Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-09-2024 06:50

General

  • Target

    eacae1d37e509a1806b82da79ae836df_JaffaCakes118.xls

  • Size

    3.6MB

  • MD5

    eacae1d37e509a1806b82da79ae836df

  • SHA1

    daf433ffca8c28136f1c0529c5a4706e97d9e685

  • SHA256

    e1f9118bddefedfe6603245115c1b38297f8b856b95bc983b255d210d2a49377

  • SHA512

    321cac914e54e671e65b2cb5fb9f996ba14a4b15654900cf4971a3c351f85887681024a2678ba89e17754e67b347b2024ab477ef1c9aae075f605e2eb6ce3aac

  • SSDEEP

    24576:nVA7gCfsSXbWV/h/w60RNdQIn2HCccey6tAn0kHrio:NCfsSXbVBQIwQp6tAn0kHrio

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\eacae1d37e509a1806b82da79ae836df_JaffaCakes118.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:2252

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2252-1-0x00007FFDA3D4D000-0x00007FFDA3D4E000-memory.dmp

    Filesize

    4KB

  • memory/2252-0-0x00007FFD63D30000-0x00007FFD63D40000-memory.dmp

    Filesize

    64KB

  • memory/2252-3-0x00007FFD63D30000-0x00007FFD63D40000-memory.dmp

    Filesize

    64KB

  • memory/2252-2-0x00007FFD63D30000-0x00007FFD63D40000-memory.dmp

    Filesize

    64KB

  • memory/2252-5-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-4-0x00007FFD63D30000-0x00007FFD63D40000-memory.dmp

    Filesize

    64KB

  • memory/2252-6-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-7-0x00007FFD63D30000-0x00007FFD63D40000-memory.dmp

    Filesize

    64KB

  • memory/2252-11-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-13-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-12-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-10-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-14-0x00007FFD61660000-0x00007FFD61670000-memory.dmp

    Filesize

    64KB

  • memory/2252-9-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-15-0x00007FFD61660000-0x00007FFD61670000-memory.dmp

    Filesize

    64KB

  • memory/2252-8-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-33-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-34-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-35-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-36-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-37-0x00007FFDA3D4D000-0x00007FFDA3D4E000-memory.dmp

    Filesize

    4KB

  • memory/2252-38-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-42-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB

  • memory/2252-43-0x00007FFDA3CB0000-0x00007FFDA3EA5000-memory.dmp

    Filesize

    2.0MB