78e5b60fc8143cfcbe57afc8557965dac89cc2f92e504ca4759f0d11ef4dc136

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
920f5e9b09dbcce371dac837604eb862_JaffaCakes118.exe
Size 40KB
Sample240603-re689aad25
SHA256 78e5b60fc8143cfcbe57afc8557965dac89cc2f92e504ca4759f0d11ef4dc136
MD5 920f5e9b09dbcce371dac837604eb862
SHA1 8420f604b6782a50f86a6477060822e1f9ebf272
SHA512 7aebfd69797b3bd6538e4639d82b4bf2f4d35a9e70e7c0b5ac455a1f262e4a225c061adc218186208c4a73d059bbb0d30b6057c813d1bf58eae2bcdffe066fc6
SSDEEP 768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHcP:aqk/Zdic/qjh8w19JDHcP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

microsoft persistence phishing product:outlook upx

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook

Executes dropped EXE 1 IoCs

pid	Process
3420	services.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3420-5-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x00090000000233fe-4.dat	upx
behavioral2/memory/3420-13-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3420-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3420-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3420-22-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3420-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3420-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3420-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3420-35-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3420-39-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3420-40-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3420-44-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3420-107-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3420-251-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3420-254-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	920f5e9b09dbcce371dac837604eb862_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	920f5e9b09dbcce371dac837604eb862_JaffaCakes118.exe
File opened for modification	C:\Windows\java.exe	920f5e9b09dbcce371dac837604eb862_JaffaCakes118.exe
File created	C:\Windows\java.exe	920f5e9b09dbcce371dac837604eb862_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 3420	2264	920f5e9b09dbcce371dac837604eb862_JaffaCakes118.exe	83
PID 2264 wrote to memory of 3420	2264	920f5e9b09dbcce371dac837604eb862_JaffaCakes118.exe	83
PID 2264 wrote to memory of 3420	2264	920f5e9b09dbcce371dac837604eb862_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\920f5e9b09dbcce371dac837604eb862_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\920f5e9b09dbcce371dac837604eb862_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

search[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2IX84YPE\search[2].htm
Size 117KB
SHA256 a49716f36ce15d53e5e60dae1f4697f0d7515a8cabb617d3913b06aa657df367
MD5 2af1fab9cbdbaef839b051b09d297d40
SHA1 2587749d743760f5607f0bfb5f638dfb97a389d7
SHA512 22dedbeb47563db43aeebca8d8a31ccac93829aa89214171d00e1c22822640e574250607a2abde820077ea1ab73c7fc65b61a14b1ac0c04d9a75c7b4a1444b4c
SSDEEP 3072:oWIezPXUVn1YQbnUb6MHxto5cQHEC21VeK1L:ohCVr9
MD5 SHA1 SHA512 SSDEEP

Submit Download

NZO1DSCZ.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D5DFSS0T\NZO1DSCZ.htm
Size 176KB
SHA256 ab1c95eaea3052d92509fd6500654f2e22e52c2dcf2f5884ca57540decfe8e7b
MD5 29889d3675b77d5276e993dc3fd82a3c
SHA1 471fbc11d77e0685b82ce5141038ab29edf27ded
SHA512 8e4992257384618c442ac0b868005ff9c23ef65a809dea9d5e63d2584a36e993c557d0eae2280b282c0fb363fa0075e7986caab6d9f0bce2bb421bd746865817
SSDEEP 1536:4j9DsloamI1MGAzVbGAQU7+P1S0kyFK++zG58TJLDPcNeoamI1MGoamI1Mdbe0cU:y9IeGAzVCbS0ZK+QG58TJLKIetIexJT
MD5 SHA1 SHA512 SSDEEP

Submit Download

results[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D5DFSS0T\results[2].htm
Size 1KB
SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
MD5 211da0345fa466aa8dbde830c83c19f8
SHA1 779ece4d54a099274b2814a9780000ba49af1b81
SHA512 37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca
MD5 SHA1 SHA512

Submit Download

search[3].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J2J1W33T\search[3].htm
Size 25B
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
MD5 SHA1 SHA512

Submit Download

tmp5ED3.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp5ED3.tmp
Size 40KB
SHA256 b153e5db94e0be9a525fa8d93c5133c77317b8e1a77d4aae8d93f27086d4ac19
MD5 95fc55086fd2eb426e214635329024ba
SHA1 4fd53eeac0654a8d65e691cda28c3cb85a0ce231
SHA512 b2178270d364a69d4c1cfde2312458117a6a5c3de1d9d4c3e74e6871671fe39fc3d25f8bb4a30415ee848beb5b12f68ab9c0dc53d2a88ce2544ca5e993a4a33f
SSDEEP 768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHrP:aqk/Zdic/qjh8w19JDHrP
MD5 SHA1 SHA512 SSDEEP

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 1KB
SHA256 9bb681adf3354bfb44f3fad3ec9a0e63625905aceed63690c41f3d7ffa7ad471
MD5 7ed8410b4636ec3045ea92d343163977
SHA1 3497fe24e99d3f90f4f6417a5d598bfd03818911
SHA512 e800fdd3f0375d064ecfb38bf907f7953304900f68e7b316088d48f1b6478c1db62a52ff7f486972dc75dfc7a8a1fb39e55377031fc5c2ec996580fb02e85052
MD5 SHA1 SHA512

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 1KB
SHA256 26af4b3e7e7ffa62d73d18241b9f5961c65ac279335a8ea0cb07b1affec017ac
MD5 f63ce504b3aec0c446e433baca053038
SHA1 a351cc93a886423fd03557db80d384c13477fde9
SHA512 e939cc8dfff88b15ae063e8b8dab4e392286316732381665ef153fac6365612cbf32b416c3dadedc3381f3038bae8d43e23e28ca5c38758ce48e9d3075fbfca1
MD5 SHA1 SHA512

Submit Download

services.exe

Path C:\Windows\services.exe
Size 8KB
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
SSDEEP 192:tZWNqWKIzebvOZnzCj6juhEJS3/Uf/tpfmG62X9f3:tZ6qWTYvczfahX/UHtF6e9f3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2264-0-0x0000000000500000-0x000000000050D000-memory.dmp

Download

memory/3420-39-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3420-22-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3420-31-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3420-40-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3420-44-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3420-30-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3420-26-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3420-35-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3420-107-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3420-21-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3420-17-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3420-13-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3420-5-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3420-251-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3420-254-0x0000000000400000-0x0000000000408000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads