Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20/09/2024, 07:33
General
-
Target
ed1d2ec94052a01a82dc41386c67fa95_JaffaCakes118.xls
-
Size
58KB
-
MD5
ed1d2ec94052a01a82dc41386c67fa95
-
SHA1
26b80c542713e53d2258ea3b271c4c9a3e1e1147
-
SHA256
0c24602274c0afda05197250336fbecd64a2afef887a39f3a714acf727e28c52
-
SHA512
90a3a7eae17f5c0d8d37ffcc408f1790b6e08bda43b51fb0491f35ab03627f9ac6ceb43b6db5ffe8363eccb83f027aecff587a76427889008d3f265e070e330c
-
SSDEEP
1536:Oihz0DewjEXWfCDIM/V5xtezEsi8OUM+tfNaIZEpqpXouv:Oihz0DewjEXWfCDIM/V5xtezEsi8OUMu
Malware Config
Extracted
http://www.psicheaurora.it/fanta/download.php
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\ed1d2ec94052a01a82dc41386c67fa95_JaffaCakes118.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\rundll32.exerundll32 ..\Joret.fffooo,DllRegisterServer12⤵
- Process spawned unexpected child process
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b477c50150d222eb76ce96d7a5dc3b3b
SHA1212b4222ad4cb1e98327017d29f09b2503dd505f
SHA256ed6c60741e9d71b79ea2d5e82e59c8c67a1dda57735b1ed2c66465a7682008c7
SHA512dede98abf6ca13d56bfd8fff18fd9f9dc56a8c9a893807af09b0e3240a7576d0df944e89c0b4bc9a3bbd1e1bc35a4e26a4052a7c836582fc40d8c3e4e59a488c
-
Filesize
7KB
MD526ac240c07fd7989aef333c4ae18234f
SHA1fcff627a9a8ea69a7ce71869c6f776436e4a6cfd
SHA256debb0cdc2ad455bdf2ded4555528d198d7260bd2d7eeadc2523eb485675c5a30
SHA512188f5058de2edd697109d5690acf8b92bb2e0b56d0a7eaa055c57dbcb4cfc1933e19e1c2969ccab0285fcb30075bb26ee95a89846215e3fe1d86a9cee8ee6379
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB