Analysis

  • max time kernel
    141s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-10-2024 01:03

General

  • Target

    4510572427d19ed33b53ff1e1004ad9a_JaffaCakes118.xls

  • Size

    22KB

  • MD5

    4510572427d19ed33b53ff1e1004ad9a

  • SHA1

    76b8a711cd9e3efff01e2561b9fa83d0b232da4b

  • SHA256

    2846bc45153d46da5ab040e71ac5874608aa66c60e99d631bd68c02a48a1b93a

  • SHA512

    8c094f08917da85b9c537989ec09da4c365c3bb05dd2747fc40a6248a53d4f0d4e8984b0f7198c810c34d49cb0b6c4d26f2bf3da746fd53da860ef673ea58cc7

  • SSDEEP

    384:yffffOyrER2FOEyYx7DuoeeiIM8JmhCTbH+E//E6uQ5gU:yffffOyrER2HV7yoeebM8GCTbH+HPsgU

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\4510572427d19ed33b53ff1e1004ad9a_JaffaCakes118.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1472

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\VB7A51.tmp

    Filesize

    916B

    MD5

    cdb57ead2f39e5ed8a246b49fb9237b8

    SHA1

    757f0849f5a3b9f9b20672fe2262e74b92a5c8d2

    SHA256

    711dc330ea9e0504b38c23e880d2dddb239a20562782a41ce0e4e54188633c43

    SHA512

    d9ed2f1949d4a3bd6c33d15c20319a41f93a6977e99baaee542cb6cc38d9ce72d583aca34d3f973383fe636241fd30c63b053ef99937f653d1b72218681a8a30

  • C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\9F875E00

    Filesize

    8KB

    MD5

    d3352a91a032cec98a4a224f7f8a8e18

    SHA1

    87afe9353d94e8e72662dac3e1186036aa0616ca

    SHA256

    5724dd98e6c8af89b93ac689cda8985e59edfe6fb3fc7969f9a78d1673bd623a

    SHA512

    4f001954cbc7b431f5e869ba2c31a44d8d7e8256055e3197c4d5fdc8df812c494ee5128c9d22371ffff77eb736f5848276ae1d6d8af7434862a610d36060128b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\StartUp.xls

    Filesize

    8KB

    MD5

    28027a9b8a70f172056c1ef15e5147eb

    SHA1

    36720b8bf49131d99670e1250bb9b863486e2cd2

    SHA256

    0ebfd77274d1bb12efca6284040c87094568c31e1ec6204be7fb7b6829a5fbd0

    SHA512

    97ef1c6c66cbed6b199f0a215877a997db58a143476ae1e71834cb3f5ab31bf567a5a8fa3edc1fe37604103f72a241444ec957e31093d24ffe59176a4315a729

  • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

    Filesize

    330B

    MD5

    19aa68d4b4158ddf5a9cd8cfba0833cb

    SHA1

    a1be6110fa97b8ae87a87002341b2e0ed739aa40

    SHA256

    8b45207473396b0dbb6cd5946f4f50ba6e3fd39197ef395d7baed15d55b084f2

    SHA512

    c7fce40e992671aee8fcd162da5f863bd34b900a2f9f5b949401e6eca09225b3f360701805f7ab19eb5e1f0dca26e42d9ec63ba12ab5ead7531e790c489364a1

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

    Filesize

    1KB

    MD5

    5c4850a8a7f1fc690ace85ce8472b2ba

    SHA1

    e8c6364849cb54773512edaed00f2d0f43b03683

    SHA256

    e2bd47d70b88f5d92a363a6a632d96bca8263a62331c951e367556cdc0cee9b7

    SHA512

    550ce7b5e52dd67ec5991d9e2fecfa430c679198fa22407a79ad2c10579b6fcdbcf7906ebcc080f4427f98f60d93c0dae01a91f800fdc8616e9d5fb1f8944465

  • memory/1472-10-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

    Filesize

    2.0MB

  • memory/1472-5-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

    Filesize

    2.0MB

  • memory/1472-8-0x00007FFBB06F0000-0x00007FFBB0700000-memory.dmp

    Filesize

    64KB

  • memory/1472-0-0x00007FFBB06F0000-0x00007FFBB0700000-memory.dmp

    Filesize

    64KB

  • memory/1472-9-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

    Filesize

    2.0MB

  • memory/1472-12-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

    Filesize

    2.0MB

  • memory/1472-15-0x00007FFBADE70000-0x00007FFBADE80000-memory.dmp

    Filesize

    64KB

  • memory/1472-14-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

    Filesize

    2.0MB

  • memory/1472-13-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

    Filesize

    2.0MB

  • memory/1472-11-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

    Filesize

    2.0MB

  • memory/1472-16-0x00007FFBADE70000-0x00007FFBADE80000-memory.dmp

    Filesize

    64KB

  • memory/1472-7-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

    Filesize

    2.0MB

  • memory/1472-30-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

    Filesize

    2.0MB

  • memory/1472-6-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

    Filesize

    2.0MB

  • memory/1472-39-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

    Filesize

    2.0MB

  • memory/1472-48-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

    Filesize

    2.0MB

  • memory/1472-49-0x00007FFBF070D000-0x00007FFBF070E000-memory.dmp

    Filesize

    4KB

  • memory/1472-50-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

    Filesize

    2.0MB

  • memory/1472-2-0x00007FFBB06F0000-0x00007FFBB0700000-memory.dmp

    Filesize

    64KB

  • memory/1472-3-0x00007FFBB06F0000-0x00007FFBB0700000-memory.dmp

    Filesize

    64KB

  • memory/1472-4-0x00007FFBB06F0000-0x00007FFBB0700000-memory.dmp

    Filesize

    64KB

  • memory/1472-99-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

    Filesize

    2.0MB

  • memory/1472-98-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

    Filesize

    2.0MB

  • memory/1472-100-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

    Filesize

    2.0MB

  • memory/1472-101-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

    Filesize

    2.0MB

  • memory/1472-105-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

    Filesize

    2.0MB

  • memory/1472-1-0x00007FFBF070D000-0x00007FFBF070E000-memory.dmp

    Filesize

    4KB

  • memory/1472-111-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

    Filesize

    2.0MB