54567c7740fc01c72d9bac448a6636b657e77c3e43285608b168a19b14e76d6e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe
Size

40KB
MD5

b062439eae5de871d8f6faf27059a53e
SHA1

c2f30edac33ccc8ef09270a2a4fd75d37bad67f2
SHA256

54567c7740fc01c72d9bac448a6636b657e77c3e43285608b168a19b14e76d6e
SHA512

3b9494cdd73fe93818984d9af0a50823f4e2bfa689254ef66d049526b9c147825c8beac6697b5a9f1543793df588edf10b9ee5154b0f5e8ec0df95ea4ec3e41f
SSDEEP

768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHdE:aqk/Zdic/qjh8w19JDHdE

Score

10^/10

google microsoft persistence phishing product:outlook upx

Malware Config

Signatures

Detected google phishing page
phishing google
Detected microsoft outlook phishing page
phishing microsoft product:outlook

Executes dropped EXE 1 IoCs

pid	Process
2228	services.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000800000002340e-4.dat	upx
behavioral2/memory/2228-6-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2228-13-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2228-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2228-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2228-22-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2228-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2228-125-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2228-256-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2228-259-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2228-263-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2228-278-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2228-281-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2228-296-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2228-398-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2228-401-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\java.exe	b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe
File created	C:\Windows\services.exe	b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe
File opened for modification	C:\Windows\java.exe	b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2228	2088	b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe	83
PID 2088 wrote to memory of 2228	2088	b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe	83
PID 2088 wrote to memory of 2228	2088	b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b062439eae5de871d8f6faf27059a53e_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GU2A83AM\searchERQ8X52Q.htm

Filesize
115KB

MD5
06fb4e42575b9eb014ac71ddacbafbb9

SHA1
0832e336a91abc299270460720b88bfb1e60b7cb

SHA256
d22f0d4d0aee5696fc3a6d83f091f68fc92e9bdcde8a7e9c0ff17255c8e8612a

SHA512
1730e09fa68e8c2b4b3a683c399eb574c89ffc8b580248ddf8f6d4ca249dcf73a4d07597d4fee1a78deff24ee5d0e66a819e374488f74820e9357a24c63e6f7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GU2A83AM\search[4].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GU2A83AM\search[7].htm

Filesize
119KB

MD5
9bd69bdfc6e16b61a1efccff74e3d58b

SHA1
13513033ba6384ce8901b1202fea9bd4c1d14d66

SHA256
a15645715b334ad9513687bd30aac2838e3dbe6b00cfaf08d2508d6a8b310c13

SHA512
f3681d41efcbc2beb8d3aeae3734368e2cab36299c5a0e198cc181ad9714d4a4efb7342315fa29493b803582b405b913399fb1e4d38423bd7a729f150ee05cc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GU2A83AM\search[9].htm

Filesize
157KB

MD5
56895f84a1ec0957c1793c1f4801feb1

SHA1
44fda5bd6f4538463839112a9ce85566ecfc8d9b

SHA256
cd715166e7556b727a41743c15537f1f00919beecbac1c662dd0e4b3eda9bfbe

SHA512
14973dd1dc8edc659aa1ba49d0cc84a63e1dfc2d3071a96dee264c34e780bddb7f90586256159aa11fbf44794de56a2c6033d6f1bb1fabff6cffac4d64017697

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NNUT9QBP\841SM1P8.htm

Filesize
185KB

MD5
61ef1f7fbd9123164f3edfa4255d2da2

SHA1
bf9292b34038a2e9ff5f5c448b2580bd8d56f7e0

SHA256
c7c1f3809ad09b7280c625ca3b45fbf2be88f55524feebe043d9bc31e5c006f7

SHA512
dc1869566d8c51e76149a4dc5f1a5a8ef5adbe0c75638aa5f79e7c302436262b31abc7e80bd7de07b6394291d06d828c4ea9f7f01d7b8b60182811d761c4b263

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NNUT9QBP\results[3].htm

Filesize
1KB

MD5
211da0345fa466aa8dbde830c83c19f8

SHA1
779ece4d54a099274b2814a9780000ba49af1b81

SHA256
aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5

SHA512
37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NNUT9QBP\search[6].htm

Filesize
150KB

MD5
721d41f93e32834a419e6408c5450996

SHA1
6a52951f167318d868554dccb3fe9066354e36fe

SHA256
6bd2e576fc86ae5aff76bce110ffc987b5edc27eb9931acd228aee116a0f1d37

SHA512
38817e47a194cbabc49b6456185a4bba7e1f8a8e1af2e13b0d52dab994cca8ca792fe6e1c73d57d91337709aed1cc3686adf8cbf639f6c640710a9057cd61c81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QL6D63T0\results[3].htm

Filesize
1KB

MD5
ee4aed56584bf64c08683064e422b722

SHA1
45e5ba33f57c6848e84b66e7e856a6b60af6c4a8

SHA256
a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61

SHA512
058f023cb934a00c8f1c689001438c9bdd067d923ddcbe7a951f54d3ca82218803e0e81fbc9af5c56375ff7961deed0359af1ffa7335d41379ee97d01a76ded6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QL6D63T0\search[10].htm

