Overview

overview

10

Static

static

3

1f57822e30...18.exe

windows7-x64

7

1f57822e30...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/05/2024, 03:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1f57822e307136f25cd37727b1905dce_JaffaCakes118.exe
  • Size 40KB
  • Sample240507-eb7dmagf5w
  • SHA256 9eb9b2f49b8a9a465f3795aaaacc499776f7563b3d19cb316b6fc5f6b953c45e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
microsoftpersistencephishingproduct:outlookupx

Malware Config

Signatures

  • Detected microsoft outlook phishing page
    phishingmicrosoftproduct:outlook
  • Executes dropped EXE 1 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f57822e307136f25cd37727b1905dce_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1f57822e307136f25cd37727b1905dce_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4856
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2316

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        default[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5ACXXH1H\default[1].htm
        • Size 312B
        • SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
        • MD5 SHA1 SHA512
        Submit Download

        search[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5ACXXH1H\search[3].htm
        • Size 112KB
        • SHA256 c9e3cc542483692fe661939e1ed897dd35b9514192384759193328d106bdc417
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5ACXXH1H\search[4].htm
        • Size 117KB
        • SHA256 8957947d69a2d77e021a90cca4215a05569c3a91c4329a7cd7b1b6c3e6b63011
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5ACXXH1H\search[6].htm
        • Size 125KB
        • SHA256 c49970ced89170e5a78e877c4f67b6e86aa3278446ba32a2bc1d26884d086ebc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[9].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5ACXXH1H\search[9].htm
        • Size 143KB
        • SHA256 d44066e108288579f425b4cc29392f80d11f622eaef4cd90dd08d502533af9dc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KQH3BVSD\default[1].htm
        • Size 312B
        • SHA256 3d7c76daab98368a0dd25cd184db039cdd5d1bc9bd6e9bb91b289119047f5432
        • MD5 SHA1 SHA512
        Submit Download

        results[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KQH3BVSD\results[1].htm
        • Size 1KB
        • SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
        • MD5 SHA1 SHA512
        Submit Download

        results[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LYH0CKVD\results[8].htm
        • Size 1KB
        • SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
        • MD5 SHA1 SHA512
        Submit Download

        searchRYN5OUMQ.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LYH0CKVD\searchRYN5OUMQ.htm
        • Size 158KB
        • SHA256 c921035ae59902c3c8cca7e80971142de4c1980efa23b466c784db8c9ae60e49
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LYH0CKVD\search[2].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        search[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LYH0CKVD\search[6].htm
        • Size 118KB
        • SHA256 44cbab902292b37cb424d2419c7b48763bb84bda6099ce80257ee3ca60e14fb5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        U0Z1VPA0.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PQX1KJ9K\U0Z1VPA0.htm
        • Size 176KB
        • SHA256 89f4551d80482eb5b92296c172b2cafb68b3394d7dda6af7fcb19f37bac3e7ef
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchDXIGW91H.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PQX1KJ9K\searchDXIGW91H.htm
        • Size 116KB
        • SHA256 e5462292f8150aa64630e4194a5625715332ea6a2022330601e40031aa5da795
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchYHTKRNOZ.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PQX1KJ9K\searchYHTKRNOZ.htm
        • Size 133KB
        • SHA256 a6238113d8b67d460aa8e7c5267f08162725faa6d1bbe96ead1615cf7e06d408
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PQX1KJ9K\search[5].htm
        • Size 143KB
        • SHA256 40cff66681fa9cb7ba0f95f76567236197dfd34f851e5825aee5dd8d0c32387b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmp8654.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp8654.tmp
        • Size 40KB
        • SHA256 3b861cb141dff1704b446a22a3b9fedf297ee99db4994e3a5cf1e3208dd2b23e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 063c7103fd9ee80f36f3919962791b1641db62ec395d3a0e0d8eec299318de1e
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 feb595531dad415ffd3a1492974f28d561bad25266a38799e904a95a4cfd88b3
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 f08ae3664cf2c08a0e8e0a00934accbe93791ba0642f552e01c06d72c8309bcf
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 bdedc528cc378317db9e7c1ca04edf2564aa274c00f15624e62a7e64eea1271c
        • MD5 SHA1 SHA512
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/2316-26-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2316-22-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2316-283-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2316-17-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2316-326-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2316-276-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2316-279-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2316-21-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2316-465-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2316-13-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2316-162-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2316-35-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2316-31-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2316-30-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2316-7-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4856-0-0x0000000000500000-0x000000000050D000-memory.dmp
        Download