7e3d0cfc913146ee59b7331f394987a0716bc49140e140ae55fd49a33de41619

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 07:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad5c08bf21fb3a5a53ccce330efdfc04_JaffaCakes118.exe
Size

40KB
MD5

ad5c08bf21fb3a5a53ccce330efdfc04
SHA1

40956e24dc1602d88999c8e77c84074dca922dd5
SHA256

7e3d0cfc913146ee59b7331f394987a0716bc49140e140ae55fd49a33de41619
SHA512

ae34cda701737f8c70d09a67f5763fb44c10ce08031fbe0a54f175183e6cac4d2b1b657c1e9ca9f9bcde9e2b69978c363f24ec0de8720b1c9cea3e16b870b0b3
SSDEEP

768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHG:aqk/Zdic/qjh8w19JDHG

Score

10^/10

google microsoft persistence phishing product:outlook upx

Malware Config

Signatures

Detected google phishing page
phishing google
Detected microsoft outlook phishing page
phishing microsoft product:outlook
Executes dropped EXE 1 IoCs

Processes:

services.exe

pid process

4316 services.exe

pid	process
4316	services.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\services.exe	upx
behavioral2/memory/4316-6-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4316-13-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4316-17-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4316-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4316-22-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4316-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4316-30-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4316-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4316-266-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4316-424-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4316-425-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4316-429-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4316-499-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4316-521-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4316-534-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ad5c08bf21fb3a5a53ccce330efdfc04_JaffaCakes118.exeservices.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	ad5c08bf21fb3a5a53ccce330efdfc04_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

Processes:

ad5c08bf21fb3a5a53ccce330efdfc04_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\java.exe	ad5c08bf21fb3a5a53ccce330efdfc04_JaffaCakes118.exe
File created	C:\Windows\services.exe	ad5c08bf21fb3a5a53ccce330efdfc04_JaffaCakes118.exe
File opened for modification	C:\Windows\java.exe	ad5c08bf21fb3a5a53ccce330efdfc04_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ad5c08bf21fb3a5a53ccce330efdfc04_JaffaCakes118.exe

description	pid	process	target process
PID 3164 wrote to memory of 4316	3164	ad5c08bf21fb3a5a53ccce330efdfc04_JaffaCakes118.exe	services.exe
PID 3164 wrote to memory of 4316	3164	ad5c08bf21fb3a5a53ccce330efdfc04_JaffaCakes118.exe	services.exe
PID 3164 wrote to memory of 4316	3164	ad5c08bf21fb3a5a53ccce330efdfc04_JaffaCakes118.exe	services.exe

C:\Users\Admin\AppData\Local\Temp\ad5c08bf21fb3a5a53ccce330efdfc04_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ad5c08bf21fb3a5a53ccce330efdfc04_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3164

C:\Windows\services.exe
"C:\Windows\services.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4316

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3NQFXGDW\results[2].htm
Filesize
1KB

MD5
ee4aed56584bf64c08683064e422b722

SHA1
45e5ba33f57c6848e84b66e7e856a6b60af6c4a8

SHA256
a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61

SHA512
058f023cb934a00c8f1c689001438c9bdd067d923ddcbe7a951f54d3ca82218803e0e81fbc9af5c56375ff7961deed0359af1ffa7335d41379ee97d01a76ded6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3NQFXGDW\results[4].htm
Filesize
1KB

MD5
211da0345fa466aa8dbde830c83c19f8

SHA1
779ece4d54a099274b2814a9780000ba49af1b81

SHA256
aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5

SHA512
37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3NQFXGDW\search[10].htm
Filesize
127KB

MD5
06ae5e7d589bd39f7c68ba7bf0dc9324

SHA1
f48489af8792dc8cf47f987401954562eb094dd5

SHA256
8f612930cafd0324a3ac0cf3c753435e4d47c5e42bd3f930fc78fb33c97e102c

SHA512
4677e5044d56cc24d2b32430708c0fb9fa40c1073f63e0f7d082b7e0e1ad02176ee248ccad703e00d13c7a5c3da8297f0c39bb5ca36e5e377c6aea801fd1d656

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EROQDKB0\SLDRPM2N.htm
Filesize
185KB