Filesize
138KB

MD5
d6b86afd44324612b513e8201ac83f1a

SHA1
aebb9de705e540faaef1496f4cd68a9caa77ede8

SHA256
7ae2cb87b63eece1b553969b1eb14e86a6395ffc503868f7db8ac96bf8ad6b3c

SHA512
4b7cbd6ce4cec4a61709423a110f9a7c0c482f1ab08736dcf56523fcbe1c4f37d1b9f823a045ccd34307a383d0a2c39e3abb475587474d8c43f58fc2d3c3cc5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUGBEKKF\UYX62YL5.htm

Filesize
185KB

MD5
73c08a115b95198890f575d8371256d8

SHA1
e1a1efb99a0a3cd72d9ac9167ecde434833664bf

SHA256
aee7af560bfa98f583bc028e9eb1ba372598337feb78dd8547072a4d6ba37932

SHA512
53536bf5c892a564d334f3532ce4204763de71b68544980c4c615f416c936f3eca02c90193397f294e6de3c039eea5f8669d87884957e3996208fc4ca9b82250

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUGBEKKF\search[4].htm

Filesize
103KB

MD5
fb42021454f71553b77128adf63cbcc6

SHA1
5c521317e657bf72fc0d0223de4306fd1a7e3dc0

SHA256
f5ea0c5749073e5a76223c4d37efca787d175e67f2ef786d1c60ddf29b9c86e8

SHA512
9994f552a676e0725a59abddc0c6b8093ce4008c0fad722f62235eaae587b09539fb588f5803e7cdace63c2f0a7529a29f07c5e5d8e9e0ee9bfbbcda6659594b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1DF3.tmp

Filesize
40KB

MD5
718f4dec80da3cccb0e1f0bb83d27aff

SHA1
d6d26402f1019e088c40c72e4ad9c134a717287a

SHA256
93e0fac0a682e6c3c2c17122a11041d7e534b8688165fed546b79f38e5ad06ae

SHA512
9ae5f701fea35773c3ffff7044c62c0fd2312ca69ae8ed82c8e29388e8afb34665521a42b85efed65945dcac51c145d44f3a7cf00f8d42dc41537a02ad668fc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
f01802392dce0b5c8682c3bca9dafdb9

SHA1
7ff499c562b512e10a7e73414f6d93f22b9b665f

SHA256
bdc0873a865d4bedb30bd5b853005418c5c312f6d54bb26e67b5fef1b1c00187

SHA512
59cee8dd37e35858149d0219b047ce75bf65bda33dfc79d822125639d2f282fbe872ceb8b892037b9d10e0ad731b4773c68282986de5fec0692ef5d4ce3eb06d

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
78fb8de29e6ca0195c9274d06dd0e2fd

SHA1
acef71da084f778d3aca27c84aa2b46cbe12c254

SHA256
5b705574582a9e3e2c810658d528be29cf78e110c4ef921dcbd193828d16074a

SHA512
5902e93868c83b2948028e3131979b6ba4620ad3947e2b34edd54238c256ee37a7d7678a672590aacc72f229e1438010d3163bc6ba30b8f6dfeb2311efcc390c

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
511e6d697ff7949c57e176bab270c425

SHA1
9dabba394817f003d0c623a512b04f65b7eeeebb

SHA256
efd1747c892aa50e4856ca0a5edba8589e6b2964f7cbc634b56765bd8e08b487

SHA512
3a8b6a93a17128d7c99b4e5998134db4e7473f6198c058973e855ab189166f5941119404590f13e98e22ce06f26fb6b9d9ce0e714042c07c70e84fdf22db25f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
f1f90d9e26ade50373c12f1232a1f854

SHA1
20fd1be3cfe7425b056dff92fc7befd85a13922e

SHA256
9d0cc0df99bf63de4d295bd46992cb1d607ab19afa0f712d1212edcfa1f2cbc7

SHA512
48be7b083b637bd6a11b590af93ffbee97bc7c89ad7bb71010550cc8556ac5596e8f870e93b856b634d3e993f23a609ed4326af8887556c7195496fbe10aa8b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
a26b97377a04c2ae84224f477497da55

SHA1
19266f4fff80d331cb2f8c0117086e24765d4d2f

SHA256
ad4404a9f869b45a20966b83cd513d2c7a5ed8309c25c1a1e4fb94a705ede94c

SHA512
85176a42ca94716064b3a23ea15fb8ffe0f143e34e4b110e037d868740782259b5444e8bc834ff0e7196410b08fa2be2f023ac52ebf97a4c8de0ebe0e633e940

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/2088-0-0x0000000000500000-0x000000000050D000-memory.dmp

Filesize
52KB

Download
memory/2228-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2228-263-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2228-259-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2228-278-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2228-281-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2228-256-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2228-296-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2228-125-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2228-22-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2228-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2228-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2228-13-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2228-398-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2228-401-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2228-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads