Analysis Overview
SHA256
3a26d714db6bcc160be992c7640243c245122f43747c7a3843a81f2e9c3803d2
Threat Level: Known bad
The file d6178e66b2e106d41b80f0a65648193f_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
Process spawned unexpected child process
Suspicious Office macro
System Location Discovery: System Language Discovery
Checks processor information in registry
Modifies registry class
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates system info in registry
Suspicious behavior: AddClipboardFormatListener
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-09-09 10:02
Signatures
Suspicious Office macro
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-09-09 10:02
Reported
2024-09-09 10:04
Platform
win7-20240903-en
Max time kernel
121s
Max time network
122s
Command Line
Signatures
Process spawned unexpected child process
| Description | Indicator | Process | Target |
| Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\SysWOW64\explorer.exe | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE |
| Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\SysWOW64\rundll32.exe | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\explorer.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\rundll32.exe | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\d6178e66b2e106d41b80f0a65648193f_JaffaCakes118.xls
C:\Windows\SysWOW64\explorer.exe
explorer.exe C:\Users\Admin\AppData\Local\Temp\Q7ye.vbs
C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Q7ye.vbs"
C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\o3N21.html,DllRegisterServer
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | jumper.rocks | udp |
| US | 8.8.8.8:53 | jumper.yoga | udp |
Files
memory/2016-1-0x0000000073BBD000-0x0000000073BC8000-memory.dmp
memory/2016-0-0x000000005FFF0000-0x0000000060000000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Q7ye.vbs
| MD5 | 27f46f90268086c258903e9af643001d |
| SHA1 | a2d036ba27a81d328f4de6a2ee4a4a4dee1115d9 |
| SHA256 | 9ca99919766876553f88875343e2c01e1c43043906122a2dfdc1d06877fab111 |
| SHA512 | 71eb78fdbdab3fbd9a38a8ee8b89935c40cd371265edbfe60f562beccfc40d35bf87c9b0478d64a27b0aecdf11cd70e064301c018191f31718dfdbf66d39a72c |
C:\Users\Admin\AppData\Local\Temp\sc5T.txt
| MD5 | 21438ef4b9ad4fc266b6129a2f60de29 |
| SHA1 | 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd |
| SHA256 | 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354 |
| SHA512 | 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237 |
memory/2016-6-0x0000000073BBD000-0x0000000073BC8000-memory.dmp
memory/2016-7-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/2016-8-0x0000000073BBD000-0x0000000073BC8000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-09-09 10:02
Reported
2024-09-09 10:04
Platform
win10v2004-20240802-en
Max time kernel
149s
Max time network
127s
Command Line
Signatures
Process spawned unexpected child process
| Description | Indicator | Process | Target |
| Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\explorer.exe | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE |
| Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process | N/A | C:\Windows\explorer.exe | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\BIOS | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings | C:\Windows\explorer.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings | C:\Windows\explorer.exe | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4280 wrote to memory of 1908 | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | C:\Windows\explorer.exe |
| PID 4280 wrote to memory of 1908 | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | C:\Windows\explorer.exe |
| PID 1076 wrote to memory of 3404 | N/A | C:\Windows\explorer.exe | C:\Windows\System32\WScript.exe |
| PID 1076 wrote to memory of 3404 | N/A | C:\Windows\explorer.exe | C:\Windows\System32\WScript.exe |
| PID 4280 wrote to memory of 5096 | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | C:\Windows\explorer.exe |
| PID 4280 wrote to memory of 5096 | N/A | C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE | C:\Windows\explorer.exe |
| PID 2024 wrote to memory of 4204 | N/A | C:\Windows\explorer.exe | C:\Windows\System32\WScript.exe |
| PID 2024 wrote to memory of 4204 | N/A | C:\Windows\explorer.exe | C:\Windows\System32\WScript.exe |
Processes
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d6178e66b2e106d41b80f0a65648193f_JaffaCakes118.xls"
C:\Windows\explorer.exe
explorer.exe C:\Users\Admin\AppData\Local\Temp\Q7ye.vbs
C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Q7ye.vbs"
C:\Windows\explorer.exe
explorer.exe C:\Users\Admin\AppData\Local\Temp\Rxe6l4j.vbs
C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Rxe6l4j.vbs"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | roaming.officeapps.live.com | udp |
| NL | 52.109.89.19:443 | roaming.officeapps.live.com | tcp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 19.89.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | jumper.rocks | udp |
| US | 8.8.8.8:53 | 12.173.189.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 92.12.20.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 81.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
Files
memory/4280-0-0x00007FF967730000-0x00007FF967740000-memory.dmp
memory/4280-1-0x00007FF9A774D000-0x00007FF9A774E000-memory.dmp
memory/4280-3-0x00007FF967730000-0x00007FF967740000-memory.dmp
memory/4280-2-0x00007FF967730000-0x00007FF967740000-memory.dmp
memory/4280-4-0x00007FF967730000-0x00007FF967740000-memory.dmp
memory/4280-5-0x00007FF967730000-0x00007FF967740000-memory.dmp
memory/4280-6-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp
memory/4280-11-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp
memory/4280-10-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp
memory/4280-9-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp
memory/4280-12-0x00007FF965280000-0x00007FF965290000-memory.dmp
memory/4280-8-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp
memory/4280-7-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp
memory/4280-16-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp
memory/4280-17-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp
memory/4280-22-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp
memory/4280-21-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp
memory/4280-20-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp
memory/4280-19-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp
memory/4280-18-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp
memory/4280-15-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp
memory/4280-14-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp
memory/4280-13-0x00007FF965280000-0x00007FF965290000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Q7ye.vbs
| MD5 | edb0b4135928c730ed9dc7d0ef12a719 |
| SHA1 | f0393a6aea4907960e4c74f109eed868a1a31e47 |
| SHA256 | caf13cceb9783893f5b857c216c938e1f6757142d0cca2c5677298ae730837a0 |
| SHA512 | 0d5ea8eb122dc4f9e3808000b72f0ed9fa2c1400a3b2f689fd47a9120915972dd3b550179a17fea0f6163dcb475a29badd8466b107e146f2ea2e7186a8a6b5bd |
C:\Users\Admin\AppData\Local\Temp\sc5T.txt
| MD5 | 21438ef4b9ad4fc266b6129a2f60de29 |
| SHA1 | 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd |
| SHA256 | 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354 |
| SHA512 | 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237 |
C:\Users\Admin\AppData\Local\Temp\Rxe6l4j.vbs
| MD5 | 5ce313468c7c1ff42853387d16989f23 |
| SHA1 | e72a71465b108f918c610f4f79fd513b6a967528 |
| SHA256 | 30378ffc29b84870d782b2bc7661b76c95477120ba6a6fd1d8e7521057d39a94 |
| SHA512 | 8020d0b8759b786c3d0934719bca0dc5180acffa5a2906ad9c3f48995de24070eb5845e020c59ae0543dab6cb10e3c270e4e7d1ad8c48f6febeb11f0bacb5b59 |
memory/4280-40-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp
memory/4280-41-0x00007FF9A774D000-0x00007FF9A774E000-memory.dmp
memory/4280-42-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp