Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09-09-2024 10:02

General

  • Target

    d6178e66b2e106d41b80f0a65648193f_JaffaCakes118.xls

  • Size

    234KB

  • MD5

    d6178e66b2e106d41b80f0a65648193f

  • SHA1

    bd63130e0f98474237cf2f0dc75c72df540b0f35

  • SHA256

    3a26d714db6bcc160be992c7640243c245122f43747c7a3843a81f2e9c3803d2

  • SHA512

    b45ab685b6e6e715f45513aab19afdfd81c09f47a241ca19b91cea920535b2fd9d24d5963f7cd90c16e4a468934a7c536771b0bdc31c73c66101c4c468f6cfe6

  • SSDEEP

    6144:Sk3hOdsylKlgxopeiBNhZF+E+W2kdAQFD+UAnvfrrfKQATdevW9BW7K:coT5

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
URLs
xlm40.dropper

https://jumper.rocks/wp-index.php

xlm40.dropper

https://jumper.yoga/wp-index.php

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\d6178e66b2e106d41b80f0a65648193f_JaffaCakes118.xls
    1⤵
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Windows\SysWOW64\explorer.exe
      explorer.exe C:\Users\Admin\AppData\Local\Temp\Q7ye.vbs
      2⤵
      • Process spawned unexpected child process
      • System Location Discovery: System Language Discovery
      PID:2728
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\o3N21.html,DllRegisterServer
      2⤵
      • Process spawned unexpected child process
      • System Location Discovery: System Language Discovery
      PID:2652
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Q7ye.vbs"
      2⤵
        PID:2660

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Q7ye.vbs

      Filesize

      331B

      MD5

      27f46f90268086c258903e9af643001d

      SHA1

      a2d036ba27a81d328f4de6a2ee4a4a4dee1115d9

      SHA256

      9ca99919766876553f88875343e2c01e1c43043906122a2dfdc1d06877fab111

      SHA512

      71eb78fdbdab3fbd9a38a8ee8b89935c40cd371265edbfe60f562beccfc40d35bf87c9b0478d64a27b0aecdf11cd70e064301c018191f31718dfdbf66d39a72c

    • C:\Users\Admin\AppData\Local\Temp\sc5T.txt

      Filesize

      3B

      MD5

      21438ef4b9ad4fc266b6129a2f60de29

      SHA1

      5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

      SHA256

      13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

      SHA512

      37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

    • memory/2016-1-0x0000000073BBD000-0x0000000073BC8000-memory.dmp

      Filesize

      44KB

    • memory/2016-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2016-6-0x0000000073BBD000-0x0000000073BC8000-memory.dmp

      Filesize

      44KB

    • memory/2016-7-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2016-8-0x0000000073BBD000-0x0000000073BC8000-memory.dmp

      Filesize

      44KB