Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-09-2024 04:03

General

  • Target

    d37ea0e04f634195f4037ed049538f8f_JaffaCakes118.xls

  • Size

    143KB

  • MD5

    d37ea0e04f634195f4037ed049538f8f

  • SHA1

    cf0d658c3bc33bc5bcb8f4852a7a3dc805d36860

  • SHA256

    071f41c6ba5d557491c35260b8d99a5cee331d870c1fbc7756303de0eb3ba63e

  • SHA512

    f8b113615b780a7d27a56804bf3d964f4270183134a991fccb8c278d47e05b1c08a27aea98b713b2d2b08e68f5015629277ad9fdac7d26fd2a21514e9c0c161a

  • SSDEEP

    3072:Zk3hOdsylKlgxopeiBNhZFGzE+cL2kdATHtCcT+f8bCVyZG1MeNC:Zk3hOdsylKlgxopeiBNhZF+E+W2kdATL

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d37ea0e04f634195f4037ed049538f8f_JaffaCakes118.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3604
    • C:\Windows\explorer.exe
      explorer.exe C:\Users\Admin\AppData\Local\Temp\mH5Wxk.vbs
      2⤵
      • Process spawned unexpected child process
      PID:888
    • C:\Windows\explorer.exe
      explorer.exe C:\Users\Admin\AppData\Local\Temp\pq1fzH.vbs
      2⤵
      • Process spawned unexpected child process
      PID:1320
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1576
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\mH5Wxk.vbs"
      2⤵
        PID:1584
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2996
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\pq1fzH.vbs"
        2⤵
        • Blocklisted process makes network request
        PID:4000

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\mH5Wxk.vbs

      Filesize

      331B

      MD5

      e5145fb5345e2179c2a63f6152ad2cb4

      SHA1

      8c4f8f4af8c70c8e1c1d6b072e7098c476f7bc20

      SHA256

      6743285676f5ac3dad4d93fce806d9704ddd910d864be3670150444fd95dec3e

      SHA512

      80de5399a8303dcb1be76155c738075b1494886faf2dddb348ebd5a8e33d62bb67198662ac7dda9b57493f170f3ae670c05ac722e4fcbcbc74c20841a47cba37

    • C:\Users\Admin\AppData\Local\Temp\pq1fzH.vbs

      Filesize

      706B

      MD5

      d62669519b44a6e13dcf61397b6e6b5d

      SHA1

      85cc1973b92a9e48843f542dc23e0b30cd962bdc

      SHA256

      f0440e9edfdc1a8f1d4e5c8bb86bd74dfa56362cc5e25b512f3c0d2e84ffc1c8

      SHA512

      773c9fe21ee9e6cf5b7d6b5402851d34ad7b4b269abde3982741fc55fcb36325a22c3a0d33b87284f7b048fc938369d457b0ac870b425772a117532943bac5cf

    • C:\Users\Admin\AppData\Local\Temp\uVIp.txt

      Filesize

      3B

      MD5

      21438ef4b9ad4fc266b6129a2f60de29

      SHA1

      5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

      SHA256

      13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

      SHA512

      37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

    • memory/3604-12-0x00007FFA27750000-0x00007FFA27945000-memory.dmp

      Filesize

      2.0MB

    • memory/3604-14-0x00007FF9E5340000-0x00007FF9E5350000-memory.dmp

      Filesize

      64KB

    • memory/3604-5-0x00007FFA27750000-0x00007FFA27945000-memory.dmp

      Filesize

      2.0MB

    • memory/3604-7-0x00007FFA27750000-0x00007FFA27945000-memory.dmp

      Filesize

      2.0MB

    • memory/3604-9-0x00007FFA27750000-0x00007FFA27945000-memory.dmp

      Filesize

      2.0MB

    • memory/3604-8-0x00007FF9E77D0000-0x00007FF9E77E0000-memory.dmp

      Filesize

      64KB

    • memory/3604-10-0x00007FF9E5340000-0x00007FF9E5350000-memory.dmp

      Filesize

      64KB

    • memory/3604-6-0x00007FF9E77D0000-0x00007FF9E77E0000-memory.dmp

      Filesize

      64KB

    • memory/3604-13-0x00007FFA27750000-0x00007FFA27945000-memory.dmp

      Filesize

      2.0MB

    • memory/3604-1-0x00007FFA277ED000-0x00007FFA277EE000-memory.dmp

      Filesize

      4KB

    • memory/3604-11-0x00007FFA27750000-0x00007FFA27945000-memory.dmp

      Filesize

      2.0MB

    • memory/3604-4-0x00007FFA27750000-0x00007FFA27945000-memory.dmp

      Filesize

      2.0MB

    • memory/3604-18-0x00007FFA27750000-0x00007FFA27945000-memory.dmp

      Filesize

      2.0MB

    • memory/3604-16-0x00007FFA27750000-0x00007FFA27945000-memory.dmp

      Filesize

      2.0MB

    • memory/3604-15-0x00007FFA27750000-0x00007FFA27945000-memory.dmp

      Filesize

      2.0MB

    • memory/3604-17-0x00007FFA27750000-0x00007FFA27945000-memory.dmp

      Filesize

      2.0MB

    • memory/3604-0-0x00007FF9E77D0000-0x00007FF9E77E0000-memory.dmp

      Filesize

      64KB

    • memory/3604-2-0x00007FF9E77D0000-0x00007FF9E77E0000-memory.dmp

      Filesize

      64KB

    • memory/3604-3-0x00007FF9E77D0000-0x00007FF9E77E0000-memory.dmp

      Filesize

      64KB

    • memory/3604-37-0x00007FFA27750000-0x00007FFA27945000-memory.dmp

      Filesize

      2.0MB

    • memory/3604-39-0x00007FFA27750000-0x00007FFA27945000-memory.dmp

      Filesize

      2.0MB

    • memory/3604-38-0x00007FFA277ED000-0x00007FFA277EE000-memory.dmp

      Filesize

      4KB

    • memory/3604-40-0x00007FFA27750000-0x00007FFA27945000-memory.dmp

      Filesize

      2.0MB