Analysis
-
max time kernel
148s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-09-2024 05:33
General
-
Target
eaadbf33d6d8e1df8106018fdc39d3f9_JaffaCakes118.xlsm
-
Size
2.7MB
-
MD5
eaadbf33d6d8e1df8106018fdc39d3f9
-
SHA1
8e95e02a998509003fea9c205e752e4ec2802808
-
SHA256
a9ba5e7ae9dca585a8b3e993dba5055bffce24a5e201e5b9cdd6e88c2c33bb60
-
SHA512
ab654653089c8c720e71d2f80670c3eade14cd55ef45d9c0c49f7fa146a6d08f28fbcda35331911d823df1a6000a4474573586b0e70aea160ab0eca81e7e8337
-
SSDEEP
1536:lnd4uFEvT42ZacNCMi8LZ+lWxaqOyIasQmUV2ZT0nIcjELco6kx:r4uFEr423N7ipWJOyIj8sT0n9Jkx
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
NTFS ADS 3 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\eaadbf33d6d8e1df8106018fdc39d3f9_JaffaCakes118.xlsm"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" C:\programdata\asc.txt:script1.vbs2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Checks computer location settings
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD5fb37525a37129dd0aa9106b96704de60
SHA121dd09b4a0a606c28cdbe37242a0786a1aad9547
SHA256af1be61bdc12ddbea492ca2d41977d15c6679b2d8210ec45bb2458a00a544f63
SHA51222bf079d55217736f3d6aabb786c3e81d90304839f4d4c1980ad83219a325a6e763975b2d276886532d800d7490835bc6a96295f3821ce1e347ee2ecd050e89f
-
Filesize
1KB
MD5049bda4a20e5c17aaa1f0dac9e2b1088
SHA1c0b9f6d6d59ae2364a2c8fcecd0e87c5b2056cf1
SHA2565ae6553ac4540d6f801a1972b06d3cd83d6c29749fbaeeb86ed6e220910bbab2
SHA51296d14afbfd7e43c69eab694db5397e22b756a6d1376c43a5bbd785c3f0af8c50200cf0b1245d2ac9875a2bb35ce7624f2358304085829169444099c9e049f657
-
Filesize
68KB
MD59804524f96c787a69a60738fd9b958ac
SHA10b8d06a63322719037cb7c479f11c9d1db4e5e5e
SHA25603220f8d458cf2c5c95b2721b63e740ee6a1d68660b2e9995a423f821134c15f
SHA512c1e2b53dbfa261da5d6d7f3f83c85b04fb5105548c63efe251db0371a27ee48dae200405fe8f837a43b8949f7801ae4156a97eabb5307c4416641fb72e3ef468
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB