Analysis

  • max time kernel
    105s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-09-2024 18:22

General

  • Target

    d6dd1b0ec2a9845c6062e40b66a08fc9_JaffaCakes118.xls

  • Size

    75KB

  • MD5

    d6dd1b0ec2a9845c6062e40b66a08fc9

  • SHA1

    32efa9b1f33e5748d0b5f1374ea4ab4414313806

  • SHA256

    ee0cb8e2bd346aec61a07634aa6a129915c9e2d75862de02b838da7d90273d56

  • SHA512

    6f3f87630adf971c7d30ea83b7fb26420c43e017ff937560007aa9804da8bc29ada73145541654df0f32289b784105909f3215a97748bd7cff96e09888edf2b9

  • SSDEEP

    768:2uuuua2+iy0yGXR2JpUdSHJtN+75x+MFH7V+k6ekmqrszM+M0Zx:2uuuua2+iy0yGupUDFH7V+KvqGM+Ms

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\d6dd1b0ec2a9845c6062e40b66a08fc9_JaffaCakes118.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4464

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    f275ef4c9756faa46d3a0e272d51c6a4

    SHA1

    ae0da1ee685b06b01a09545d7c006acdc869389b

    SHA256

    8dd93052d5aa24bb67c7f154be49f28e376bffc7eafdc6c2f244a978d9a85296

    SHA512

    4147ca0e31ec74d751dc724dcc272a68f214cdc009c8a424a2061a347ffc62942cd0ce41768a2659dd1b7181dcf67cb388405589316ddafafaeb06ef3a6e4972

  • memory/4464-17-0x00007FF992190000-0x00007FF992385000-memory.dmp

    Filesize

    2.0MB

  • memory/4464-8-0x00007FF992190000-0x00007FF992385000-memory.dmp

    Filesize

    2.0MB

  • memory/4464-18-0x00007FF950100000-0x00007FF950110000-memory.dmp

    Filesize

    64KB

  • memory/4464-7-0x00007FF992190000-0x00007FF992385000-memory.dmp

    Filesize

    2.0MB

  • memory/4464-16-0x00007FF992190000-0x00007FF992385000-memory.dmp

    Filesize

    2.0MB

  • memory/4464-9-0x00007FF992190000-0x00007FF992385000-memory.dmp

    Filesize

    2.0MB

  • memory/4464-12-0x00007FF992190000-0x00007FF992385000-memory.dmp

    Filesize

    2.0MB

  • memory/4464-10-0x00007FF992190000-0x00007FF992385000-memory.dmp

    Filesize

    2.0MB

  • memory/4464-14-0x00007FF950100000-0x00007FF950110000-memory.dmp

    Filesize

    64KB

  • memory/4464-11-0x00007FF992190000-0x00007FF992385000-memory.dmp

    Filesize

    2.0MB

  • memory/4464-15-0x00007FF992190000-0x00007FF992385000-memory.dmp

    Filesize

    2.0MB

  • memory/4464-0-0x00007FF952210000-0x00007FF952220000-memory.dmp

    Filesize

    64KB

  • memory/4464-1-0x00007FF952210000-0x00007FF952220000-memory.dmp

    Filesize

    64KB

  • memory/4464-2-0x00007FF952210000-0x00007FF952220000-memory.dmp

    Filesize

    64KB

  • memory/4464-13-0x00007FF992190000-0x00007FF992385000-memory.dmp

    Filesize

    2.0MB

  • memory/4464-5-0x00007FF992190000-0x00007FF992385000-memory.dmp

    Filesize

    2.0MB

  • memory/4464-6-0x00007FF952210000-0x00007FF952220000-memory.dmp

    Filesize

    64KB

  • memory/4464-4-0x00007FF952210000-0x00007FF952220000-memory.dmp

    Filesize

    64KB

  • memory/4464-30-0x00007FF992190000-0x00007FF992385000-memory.dmp

    Filesize

    2.0MB

  • memory/4464-3-0x00007FF99222D000-0x00007FF99222E000-memory.dmp

    Filesize

    4KB

  • memory/4464-54-0x00007FF952210000-0x00007FF952220000-memory.dmp

    Filesize

    64KB

  • memory/4464-55-0x00007FF952210000-0x00007FF952220000-memory.dmp

    Filesize

    64KB

  • memory/4464-57-0x00007FF952210000-0x00007FF952220000-memory.dmp

    Filesize

    64KB

  • memory/4464-56-0x00007FF952210000-0x00007FF952220000-memory.dmp

    Filesize

    64KB

  • memory/4464-58-0x00007FF992190000-0x00007FF992385000-memory.dmp

    Filesize

    2.0MB