Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15-10-2024 01:03
Static task
static1
Behavioral task
behavioral1
Sample
4510572427d19ed33b53ff1e1004ad9a_JaffaCakes118.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4510572427d19ed33b53ff1e1004ad9a_JaffaCakes118.xls
Resource
win10v2004-20241007-en
General
-
Target
4510572427d19ed33b53ff1e1004ad9a_JaffaCakes118.xls
-
Size
22KB
-
MD5
4510572427d19ed33b53ff1e1004ad9a
-
SHA1
76b8a711cd9e3efff01e2561b9fa83d0b232da4b
-
SHA256
2846bc45153d46da5ab040e71ac5874608aa66c60e99d631bd68c02a48a1b93a
-
SHA512
8c094f08917da85b9c537989ec09da4c365c3bb05dd2747fc40a6248a53d4f0d4e8984b0f7198c810c34d49cb0b6c4d26f2bf3da746fd53da860ef673ea58cc7
-
SSDEEP
384:yffffOyrER2FOEyYx7DuoeeiIM8JmhCTbH+E//E6uQ5gU:yffffOyrER2HV7yoeebM8GCTbH+HPsgU
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1472 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 1472 EXCEL.EXE 1472 EXCEL.EXE 1472 EXCEL.EXE 1472 EXCEL.EXE 1472 EXCEL.EXE 1472 EXCEL.EXE 1472 EXCEL.EXE 1472 EXCEL.EXE 1472 EXCEL.EXE 1472 EXCEL.EXE 1472 EXCEL.EXE 1472 EXCEL.EXE 1472 EXCEL.EXE 1472 EXCEL.EXE 1472 EXCEL.EXE 1472 EXCEL.EXE 1472 EXCEL.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\4510572427d19ed33b53ff1e1004ad9a_JaffaCakes118.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1472
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
916B
MD5cdb57ead2f39e5ed8a246b49fb9237b8
SHA1757f0849f5a3b9f9b20672fe2262e74b92a5c8d2
SHA256711dc330ea9e0504b38c23e880d2dddb239a20562782a41ce0e4e54188633c43
SHA512d9ed2f1949d4a3bd6c33d15c20319a41f93a6977e99baaee542cb6cc38d9ce72d583aca34d3f973383fe636241fd30c63b053ef99937f653d1b72218681a8a30
-
Filesize
8KB
MD5d3352a91a032cec98a4a224f7f8a8e18
SHA187afe9353d94e8e72662dac3e1186036aa0616ca
SHA2565724dd98e6c8af89b93ac689cda8985e59edfe6fb3fc7969f9a78d1673bd623a
SHA5124f001954cbc7b431f5e869ba2c31a44d8d7e8256055e3197c4d5fdc8df812c494ee5128c9d22371ffff77eb736f5848276ae1d6d8af7434862a610d36060128b
-
Filesize
8KB
MD528027a9b8a70f172056c1ef15e5147eb
SHA136720b8bf49131d99670e1250bb9b863486e2cd2
SHA2560ebfd77274d1bb12efca6284040c87094568c31e1ec6204be7fb7b6829a5fbd0
SHA51297ef1c6c66cbed6b199f0a215877a997db58a143476ae1e71834cb3f5ab31bf567a5a8fa3edc1fe37604103f72a241444ec957e31093d24ffe59176a4315a729
-
Filesize
330B
MD519aa68d4b4158ddf5a9cd8cfba0833cb
SHA1a1be6110fa97b8ae87a87002341b2e0ed739aa40
SHA2568b45207473396b0dbb6cd5946f4f50ba6e3fd39197ef395d7baed15d55b084f2
SHA512c7fce40e992671aee8fcd162da5f863bd34b900a2f9f5b949401e6eca09225b3f360701805f7ab19eb5e1f0dca26e42d9ec63ba12ab5ead7531e790c489364a1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD55c4850a8a7f1fc690ace85ce8472b2ba
SHA1e8c6364849cb54773512edaed00f2d0f43b03683
SHA256e2bd47d70b88f5d92a363a6a632d96bca8263a62331c951e367556cdc0cee9b7
SHA512550ce7b5e52dd67ec5991d9e2fecfa430c679198fa22407a79ad2c10579b6fcdbcf7906ebcc080f4427f98f60d93c0dae01a91f800fdc8616e9d5fb1f8944465