60000-memory.dmp

    Filesize

    64KB

  • memory/1244-2-0x00007FFB2FE50000-0x00007FFB2FE60000-memory.dmp

    Filesize

    64KB

  • memory/1244-6-0x00007FFB6FDD0000-0x00007FFB6FFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1244-9-0x00007FFB6FDD0000-0x00007FFB6FFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1244-8-0x00007FFB6FDD0000-0x00007FFB6FFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1244-10-0x00007FFB6FDD0000-0x00007FFB6FFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1244-11-0x00007FFB2D540000-0x00007FFB2D550000-memory.dmp

    Filesize

    64KB

  • memory/1244-14-0x00007FFB6FDD0000-0x00007FFB6FFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1244-4-0x00007FFB2FE50000-0x00007FFB2FE60000-memory.dmp

    Filesize

    64KB

  • memory/1244-3-0x00007FFB2FE50000-0x00007FFB2FE60000-memory.dmp

    Filesize

    64KB

  • memory/1244-7-0x00007FFB6FDD0000-0x00007FFB6FFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1244-15-0x00007FFB6FDD0000-0x00007FFB6FFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1244-13-0x00007FFB6FDD0000-0x00007FFB6FFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1244-17-0x00007FFB6FDD0000-0x00007FFB6FFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1244-18-0x00007FFB6FDD0000-0x00007FFB6FFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1244-16-0x00007FFB6FDD0000-0x00007FFB6FFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1244-34-0x00007FFB6FDD0000-0x00007FFB6FFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1244-35-0x00007FFB6FE6D000-0x00007FFB6FE6E000-memory.dmp

    Filesize

    4KB

  • memory/1244-36-0x00007FFB6FDD0000-0x00007FFB6FFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1244-37-0x00007FFB6FDD0000-0x00007FFB6FFC5000-memory.dmp

    Filesize

    2.0MB

  • memory/1244-1-0x00007FFB6FE6D000-0x00007FFB6FE6E000-memory.dmp

    Filesize

    4KB