Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-09-2024 10:02

General

  • Target

    d6178e66b2e106d41b80f0a65648193f_JaffaCakes118.xls

  • Size

    234KB

  • MD5

    d6178e66b2e106d41b80f0a65648193f

  • SHA1

    bd63130e0f98474237cf2f0dc75c72df540b0f35

  • SHA256

    3a26d714db6bcc160be992c7640243c245122f43747c7a3843a81f2e9c3803d2

  • SHA512

    b45ab685b6e6e715f45513aab19afdfd81c09f47a241ca19b91cea920535b2fd9d24d5963f7cd90c16e4a468934a7c536771b0bdc31c73c66101c4c468f6cfe6

  • SSDEEP

    6144:Sk3hOdsylKlgxopeiBNhZF+E+W2kdAQFD+UAnvfrrfKQATdevW9BW7K:coT5

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d6178e66b2e106d41b80f0a65648193f_JaffaCakes118.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4280
    • C:\Windows\explorer.exe
      explorer.exe C:\Users\Admin\AppData\Local\Temp\Q7ye.vbs
      2⤵
      • Process spawned unexpected child process
      PID:1908
    • C:\Windows\explorer.exe
      explorer.exe C:\Users\Admin\AppData\Local\Temp\Rxe6l4j.vbs
      2⤵
      • Process spawned unexpected child process
      PID:5096
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1076
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Q7ye.vbs"
      2⤵
        PID:3404
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2024
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Rxe6l4j.vbs"
        2⤵
          PID:4204

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Q7ye.vbs

        Filesize

        331B

        MD5

        edb0b4135928c730ed9dc7d0ef12a719

        SHA1

        f0393a6aea4907960e4c74f109eed868a1a31e47

        SHA256

        caf13cceb9783893f5b857c216c938e1f6757142d0cca2c5677298ae730837a0

        SHA512

        0d5ea8eb122dc4f9e3808000b72f0ed9fa2c1400a3b2f689fd47a9120915972dd3b550179a17fea0f6163dcb475a29badd8466b107e146f2ea2e7186a8a6b5bd

      • C:\Users\Admin\AppData\Local\Temp\Rxe6l4j.vbs

        Filesize

        799B

        MD5

        5ce313468c7c1ff42853387d16989f23

        SHA1

        e72a71465b108f918c610f4f79fd513b6a967528

        SHA256

        30378ffc29b84870d782b2bc7661b76c95477120ba6a6fd1d8e7521057d39a94

        SHA512

        8020d0b8759b786c3d0934719bca0dc5180acffa5a2906ad9c3f48995de24070eb5845e020c59ae0543dab6cb10e3c270e4e7d1ad8c48f6febeb11f0bacb5b59

      • C:\Users\Admin\AppData\Local\Temp\sc5T.txt

        Filesize

        3B

        MD5

        21438ef4b9ad4fc266b6129a2f60de29

        SHA1

        5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

        SHA256

        13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

        SHA512

        37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

      • memory/4280-17-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

        Filesize

        2.0MB

      • memory/4280-21-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

        Filesize

        2.0MB

      • memory/4280-5-0x00007FF967730000-0x00007FF967740000-memory.dmp

        Filesize

        64KB

      • memory/4280-6-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

        Filesize

        2.0MB

      • memory/4280-11-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

        Filesize

        2.0MB

      • memory/4280-10-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

        Filesize

        2.0MB

      • memory/4280-9-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

        Filesize

        2.0MB

      • memory/4280-12-0x00007FF965280000-0x00007FF965290000-memory.dmp

        Filesize

        64KB

      • memory/4280-8-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

        Filesize

        2.0MB

      • memory/4280-7-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

        Filesize

        2.0MB

      • memory/4280-16-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

        Filesize

        2.0MB

      • memory/4280-0-0x00007FF967730000-0x00007FF967740000-memory.dmp

        Filesize

        64KB

      • memory/4280-22-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

        Filesize

        2.0MB

      • memory/4280-4-0x00007FF967730000-0x00007FF967740000-memory.dmp

        Filesize

        64KB

      • memory/4280-20-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

        Filesize

        2.0MB

      • memory/4280-19-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

        Filesize

        2.0MB

      • memory/4280-18-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

        Filesize

        2.0MB

      • memory/4280-15-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

        Filesize

        2.0MB

      • memory/4280-14-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

        Filesize

        2.0MB

      • memory/4280-13-0x00007FF965280000-0x00007FF965290000-memory.dmp

        Filesize

        64KB

      • memory/4280-2-0x00007FF967730000-0x00007FF967740000-memory.dmp

        Filesize

        64KB

      • memory/4280-3-0x00007FF967730000-0x00007FF967740000-memory.dmp

        Filesize

        64KB

      • memory/4280-1-0x00007FF9A774D000-0x00007FF9A774E000-memory.dmp

        Filesize

        4KB

      • memory/4280-40-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

        Filesize

        2.0MB

      • memory/4280-41-0x00007FF9A774D000-0x00007FF9A774E000-memory.dmp

        Filesize

        4KB

      • memory/4280-42-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

        Filesize

        2.0MB