Malware Analysis Report

2024-10-24 17:09

Sample ID 240909-l2tc1svdla
Target d6178e66b2e106d41b80f0a65648193f_JaffaCakes118
SHA256 3a26d714db6bcc160be992c7640243c245122f43747c7a3843a81f2e9c3803d2
Tags
macro xlm discovery
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3a26d714db6bcc160be992c7640243c245122f43747c7a3843a81f2e9c3803d2

Threat Level: Known bad

The file d6178e66b2e106d41b80f0a65648193f_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

macro xlm discovery

Process spawned unexpected child process

Suspicious Office macro

System Location Discovery: System Language Discovery

Checks processor information in registry

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-09 10:02

Signatures

Suspicious Office macro

macro xlm
Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-09 10:02

Reported

2024-09-09 10:04

Platform

win7-20240903-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\d6178e66b2e106d41b80f0a65648193f_JaffaCakes118.xls

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\SysWOW64\explorer.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\SysWOW64\rundll32.exe C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2016 wrote to memory of 2728 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\explorer.exe
PID 2016 wrote to memory of 2728 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\explorer.exe
PID 2016 wrote to memory of 2728 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\explorer.exe
PID 2016 wrote to memory of 2728 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\explorer.exe
PID 2168 wrote to memory of 2660 N/A C:\Windows\explorer.exe C:\Windows\System32\WScript.exe
PID 2168 wrote to memory of 2660 N/A C:\Windows\explorer.exe C:\Windows\System32\WScript.exe
PID 2168 wrote to memory of 2660 N/A C:\Windows\explorer.exe C:\Windows\System32\WScript.exe
PID 2016 wrote to memory of 2652 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\rundll32.exe
PID 2016 wrote to memory of 2652 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\rundll32.exe
PID 2016 wrote to memory of 2652 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\rundll32.exe
PID 2016 wrote to memory of 2652 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\rundll32.exe
PID 2016 wrote to memory of 2652 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\rundll32.exe
PID 2016 wrote to memory of 2652 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\rundll32.exe
PID 2016 wrote to memory of 2652 N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\d6178e66b2e106d41b80f0a65648193f_JaffaCakes118.xls

C:\Windows\SysWOW64\explorer.exe

explorer.exe C:\Users\Admin\AppData\Local\Temp\Q7ye.vbs

C:\Windows\explorer.exe

C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Q7ye.vbs"

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\o3N21.html,DllRegisterServer

Network

Country Destination Domain Proto
US 8.8.8.8:53 jumper.rocks udp
US 8.8.8.8:53 jumper.yoga udp

Files

memory/2016-1-0x0000000073BBD000-0x0000000073BC8000-memory.dmp

memory/2016-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Q7ye.vbs

MD5 27f46f90268086c258903e9af643001d
SHA1 a2d036ba27a81d328f4de6a2ee4a4a4dee1115d9
SHA256 9ca99919766876553f88875343e2c01e1c43043906122a2dfdc1d06877fab111
SHA512 71eb78fdbdab3fbd9a38a8ee8b89935c40cd371265edbfe60f562beccfc40d35bf87c9b0478d64a27b0aecdf11cd70e064301c018191f31718dfdbf66d39a72c

C:\Users\Admin\AppData\Local\Temp\sc5T.txt

MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

memory/2016-6-0x0000000073BBD000-0x0000000073BC8000-memory.dmp

memory/2016-7-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2016-8-0x0000000073BBD000-0x0000000073BC8000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-09 10:02

Reported

2024-09-09 10:04

Platform

win10v2004-20240802-en

Max time kernel

149s

Max time network

127s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d6178e66b2e106d41b80f0a65648193f_JaffaCakes118.xls"

Signatures

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\explorer.exe C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process N/A C:\Windows\explorer.exe C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000_Classes\Local Settings C:\Windows\explorer.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d6178e66b2e106d41b80f0a65648193f_JaffaCakes118.xls"

C:\Windows\explorer.exe

explorer.exe C:\Users\Admin\AppData\Local\Temp\Q7ye.vbs

C:\Windows\explorer.exe

C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Q7ye.vbs"

C:\Windows\explorer.exe

explorer.exe C:\Users\Admin\AppData\Local\Temp\Rxe6l4j.vbs

C:\Windows\explorer.exe

C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Rxe6l4j.vbs"

Network

Country Destination Domain Proto
US 8.8.8.8:53 roaming.officeapps.live.com udp
NL 52.109.89.19:443 roaming.officeapps.live.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 19.89.109.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 jumper.rocks udp
US 8.8.8.8:53 12.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp

Files

memory/4280-0-0x00007FF967730000-0x00007FF967740000-memory.dmp

memory/4280-1-0x00007FF9A774D000-0x00007FF9A774E000-memory.dmp

memory/4280-3-0x00007FF967730000-0x00007FF967740000-memory.dmp

memory/4280-2-0x00007FF967730000-0x00007FF967740000-memory.dmp

memory/4280-4-0x00007FF967730000-0x00007FF967740000-memory.dmp

memory/4280-5-0x00007FF967730000-0x00007FF967740000-memory.dmp

memory/4280-6-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

memory/4280-11-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

memory/4280-10-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

memory/4280-9-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

memory/4280-12-0x00007FF965280000-0x00007FF965290000-memory.dmp

memory/4280-8-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

memory/4280-7-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

memory/4280-16-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

memory/4280-17-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

memory/4280-22-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

memory/4280-21-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

memory/4280-20-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

memory/4280-19-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

memory/4280-18-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

memory/4280-15-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

memory/4280-14-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

memory/4280-13-0x00007FF965280000-0x00007FF965290000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Q7ye.vbs

MD5 edb0b4135928c730ed9dc7d0ef12a719
SHA1 f0393a6aea4907960e4c74f109eed868a1a31e47
SHA256 caf13cceb9783893f5b857c216c938e1f6757142d0cca2c5677298ae730837a0
SHA512 0d5ea8eb122dc4f9e3808000b72f0ed9fa2c1400a3b2f689fd47a9120915972dd3b550179a17fea0f6163dcb475a29badd8466b107e146f2ea2e7186a8a6b5bd

C:\Users\Admin\AppData\Local\Temp\sc5T.txt

MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

C:\Users\Admin\AppData\Local\Temp\Rxe6l4j.vbs

MD5 5ce313468c7c1ff42853387d16989f23
SHA1 e72a71465b108f918c610f4f79fd513b6a967528
SHA256 30378ffc29b84870d782b2bc7661b76c95477120ba6a6fd1d8e7521057d39a94
SHA512 8020d0b8759b786c3d0934719bca0dc5180acffa5a2906ad9c3f48995de24070eb5845e020c59ae0543dab6cb10e3c270e4e7d1ad8c48f6febeb11f0bacb5b59

memory/4280-40-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp

memory/4280-41-0x00007FF9A774D000-0x00007FF9A774E000-memory.dmp

memory/4280-42-0x00007FF9A76B0000-0x00007FF9A78A5000-memory.dmp