MD5
e245ca8cee9716ab82c924a2bfdc6ec9

SHA1
f5201631465871731003a641bc312f294082c9fa

SHA256
b35a0707ec7897772afce805dc2d982a0267a479de22d6ce25cd6a51b28aba1b

SHA512
145a3768190de5c3e06eb400a40b223c9908b34e5b0ad78029cb0235f79b30be9301400c8680eafbb1da0e2ed607387ec9a1b4671955a599bd223b1a6f82f4a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EROQDKB0\search[2].htm
Filesize
163KB

MD5
02d0c05f7673b212c1e8e41233f32034

SHA1
2160dd0b4dbef14ac6ed848ea6fb4de7ed549e7c

SHA256
f9fea4c1ce877b4473833931b60e3295968c942d187702b7e1bee0133c8f8468

SHA512
d85f6fbb5bd32ae06ed80fe042ef341c027e7a2908ad17ef9b5657b5132b733221621b4703b6a8bfd642e72f0431d78591e84fa58d3c24b38f2de0991e3c73c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EROQDKB0\search[9].htm
Filesize
157KB

MD5
7dfed04f0f93881b296fb8aefc897a6d

SHA1
9a0ace15969a514ad41fe1590f00b146d7cfd348

SHA256
6aae4f7c18b04bb4c1782d1680a9da31e3eca290e013a59ef3c4ca19eb14e236

SHA512
164cf41d4828ae5fda8b73cf5030c9aaaeceb46f97a4d1a33a48528c8d612b50b4a5d8f1fa90ed5d55cf10fcafe8d55febe0e447c10d684ed1a4d0349b6d18ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RYAG7OSV\search[2].htm
Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RYAG7OSV\search[5].htm
Filesize
112KB

MD5
108f80791fa35e500ded9277359bedce

SHA1
ea0f0536e945d5915322c336a3a729ffd42de890

SHA256
7251a3dc5adcdf463d686ef005ae0717ef71d25286b60123d525005a8ef354d2

SHA512
28f05d8c518969c2d3f6175a6f9a010a858a0eee6ab3d992688596678c849702acbff524b9804b2548f723c40b2d15edb887d0aa1e281381ae1c335b28bd5339

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp6193.tmp
Filesize
40KB

MD5
40e1092c6f15dee4674a39edfd2a57dc

SHA1
5711e3dd3ba9b283343a287a07478e08b787aa81

SHA256
825cfcbd59d3dfa44a43fa921e86497d6cf65fa98655f4c7100a717975aabb07

SHA512
e076bd1f1303594c8bb6730db8b72122584678809cd58890ba9c5d6741468773a6f2e1376c480d0449fed9d68d213e6f9ee4d3284b6c198bc0b7d851c1c69398

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
1KB

MD5
f290755bdd3676181f710de251db4dc7

SHA1
f9606815e5141c32fd6c27ccb3157211a68ba3cd

SHA256
23a622286aecd6b1c1eb43dcd28dfd3ad109290c20e3704db50e5460646eacf5

SHA512
d25ecc2ff5b4f1f4f306d0f2ed443e059d50d3ae58f78997bc4a5cc007846ffeb276fc41bbd5ce324fcb71e4a3e8550617e988e37e4888c04a51ef6c071b158c

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
1KB

MD5
0f6489665bc4c33ddf71565ec8aa0710

SHA1
4da189fa4467d7dce072ffc754fd8e3292b69396

SHA256
6d6721e5945a0444099e03f1b014bf039a6d803b974d26d16d9d5cd9dce5fe1f

SHA512
bfd079f1a6e93675b55c43bb9569683429ad480c48383f5413af3b1ceef6ec5d1e4e15d9a565140c46c5c3d2d435045ced8eae30a46175e2b9a4af3a5f098200

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
Filesize
1KB

MD5
53bca511acc798f6a1183775f31cca82

SHA1
ecaeac7e28b4d290f949981aac00826433d3d1e3

SHA256
8fd4ab90c5bfd58e11b02aa9d6738b314cd5e26532edaa1ba94f5316db32cdaa

SHA512
4523864788bfca643e6a7c9bb46ae8c4810b5d0157ac398e66b00c517c1853b0f20d463663e58612c2c32c9a03362059f2ff1a8aa8bd74a61804cb0a26275ddf

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Windows\services.exe
Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/3164-0-0x0000000000500000-0x000000000050D000-memory.dmp

Filesize
52KB

Download
memory/4316-22-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4316-266-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4316-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4316-30-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4316-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4316-424-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4316-425-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4316-429-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4316-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4316-17-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4316-499-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4316-13-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4316-521-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4316-6-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4316-534-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download