Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
01/04/2024, 03:52
General
- Target 66fc3a33c812bf8b021f301da489ed7d_JaffaCakes118.exe
- Size 30KB
- Sample240401-ee8qvsdc67
- SHA256 a3832604136ad7c1ec302c586d7a9f9d2aac6612ca50d74c1bf5fdeb7e64bef6
Malware Config
Signatures
- Detected google phishing page
- Executes dropped EXE 1 IoCs
- UPX packed file 28 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in Windows directory 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\66fc3a33c812bf8b021f301da489ed7d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\66fc3a33c812bf8b021f301da489ed7d_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
default[1].htm
default[2].htm
search[2].htm
default[2].htm
search[2].htm
search[3].htm
default[6].htm
search[2].htm
KRJ3I6KC.htm
default[1].htm
tmp4747.tmp
zincite.log
zincite.log
zincite.log
services.exe
memory/1556-24-0x0000000000400000-0x0000000000408000-memory.dmp
memory/1556-36-0x0000000000400000-0x0000000000408000-memory.dmp
memory/1556-162-0x0000000000400000-0x0000000000408000-memory.dmp
memory/1556-389-0x0000000000400000-0x0000000000408000-memory.dmp
memory/1556-344-0x0000000000400000-0x0000000000408000-memory.dmp
memory/1556-207-0x0000000000400000-0x0000000000408000-memory.dmp
memory/1556-31-0x0000000000400000-0x0000000000408000-memory.dmp
memory/1556-211-0x0000000000400000-0x0000000000408000-memory.dmp
memory/1556-26-0x0000000000400000-0x0000000000408000-memory.dmp
memory/1556-213-0x0000000000400000-0x0000000000408000-memory.dmp
memory/1556-288-0x0000000000400000-0x0000000000408000-memory.dmp
memory/1556-19-0x0000000000400000-0x0000000000408000-memory.dmp
memory/1556-232-0x0000000000400000-0x0000000000408000-memory.dmp
memory/1556-14-0x0000000000400000-0x0000000000408000-memory.dmp
memory/1556-7-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4892-35-0x0000000000500000-0x0000000000510000-memory.dmp
memory/4892-287-0x0000000000500000-0x0000000000510000-memory.dmp
memory/4892-231-0x0000000000500000-0x0000000000510000-memory.dmp
memory/4892-212-0x0000000000500000-0x0000000000510000-memory.dmp
memory/4892-210-0x0000000000500000-0x0000000000510000-memory.dmp
memory/4892-343-0x0000000000500000-0x0000000000510000-memory.dmp
memory/4892-206-0x0000000000500000-0x0000000000510000-memory.dmp
memory/4892-161-0x0000000000500000-0x0000000000510000-memory.dmp
memory/4892-388-0x0000000000500000-0x0000000000510000-memory.dmp
memory/4892-0-0x0000000000500000-0x0000000000510000-memory.dmp
memory/4892-13-0x0000000000500000-0x0000000000510000-memory.dmp