Overview

overview

10

Static

static

3

207695cd3b...18.exe

windows7-x64

7

207695cd3b...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/05/2024, 11:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    207695cd3b73332d8248024fafc55e18_JaffaCakes118.exe
  • Size 40KB
  • Sample240507-ntsgvsha26
  • SHA256 9bbade3b356fc7aa39174ee6e6bcd0122e409cebb7fad4b890ede285943064e9
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
googlemicrosoftpersistencephishingproduct:outlookupx

Malware Config

Signatures

  • Detected google phishing page
    phishinggoogle
  • Detected microsoft outlook phishing page
    phishingmicrosoftproduct:outlook
  • Executes dropped EXE 1 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\207695cd3b73332d8248024fafc55e18_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\207695cd3b73332d8248024fafc55e18_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1312
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2204

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        default[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3X7K2ORY\default[2].htm
        • Size 311B
        • SHA256 26b9da0ba2f737d0a226ab6d5b934b0e519aeda10f497cd4738752761ccb7af1
        • MD5 SHA1 SHA512
        Submit Download

        results[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3X7K2ORY\results[7].htm
        • Size 1KB
        • SHA256 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea
        • MD5 SHA1 SHA512
        Submit Download

        search2151WLKG.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3X7K2ORY\search2151WLKG.htm
        • Size 147KB
        • SHA256 31e3d8c0293975dfdcfb5cc35a1065ee75999fffa043a37cc6ac2afce3193e86
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search6ZXMAG9T.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3X7K2ORY\search6ZXMAG9T.htm
        • Size 109KB
        • SHA256 5a25deea6f6fefda3eb34f0cd3c268d5beee28e9dd694e72167591985a8fc5dd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchN4NSU2KO.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3X7K2ORY\searchN4NSU2KO.htm
        • Size 98KB
        • SHA256 9ac41390dc786c67cbcaeb70ae3e23435b8650e0db359682f06d61a72f3b37f8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchY77JWX6C.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3X7K2ORY\searchY77JWX6C.htm
        • Size 135KB
        • SHA256 87e3ea376b4b5b67c2b3b13b335b26e5f9362e3ee830cff4126de9ca8c8d64df
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3X7K2ORY\search[3].htm
        • Size 118KB
        • SHA256 02cd48cc09a01aed805899ab4a1d92a0e6da103969872492b96df39f01c5249c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3X7K2ORY\search[6].htm
        • Size 154KB
        • SHA256 6062fe404a55c75ad65a26066ee160674742fe25c8a434f91399b892ca04d13b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        CYPZJB1O.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B91VJWSD\CYPZJB1O.htm
        • Size 175KB
        • SHA256 d42efc8e6534b8eefe5b41ac9a560a976e90289df0c75e9fcccd4f93247f6233
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B91VJWSD\default[4].htm
        • Size 305B
        • SHA256 8553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac
        • MD5 SHA1 SHA512
        Submit Download

        search1Z0QVYVA.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B91VJWSD\search1Z0QVYVA.htm
        • Size 143KB
        • SHA256 d05de1538070c71b9e029b572c73f9e2d3e3401d06011a110d5b00b66a0c96d5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchJ04XANBJ.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B91VJWSD\searchJ04XANBJ.htm
        • Size 117KB
        • SHA256 094967b5505c18c71a52e010d2e673a89a907b18205fb61e7ec01c5e0ac85546
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchMHJCNL2X.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B91VJWSD\searchMHJCNL2X.htm
        • Size 111KB
        • SHA256 ff9b02bde17ece42713a54df4c3631a8a93f26f4f007ac518f8ea9c06e028159
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[10].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B91VJWSD\search[10].htm
        • Size 117KB
        • SHA256 bdb2d5c08b8564c690653bcd32cdcacce249c521f2247d6eb17072e75fbe3465
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B91VJWSD\search[1].htm
        • Size 121KB
        • SHA256 64a9adfc6b7125dbe9397bb08ab798cb03f4bf70f9b714c497578a5f46190841
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B91VJWSD\search[6].htm
        • Size 112KB
        • SHA256 06fe520c95f1486822dde868ac77cbcee7bf8c7b9ae9ba2224a5351668123b53
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W1O6EZKR\results[4].htm
        • Size 1KB
        • SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
        • MD5 SHA1 SHA512
        Submit Download

