Analysis
- max time kernel
95s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
25/09/2024, 06:24
General
- Target f564011c2aaf582fc5e7e9c95d5b6b44_JaffaCakes118.xls
- Size 49KB
- Sample240925-g6chvasgpc
- SHA256 83016b48397789f5215cffc5c1cc223846736ce2d795fb14bc1f3f7b87af0fa1
Malware Config
Extracted
-
xlm4.0
-
xlm40.dropper
http://matterandhome.com/twtao/222222.png
Signatures
- Process spawned suspicious child process 1 IoCs
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\f564011c2aaf582fc5e7e9c95d5b6b44_JaffaCakes118.xls"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE"C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE" -x -s 45602⤵
- Process spawned suspicious child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dwwin.exeC:\Windows\system32\dwwin.exe -x -s 45603⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2668-24-0x00007FFB0D450000-0x00007FFB0D645000-memory.dmp
memory/2668-40-0x00007FFACD4D0000-0x00007FFACD4E0000-memory.dmp
memory/2668-41-0x00007FFACD4D0000-0x00007FFACD4E0000-memory.dmp
memory/2668-42-0x00007FFACD4D0000-0x00007FFACD4E0000-memory.dmp
memory/2668-43-0x00007FFACD4D0000-0x00007FFACD4E0000-memory.dmp
memory/2668-44-0x00007FFB0D450000-0x00007FFB0D645000-memory.dmp
memory/2668-32-0x00007FFB0D450000-0x00007FFB0D645000-memory.dmp
memory/2668-31-0x00007FFB0D450000-0x00007FFB0D645000-memory.dmp
memory/2668-30-0x00007FFB0D450000-0x00007FFB0D645000-memory.dmp
memory/2668-29-0x00007FFB0D450000-0x00007FFB0D645000-memory.dmp
memory/2668-26-0x00007FFB0D450000-0x00007FFB0D645000-memory.dmp
memory/3224-10-0x00007FFB0D450000-0x00007FFB0D645000-memory.dmp
memory/3224-7-0x00007FFB0D450000-0x00007FFB0D645000-memory.dmp
memory/3224-15-0x00007FFACB470000-0x00007FFACB480000-memory.dmp
memory/3224-13-0x00007FFB0D450000-0x00007FFB0D645000-memory.dmp
memory/3224-17-0x00007FFB0D450000-0x00007FFB0D645000-memory.dmp
memory/3224-18-0x00007FFB0D450000-0x00007FFB0D645000-memory.dmp
memory/3224-20-0x00007FFB0D450000-0x00007FFB0D645000-memory.dmp
memory/3224-19-0x00007FFB0D450000-0x00007FFB0D645000-memory.dmp
memory/3224-16-0x00007FFB0D450000-0x00007FFB0D645000-memory.dmp
memory/3224-12-0x00007FFB0D450000-0x00007FFB0D645000-memory.dmp
memory/3224-11-0x00007FFACB470000-0x00007FFACB480000-memory.dmp
memory/3224-14-0x00007FFB0D450000-0x00007FFB0D645000-memory.dmp
memory/3224-8-0x00007FFB0D450000-0x00007FFB0D645000-memory.dmp
memory/3224-3-0x00007FFB0D4ED000-0x00007FFB0D4EE000-memory.dmp
memory/3224-6-0x00007FFB0D450000-0x00007FFB0D645000-memory.dmp
memory/3224-9-0x00007FFB0D450000-0x00007FFB0D645000-memory.dmp
memory/3224-37-0x00007FFB0D450000-0x00007FFB0D645000-memory.dmp
memory/3224-5-0x00007FFACD4D0000-0x00007FFACD4E0000-memory.dmp
memory/3224-0-0x00007FFACD4D0000-0x00007FFACD4E0000-memory.dmp
memory/3224-4-0x00007FFACD4D0000-0x00007FFACD4E0000-memory.dmp
memory/3224-1-0x00007FFACD4D0000-0x00007FFACD4E0000-memory.dmp
memory/3224-2-0x00007FFACD4D0000-0x00007FFACD4E0000-memory.dmp