Analysis
-
max time kernel
144s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-09-2024 21:23
Behavioral task
behavioral1
Sample
d2dd2ad3aafbf259297a4b301987f273_JaffaCakes118.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d2dd2ad3aafbf259297a4b301987f273_JaffaCakes118.xls
Resource
win10v2004-20240802-en
General
-
Target
d2dd2ad3aafbf259297a4b301987f273_JaffaCakes118.xls
-
Size
165KB
-
MD5
d2dd2ad3aafbf259297a4b301987f273
-
SHA1
93880806803e44c3ae6bccb4c401be03a59a757a
-
SHA256
122753162ae8f8453d6c50ff11591008c54d18f26e9a0e64549fb7a0925c0ab8
-
SHA512
5ef96b841a1562c3785a616e1683b60d2767db34098092528fba64351c6e7da321d9256b1d5f6b87cd831e2de3c1df1caa570bb8ce04810b4ebbc6b83ed9eb7f
-
SSDEEP
3072:bScKoSsxzNDZLDZjlbR868O8KlVH3jiKq7uDphYHceXVhca+fMHLtyeGxcl8OUMz:OcKoSsxzNDZLDZjlbR868O8KlVH3jiKO
Malware Config
Extracted
http://www.chipmania.it/mails/open.php
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1932 2892 rundll32.exe EXCEL.EXE -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
EXCEL.EXErundll32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2892 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
EXCEL.EXEpid process 2892 EXCEL.EXE 2892 EXCEL.EXE 2892 EXCEL.EXE 2892 EXCEL.EXE 2892 EXCEL.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 2892 wrote to memory of 1932 2892 EXCEL.EXE rundll32.exe PID 2892 wrote to memory of 1932 2892 EXCEL.EXE rundll32.exe PID 2892 wrote to memory of 1932 2892 EXCEL.EXE rundll32.exe PID 2892 wrote to memory of 1932 2892 EXCEL.EXE rundll32.exe PID 2892 wrote to memory of 1932 2892 EXCEL.EXE rundll32.exe PID 2892 wrote to memory of 1932 2892 EXCEL.EXE rundll32.exe PID 2892 wrote to memory of 1932 2892 EXCEL.EXE rundll32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\d2dd2ad3aafbf259297a4b301987f273_JaffaCakes118.xls1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\rundll32.exerundll32 ..\BASE.BABAA,DllRegisterServer2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
PID:1932