        results[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W1O6EZKR\results[5].htm
        • Size 1KB
        • SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
        • MD5 SHA1 SHA512
        Submit Download

        search18BWRCBV.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W1O6EZKR\search18BWRCBV.htm
        • Size 130KB
        • SHA256 6a91db563fbe0caf82536446dec8b45d98654c5f87ebebf86d5bdd0944ff6f65
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W1O6EZKR\search[3].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        search[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W1O6EZKR\search[4].htm
        • Size 136KB
        • SHA256 4144550743107cf8d790c9c61c46f2778c1b0294dda22aeee6429cdb307eb71b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\W1O6EZKR\search[7].htm
        • Size 128KB
        • SHA256 0bdf62ec7bedebc5cd4a985bee160d806d8a2aafffc6a04a6dc813f574d2d162
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[10].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y2LQBQ0P\default[10].htm
        • Size 315B
        • SHA256 202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf
        • MD5 SHA1 SHA512
        Submit Download

        default[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y2LQBQ0P\default[1].htm
        • Size 312B
        • SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
        • MD5 SHA1 SHA512
        Submit Download

        default[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y2LQBQ0P\default[7].htm
        • Size 310B
        • SHA256 231fe7c979332b82ceccc3b3c0c2446bc2c3cab5c46fb7687c4bb579a8bba7ce
        • MD5 SHA1 SHA512
        Submit Download

        searchGXLC0KRQ.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y2LQBQ0P\searchGXLC0KRQ.htm
        • Size 107KB
        • SHA256 1c5c76a826abddbf9ccc4760995155621603f5d734eeee0c19de4e6ce1d4b569
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchI00BQCZ1.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y2LQBQ0P\searchI00BQCZ1.htm
        • Size 112KB
        • SHA256 9dcea6bb9b16072b9961a130bbc30832709a5d65ca872117d61355a38bb3f6e1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchUHDV43EQ.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y2LQBQ0P\searchUHDV43EQ.htm
        • Size 143KB
        • SHA256 ec95630b9967059d00444bed9d79324a9446c57702a3f8d363b62bf274903fe4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmpEE67.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmpEE67.tmp
        • Size 40KB
        • SHA256 b00e8fda5ad8ac549a4f5071f41b1ac03b5f7ccdf09301f5ff8e8f069c0d819e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 51e308c41397233b925b855bce8146fd3a79a0cf27e712d060eba93706d4dff2
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 491d5687a01a2456ce554898a7e3572ab99018ff81ef1c89ceb9ca7618ce415a
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 a8158b517c26232295256e3c34a7d015b786afda5b2a5dbcfc8270c173654cd5
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 3f8840c2b0b8789d4929290dd062d7bde0c1dea0a91f37a0501623672e34468c
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 12b164b27d91acef42b2b3d17647a5f1f4b001812f48a6a51e92d3c52bfe3693
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 9fc32519a40217426878517fa086ff6749462ee8bfacb0fc083bd25ebeda4820
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 55fd498ee37b00e0436513e7e637c610613ed76cbd7ecc48dfebc7530a8bae11
        • MD5 SHA1 SHA512
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1312-0-0x0000000000500000-0x000000000050D000-memory.dmp
        Download

        memory/2204-388-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2204-13-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2204-686-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2204-248-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2204-718-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2204-21-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2204-17-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2204-22-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2204-649-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2204-249-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2204-5-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2204-172-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2204-856-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2204-579-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2204-253-0x0000000000400000-0x0000000000408000-memory.dmp
        Download