Overview

overview

10

Static

static

3

91a8c225c0...18.exe

windows7-x64

7

91a8c225c0...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 11:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    91a8c225c0f4203e1ac1df499e799801_JaffaCakes118.exe
  • Size 40KB
  • Sample240603-nwghdaee92
  • SHA256 aada9681004bdd5134497bd6b1e603b8b51554876f174c1f23c9c6c391bffd5d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
microsoftpersistencephishingproduct:outlookupx

Malware Config

Signatures

  • Detected microsoft outlook phishing page
    phishingmicrosoftproduct:outlook
  • Executes dropped EXE 1 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\91a8c225c0f4203e1ac1df499e799801_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\91a8c225c0f4203e1ac1df499e799801_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4292
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:3248

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        default[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6SQF6WJH\default[3].htm
        • Size 310B
        • SHA256 231fe7c979332b82ceccc3b3c0c2446bc2c3cab5c46fb7687c4bb579a8bba7ce
        • MD5 SHA1 SHA512
        Submit Download

        search3PRYIH74.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6SQF6WJH\search3PRYIH74.htm
        • Size 127KB
        • SHA256 fd05b4512dbb1cb6575e3b23a120de9b11bcedd24491dd1df1628d13baf7a6b3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchNJLNO8ZZ.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6SQF6WJH\searchNJLNO8ZZ.htm
        • Size 122KB
        • SHA256 2255a4086d41e1d6fe062b7ca7209895717c1f16e15129104db18d179883aa99
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchXTIBNQAN.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6SQF6WJH\searchXTIBNQAN.htm
        • Size 110KB
        • SHA256 12d92a9ce276802d0b577dc8d17721be3ffe04871243d8b765ee34cb4b704584
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6SQF6WJH\search[1].htm
        • Size 117KB
        • SHA256 cc88734933f17dc13ad51a0903f15cc7b15586d146abb2e6e4656d6e72078b48
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        0Q493XKK.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ED9UQUDY\0Q493XKK.htm
        • Size 176KB
        • SHA256 0208898ee2069543fe8e603437ff99e328f12efdf81a3bac6655af4b66cc9565
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ED9UQUDY\results[4].htm
        • Size 1KB
        • SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
        • MD5 SHA1 SHA512
        Submit Download

        results[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ED9UQUDY\results[5].htm
        • Size 1KB
        • SHA256 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea
        • MD5 SHA1 SHA512
        Submit Download

        searchGLI3FRA6.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ED9UQUDY\searchGLI3FRA6.htm
        • Size 123KB
        • SHA256 fc832c51b73ec52bf741cd57f2d88656c5c874a33122f363021bd76b22ec8b84
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ED9UQUDY\search[1].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        searchDS2180GO.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NCVVYLW7\searchDS2180GO.htm
        • Size 113KB
        • SHA256 b06424c7a2ba316f825711dec4014af6a42e065280471499c6f5440d284992c3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchO949GQXR.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NCVVYLW7\searchO949GQXR.htm
        • Size 129KB
        • SHA256 7d31fdebbfcb308ea4106d5f4113a9be2a50295b0efd45288e43313c0e807b0e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NCVVYLW7\search[6].htm
        • Size 161KB
        • SHA256 8ca578332b24d5cb38d4dc2ceaa8b726466322da4edafb371066aca2ae9f717e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        OXW12F9W.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QEA1P7KF\OXW12F9W.htm
        • Size 176KB
        • SHA256 a28f518f3c4dd5ca4b997b26cb0ccb1b912e32c55c9e1862c3bf7c3ec25d1f12
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QEA1P7KF\results[2].htm
        • Size 1KB
        • SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
        • MD5 SHA1 SHA512
        Submit Download

        searchYJHT65WF.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QEA1P7KF\searchYJHT65WF.htm
        • Size 123KB
        • SHA256 282d2a7f6e6d29003bba7e8bac39da4a9ab3be930d73e29de8a4a4c37c2e5617
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[10].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QEA1P7KF\search[10].htm
        • Size 140KB
        • SHA256 e164d97c2091a821672aa4fe5601c9a59fc41f04caae1b96cb71b71789a53357
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QEA1P7KF\search[4].htm
        • Size 120KB
        • SHA256 de21f7e2422b501b01bd8d5ab4dca487267d5c1f43723c7119f63ed10f0c7d32
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QEA1P7KF\search[7].htm
        • Size 124KB
        • SHA256 34e4f822e90adb22caaa4992485fb51133e3d32cc68316635e7c55d008eac5d2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QEA1P7KF\search[8].htm
        • Size 108KB
        • SHA256 b8a4f92e10a3c39ff55c2aa1b36d93d81ad9ad3214f1cb7314f14e71ffc3f6dc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmp5178.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp5178.tmp
        • Size 40KB
        • SHA256 1bdc2204e890ed9e072aaf5a7511384839ae3c1bee0b2b6b5c332f7b32c1a81c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 2e7c2197b79a07ebec3be498910f52267df8a1a86ca7e44175a43e93facc7a46
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 02245bf91f4956955e308e904b732d923e02eebfcad3bd0674c4a423116cb3f7
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 9564bbdb691f774b76d9310890622eac83ca3adc63d496cd3aec3dbb2e435fde
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 8bd0cbafe394c9839fcb2f129a3153878ac01053bd2c82912c4df5da39b1ca73
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 a6f6f8c3f09f2bf7d4bc29caeff412cc88e94eedaf5d1d9e10ce1603da611486
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 901cf2f71a21cacb6fc449cd77471c6ae66aaa5308f7cf08d51d6fca26e3f0d1
        • MD5 SHA1 SHA512
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/3248-210-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3248-13-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3248-297-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3248-443-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3248-217-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3248-213-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3248-26-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3248-22-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3248-21-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3248-17-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3248-163-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3248-238-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3248-7-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3248-608-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3248-235-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/4292-0-0x0000000000500000-0x000000000050D000-memory.dmp
        Download