40cb457d0a503560058b9d85bd5b64fd7008c663189436033fdcd7579186a93e

General

Target

de65e9220113457510a1160dc80c17fa_JaffaCakes118.xls
Size

36KB
MD5

de65e9220113457510a1160dc80c17fa
SHA1

bc4a366875e108d4108b657b1b183caa4119ecf4
SHA256

40cb457d0a503560058b9d85bd5b64fd7008c663189436033fdcd7579186a93e
SHA512

fb9ad66fb229db1af6dd7b2a5e33ba2232897cb42f1fc725820ff5cbd755517aa5de05ecab8a0a6b0de5e1740d1a1205d60fd0b865455179663c0525dd64a4e4
SSDEEP

768:EPqNk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJFgK4xIHOXI6FUxqQ:gok3hbdlylKsgqopeJBWhZFGkE+cL2N2

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	1844	2972	explorer.exe	82

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2972	EXCEL.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2972	EXCEL.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2972	EXCEL.EXE
2972	EXCEL.EXE
2972	EXCEL.EXE
2972	EXCEL.EXE
2972	EXCEL.EXE
2972	EXCEL.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 1844	2972	EXCEL.EXE	87
PID 2972 wrote to memory of 1844	2972	EXCEL.EXE	87
PID 3156 wrote to memory of 4468	3156	explorer.exe	89
PID 3156 wrote to memory of 4468	3156	explorer.exe	89

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\de65e9220113457510a1160dc80c17fa_JaffaCakes118.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\explorer.exe
  explorer.exe C:\Users\Public\Documents\KY8eY2.vbs
  2⤵
  - Process spawned unexpected child process
  PID:1844

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\KY8eY2.vbs"
  2⤵
  PID:4468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Documents\KY8eY2.vbs

Filesize
604B

MD5
506a5e3cb4ef47b2683ea6501ce54332

SHA1
240797d50fea745fe166447323edf9cdeb8f18ca

SHA256
d7da1ddbc5a77d182646ccfd5a155ab0fa7f3035f557277fd59049760d0c9670

SHA512
2d2610cda6c38661f5d9ff118513cc04880fce565eda65b2187d23fea27a97fb8af8b61f23bba7488960e7422f8dc3bfed372bc087ad2d53ae51f3ff5d82d82f

Download Submit
memory/2972-12-0x00007FFDAB930000-0x00007FFDABB25000-memory.dmp

Filesize
2.0MB

Download
memory/2972-0-0x00007FFD6B9B0000-0x00007FFD6B9C0000-memory.dmp

Filesize
64KB

Download
memory/2972-13-0x00007FFD69840000-0x00007FFD69850000-memory.dmp

Filesize
64KB

Download
memory/2972-7-0x00007FFD6B9B0000-0x00007FFD6B9C0000-memory.dmp

Filesize
64KB

Download
memory/2972-6-0x00007FFDAB930000-0x00007FFDABB25000-memory.dmp

Filesize
2.0MB

Download
memory/2972-10-0x00007FFDAB930000-0x00007FFDABB25000-memory.dmp

Filesize
2.0MB

Download
memory/2972-11-0x00007FFDAB930000-0x00007FFDABB25000-memory.dmp

Filesize
2.0MB

Download
memory/2972-1-0x00007FFDAB9CD000-0x00007FFDAB9CE000-memory.dmp

Filesize
4KB

Download
memory/2972-28-0x00007FFDAB930000-0x00007FFDABB25000-memory.dmp

Filesize
2.0MB

Download
memory/2972-3-0x00007FFD6B9B0000-0x00007FFD6B9C0000-memory.dmp

Filesize
64KB

Download
memory/2972-2-0x00007FFD6B9B0000-0x00007FFD6B9C0000-memory.dmp

Filesize
64KB

Download
memory/2972-9-0x00007FFDAB930000-0x00007FFDABB25000-memory.dmp

Filesize
2.0MB

Download
memory/2972-5-0x00007FFDAB930000-0x00007FFDABB25000-memory.dmp

Filesize
2.0MB

Download
memory/2972-14-0x00007FFD69840000-0x00007FFD69850000-memory.dmp

Filesize
64KB

Download
memory/2972-4-0x00007FFD6B9B0000-0x00007FFD6B9C0000-memory.dmp

Filesize
64KB

Download
memory/2972-26-0x00007FFDAB930000-0x00007FFDABB25000-memory.dmp

Filesize
2.0MB

Download
memory/2972-27-0x00007FFDAB9CD000-0x00007FFDAB9CE000-memory.dmp

Filesize
4KB

Download
memory/2972-8-0x00007FFDAB930000-0x00007FFDABB25000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads