Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
31/10/2024, 00:59
General
- Target 80ef43d2262b6c9af67b54a8ac8b3f27_JaffaCakes118.xls
- Size 512KB
- Sample241031-bb9l7sxjdl
- SHA256 ad76b6d8ed0c958197097ca1b47694e8c9f8bc1256257462b8f4021bc500afa3
Malware Config
Signatures
- Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Deletes itself 1 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\80ef43d2262b6c9af67b54a8ac8b3f27_JaffaCakes118.xls"1⤵
- Deletes itself
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c attrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\attrib.exeattrib -S -h "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"3⤵
- Views/modifies file attributes
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c Del /F /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"2⤵
- Process spawned unexpected child process
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c RD /S /Q "C:\Users\Admin\AppData\Roaming\Microsoft\Excel\XLSTART\K4.XLS"2⤵
- Process spawned unexpected child process
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
80ef43d2262b6c9af67b54a8ac8b3f27_JaffaCakes118.xls
b8ab77100df80ab2.customDestinations-ms
memory/2784-16-0x00007FFCAB180000-0x00007FFCAB190000-memory.dmp
memory/2784-48-0x00007FFCED650000-0x00007FFCED845000-memory.dmp
memory/2784-3-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp
memory/2784-2-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp
memory/2784-8-0x00007FFCED650000-0x00007FFCED845000-memory.dmp
memory/2784-7-0x00007FFCED650000-0x00007FFCED845000-memory.dmp
memory/2784-6-0x00007FFCED650000-0x00007FFCED845000-memory.dmp
memory/2784-12-0x00007FFCED650000-0x00007FFCED845000-memory.dmp
memory/2784-47-0x00007FFCED650000-0x00007FFCED845000-memory.dmp
memory/2784-13-0x00007FFCED650000-0x00007FFCED845000-memory.dmp
memory/2784-15-0x00007FFCED650000-0x00007FFCED845000-memory.dmp
memory/2784-14-0x00007FFCAB180000-0x00007FFCAB190000-memory.dmp
memory/2784-10-0x00007FFCED650000-0x00007FFCED845000-memory.dmp
memory/2784-9-0x00007FFCED650000-0x00007FFCED845000-memory.dmp
memory/2784-4-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp
memory/2784-0-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp
memory/2784-11-0x00007FFCED650000-0x00007FFCED845000-memory.dmp
memory/2784-42-0x00007FFCED650000-0x00007FFCED845000-memory.dmp
memory/2784-57-0x00007FFCED650000-0x00007FFCED845000-memory.dmp
memory/2784-56-0x00007FFCED650000-0x00007FFCED845000-memory.dmp
memory/2784-59-0x00007FFCED650000-0x00007FFCED845000-memory.dmp
memory/2784-58-0x00007FFCED650000-0x00007FFCED845000-memory.dmp
memory/2784-71-0x00007FFCED650000-0x00007FFCED845000-memory.dmp
memory/2784-5-0x00007FFCAD6D0000-0x00007FFCAD6E0000-memory.dmp
memory/2784-104-0x00007FFCED650000-0x00007FFCED845000-memory.dmp
memory/2784-105-0x00007FFCED650000-0x00007FFCED845000-memory.dmp
memory/2784-106-0x00007FFCED6ED000-0x00007FFCED6EE000-memory.dmp
memory/2784-107-0x00007FFCED650000-0x00007FFCED845000-memory.dmp
memory/2784-108-0x00007FFCED650000-0x00007FFCED845000-memory.dmp
memory/2784-109-0x00007FFCED650000-0x00007FFCED845000-memory.dmp
memory/2784-113-0x00007FFCED650000-0x00007FFCED845000-memory.dmp
memory/2784-1-0x00007FFCED6ED000-0x00007FFCED6EE000-memory.dmp