1352714a93fa17e19e034631f5279a95ed19288bc5991b2b782353d06a7c9333

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
907748201a8080254cb686160776dd95_JaffaCakes118.exe
Size 40KB
Sample240603-ej95gsae7s
SHA256 1352714a93fa17e19e034631f5279a95ed19288bc5991b2b782353d06a7c9333
MD5 907748201a8080254cb686160776dd95
SHA1 10b1c4fa3fb142b61db29748de0fd4828da0774f
SHA512 63e9dc30cb7064f50b2d85ddba17069f38c3fbd88eabd042c5224482bc8528fd8a893c8a7e5331efa6d3f1813f3c6c670d31c98013117f899df527b329644f6f
SSDEEP 768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtH7S:aqk/Zdic/qjh8w19JDH7S
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

microsoft persistence phishing product:outlook upx

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook

Executes dropped EXE 1 IoCs

pid	Process
1228	services.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a0000000232fb-4.dat	upx
behavioral2/memory/1228-7-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1228-13-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1228-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1228-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1228-22-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1228-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1228-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1228-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1228-35-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1228-39-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1228-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1228-104-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1228-303-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1228-304-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/1228-308-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	907748201a8080254cb686160776dd95_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	907748201a8080254cb686160776dd95_JaffaCakes118.exe
File opened for modification	C:\Windows\java.exe	907748201a8080254cb686160776dd95_JaffaCakes118.exe
File created	C:\Windows\java.exe	907748201a8080254cb686160776dd95_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 1228	4812	907748201a8080254cb686160776dd95_JaffaCakes118.exe	91
PID 4812 wrote to memory of 1228	4812	907748201a8080254cb686160776dd95_JaffaCakes118.exe	91
PID 4812 wrote to memory of 1228	4812	907748201a8080254cb686160776dd95_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\907748201a8080254cb686160776dd95_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\907748201a8080254cb686160776dd95_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3596,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=1316 /prefetch:8
1⤵
PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NWL1H785.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\44ZGVQ6R\NWL1H785.htm
Size 175KB
SHA256 7b526af6ddbc99b9af2c84b37a0ad41798e99fc106a2207e306e084a9c454b78
MD5 bb0327fe07a4ad00a3be8f7854625069
SHA1 a5e8e42710757143d975c6bdb57c765b28f1419b
SHA512 087d30bdff989d02efb1b097c18140c74dd4a64464bd5f86069ef79dcf4739e7857ef1fc230b1eca84428eb005784d7b64ea80d993290bbba5099663d9056058
SSDEEP 1536:4jFDsMoamI1MGAzVbGAQU7+P1S0kyFK++zG58TJLDPkNWoamI1MGoamI1MdHiO2y:uoIeGAzVCbS0ZK+QG58TJL2IetIet1T
MD5 SHA1 SHA512 SSDEEP

Submit Download

search[4].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\44ZGVQ6R\search[4].htm
Size 114KB
SHA256 a3e23a775d7878cde1bd0e5afeac498442f238dc83c56e7373c664380fd7b042
MD5 3af859e4ac961bbbab95126b750867fb
SHA1 27f78d842112f8cc4e6702e0ef0d51e69cd5e6ad
SHA512 8873fcaaa39f87f29ab798c555e89cd49a654d6e3eaca6db6dd40300cbe4928e2649b2572c283fa9f6c696b821486c3b61ec3c3c41430ff04203119bbf8ce3b7
SSDEEP 3072:QWIe8AFGhRVT4uc3b32YzBrw+CbI8Q8V8AoUVx+qVl8rp:QwFqtiAoqx+qVlKp
MD5 SHA1 SHA512 SSDEEP

Submit Download

search[3].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7UY3WOJS\search[3].htm
Size 25B
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
MD5 SHA1 SHA512

Submit Download

search[5].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7UY3WOJS\search[5].htm
Size 119KB
SHA256 c4bc8a42e25e0e3e55fdec8315e522c55ada5ad52aa52ef0d815bcb6c5d3f110
MD5 ab7d60397cf31a33f876ddeac1957c4f
SHA1 ea44af41cf826948de48d294cf02fa197b500e65
SHA512 b6704c700c9fda375ee9c84a431c592ca3107322dd4ff12e8445ca450b69e45a025f292a49aa8bd9b6f307c58104cb8894d075a6b95e85d0dddfd4e0e7e9d84b
SSDEEP 3072:UWIeEJScMNR9Bx0BOf6o/s7vFa7evogNII:UHqUo27
MD5 SHA1 SHA512 SSDEEP

Submit Download

results[3].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YOJF4VYG\results[3].htm
Size 1KB
SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
MD5 211da0345fa466aa8dbde830c83c19f8
SHA1 779ece4d54a099274b2814a9780000ba49af1b81
SHA512 37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca
MD5 SHA1 SHA512

Submit Download

lcpitpvwg.log

Path C:\Users\Admin\AppData\Local\Temp\lcpitpvwg.log
Size 1KB
SHA256 231c75ec0f1fe15ea034f23311a79495b06afd27a2f22e43c78c2ebe63b9f755
MD5 34609cca7122c3f4efc3ac166ec1287e
SHA1 7a1c1d3ec124babecad5e2b898041030f01018f2
SHA512 a962c77af63e3be7b8077fec52570505b1bff0a13c61fe225a17b1358c2b502d7b57f5bfd41624def11adab154bd93e685f7d9c5bfefe457be3bdf76eac3cb9f
MD5 SHA1 SHA512

Submit Download

tmp8FB3.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp8FB3.tmp
Size 40KB
SHA256 928be590df8020844af06ff3efb92d7d8ef63bb2b249a384e5f290892c093e01
MD5 544e8860b48de766e4f82a9d0518e27a
SHA1 028641a6910e5a4d89a3fbeec9749704ecc7485a
SHA512 af22d1731348668dd53e14bb002e43e0dd224b2b6a52a9a7fe54e7b75b4d2d7f76a911f6f7f99e4caf3bb5c02615cf92bcac4bb559ac3811c015f135fc496777
SSDEEP 768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHp:aqk/Zdic/qjh8w19JDHp
MD5 SHA1 SHA512 SSDEEP

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 1KB
SHA256 ca8af56a31d901ab57d672c5026d2ee56441192c4e2a2b3a2555883e06001a75
MD5 079902987ab5aad3764882a63deaa53a
SHA1 7376ff103f4d3d9d612fa4038dad297ed0eef4c6
SHA512 813a3a25e45b814bf6bb8b8a618d921d1b2962df8ada39f60cd2129cddcade4b52731e8c37a940d115de42664639ce9973d75f9c7bc60734946795db8de94d10
MD5 SHA1 SHA512

Submit Download

services.exe

Path C:\Windows\services.exe
Size 8KB
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
SSDEEP 192:tZWNqWKIzebvOZnzCj6juhEJS3/Uf/tpfmG62X9f3:tZ6qWTYvczfahX/UHtF6e9f3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1228-21-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1228-104-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1228-35-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1228-39-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1228-40-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1228-30-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1228-26-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1228-31-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1228-22-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1228-308-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1228-17-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1228-13-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1228-7-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1228-303-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/1228-304-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/4812-0-0x0000000000500000-0x000000000050D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads