Analysis Overview
SHA256
126534bfa7e8271926cb104ab3cc3efd47f04019ed3d5646782ac61682d2dc99
Threat Level: Known bad
The file aefd34f8cf2107c5f7fcf4ec35e8467c_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
Detected microsoft outlook phishing page
Executes dropped EXE
UPX packed file
Adds Run key to start application
Drops file in Windows directory
Unsigned PE
Suspicious use of WriteProcessMemory
MITRE ATT&CK Matrix V13
Analysis: static1
Detonation Overview
Reported
2024-06-15 15:00
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-15 15:00
Reported
2024-06-15 15:02
Platform
win10v2004-20240611-en
Max time kernel
150s
Max time network
152s
Command Line
Signatures
Detected microsoft outlook phishing page
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\services.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" | C:\Users\Admin\AppData\Local\Temp\aefd34f8cf2107c5f7fcf4ec35e8467c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" | C:\Windows\services.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\services.exe | C:\Users\Admin\AppData\Local\Temp\aefd34f8cf2107c5f7fcf4ec35e8467c_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Windows\java.exe | C:\Users\Admin\AppData\Local\Temp\aefd34f8cf2107c5f7fcf4ec35e8467c_JaffaCakes118.exe | N/A |
| File created | C:\Windows\java.exe | C:\Users\Admin\AppData\Local\Temp\aefd34f8cf2107c5f7fcf4ec35e8467c_JaffaCakes118.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1008 wrote to memory of 756 | N/A | C:\Users\Admin\AppData\Local\Temp\aefd34f8cf2107c5f7fcf4ec35e8467c_JaffaCakes118.exe | C:\Windows\services.exe |
| PID 1008 wrote to memory of 756 | N/A | C:\Users\Admin\AppData\Local\Temp\aefd34f8cf2107c5f7fcf4ec35e8467c_JaffaCakes118.exe | C:\Windows\services.exe |
| PID 1008 wrote to memory of 756 | N/A | C:\Users\Admin\AppData\Local\Temp\aefd34f8cf2107c5f7fcf4ec35e8467c_JaffaCakes118.exe | C:\Windows\services.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\aefd34f8cf2107c5f7fcf4ec35e8467c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aefd34f8cf2107c5f7fcf4ec35e8467c_JaffaCakes118.exe"
C:\Windows\services.exe
"C:\Windows\services.exe"
Network
| Country | Destination | Domain | Proto |
| BD | 123.49.14.252:1034 | tcp | |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| NL | 23.62.61.97:443 | www.bing.com | tcp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.61.62.23.in-addr.arpa | udp |
| US | 15.204.119.206:1034 | tcp | |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 142.53.16.96.in-addr.arpa | udp |
| BD | 202.191.120.160:1034 | tcp | |
| BD | 202.191.120.160:1034 | tcp | |
| N/A | 172.16.0.40:1034 | tcp | |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | m-ou.se | udp |
| US | 8.8.8.8:53 | aspmx2.googlemail.com | udp |
| US | 8.8.8.8:53 | acm.org | udp |
| NL | 142.251.9.27:25 | aspmx2.googlemail.com | tcp |
| US | 8.8.8.8:53 | mail.mailroute.net | udp |
| US | 199.89.3.120:25 | mail.mailroute.net | tcp |
| US | 8.8.8.8:53 | cs.stanford.edu | udp |
| US | 8.8.8.8:53 | smtp1.cs.stanford.edu | udp |
| US | 171.64.64.25:25 | smtp1.cs.stanford.edu | tcp |
| US | 8.8.8.8:53 | burtleburtle.net | udp |
| US | 171.64.64.25:25 | smtp1.cs.stanford.edu | tcp |
| US | 8.8.8.8:53 | alumni.caltech.edu | udp |
| US | 8.8.8.8:53 | alumni-caltech-edu.mail.protection.outlook.com | udp |
| US | 8.8.8.8:53 | gzip.org | udp |
| US | 52.101.11.17:25 | alumni-caltech-edu.mail.protection.outlook.com | tcp |
| US | 8.8.8.8:53 | gzip.org | udp |
| US | 85.187.148.2:25 | gzip.org | tcp |
| US | 8.8.8.8:53 | mx.burtleburtle.net | udp |
| US | 65.254.254.50:25 | mx.burtleburtle.net | tcp |
| US | 8.8.8.8:53 | www.google.com | udp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 8.8.8.8:53 | search.lycos.com | udp |
| US | 209.202.254.10:80 | search.lycos.com | tcp |
| US | 8.8.8.8:53 | www.altavista.com | udp |
| IE | 212.82.100.137:80 | www.altavista.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| US | 8.8.8.8:53 | search.yahoo.com | udp |
| IE | 212.82.100.137:443 | search.yahoo.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| US | 8.8.8.8:53 | r11.o.lencr.org | udp |
| BE | 23.14.90.106:80 | r11.o.lencr.org | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 8.8.8.8:53 | 196.187.250.142.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.254.202.209.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 32.25.90.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 137.100.82.212.in-addr.arpa | udp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 209.202.254.10:80 | search.lycos.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 209.202.254.10:80 | search.lycos.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| IE | 212.82.100.137:80 | search.yahoo.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 8.8.8.8:53 | 106.90.14.23.in-addr.arpa | udp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| US | 209.202.254.10:80 | search.lycos.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| IE | 212.82.100.137:80 | search.yahoo.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| IE | 212.82.100.137:80 | search.yahoo.com | tcp |
| IE | 212.82.100.137:443 | search.yahoo.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 209.202.254.10:80 | search.lycos.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 209.202.254.10:80 | search.lycos.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| IE | 212.82.100.137:80 | search.yahoo.com | tcp |
| IE | 212.82.100.137:80 | search.yahoo.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| IE | 212.82.100.137:443 | search.yahoo.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| IE | 212.82.100.137:80 | search.yahoo.com | tcp |
| US | 209.202.254.10:80 | search.lycos.com | tcp |
| IE | 212.82.100.137:80 | search.yahoo.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| IE | 212.82.100.137:443 | search.yahoo.com | tcp |
| IE | 212.82.100.137:443 | search.yahoo.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 209.202.254.10:80 | search.lycos.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| IE | 212.82.100.137:80 | search.yahoo.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 52.101.11.17:25 | alumni-caltech-edu.mail.protection.outlook.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| IM | 81.88.166.9:1034 | tcp | |
| US | 8.8.8.8:53 | aspmx3.googlemail.com | udp |
| US | 8.8.8.8:53 | acm.org | udp |
| FI | 142.250.150.27:25 | aspmx3.googlemail.com | tcp |
| US | 104.17.78.30:25 | acm.org | tcp |
| US | 8.8.8.8:53 | cs.stanford.edu | udp |
| US | 171.64.64.64:25 | cs.stanford.edu | tcp |
| US | 171.64.64.64:25 | cs.stanford.edu | tcp |
| US | 8.8.8.8:53 | alumni.caltech.edu | udp |
| US | 75.2.70.75:25 | alumni.caltech.edu | tcp |
| US | 85.187.148.2:25 | gzip.org | tcp |
| US | 8.8.8.8:53 | burtleburtle.net | udp |
| US | 65.254.227.224:25 | burtleburtle.net | tcp |
| US | 75.2.70.75:25 | alumni.caltech.edu | tcp |
| US | 16.28.192.43:1034 | tcp | |
| US | 8.8.8.8:53 | alt2.aspmx.l.google.com | udp |
| US | 8.8.8.8:53 | mx.acm.org | udp |
| US | 8.8.8.8:53 | mail.acm.org | udp |
| FI | 142.250.150.26:25 | alt2.aspmx.l.google.com | tcp |
| US | 8.8.8.8:53 | smtp.acm.org | udp |
| US | 8.8.8.8:53 | smtp2.cs.stanford.edu | udp |
| US | 171.64.64.26:25 | smtp2.cs.stanford.edu | tcp |
| US | 171.64.64.26:25 | smtp2.cs.stanford.edu | tcp |
| US | 171.64.64.25:25 | smtp1.cs.stanford.edu | tcp |
| US | 8.8.8.8:53 | mx.alumni.caltech.edu | udp |
| US | 8.8.8.8:53 | mail.alumni.caltech.edu | udp |
| US | 8.8.8.8:53 | mx.gzip.org | udp |
| US | 8.8.8.8:53 | mail.gzip.org | udp |
| US | 85.187.148.2:25 | mail.gzip.org | tcp |
| US | 8.8.8.8:53 | outlook.com | udp |
| US | 8.8.8.8:53 | outlook-com.olc.protection.outlook.com | udp |
| HK | 52.101.132.29:25 | outlook-com.olc.protection.outlook.com | tcp |
| US | 65.254.254.50:25 | mx.burtleburtle.net | tcp |
| US | 8.8.8.8:53 | mx.alumni.caltech.edu | udp |
| US | 8.8.8.8:53 | mail.alumni.caltech.edu | udp |
| US | 8.8.8.8:53 | smtp.alumni.caltech.edu | udp |
| US | 8.8.8.8:53 | coloradotech.edu | udp |
| US | 8.8.8.8:53 | mx2.hc3950-10.iphmx.com | udp |
| US | 216.71.147.46:25 | mx2.hc3950-10.iphmx.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| IE | 212.82.100.137:80 | search.yahoo.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 209.202.254.10:80 | search.lycos.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 209.202.254.10:80 | search.lycos.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| IE | 212.82.100.137:80 | search.yahoo.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 209.202.254.10:80 | search.lycos.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| IE | 212.82.100.137:80 | search.yahoo.com | tcp |
| IE | 212.82.100.137:443 | search.yahoo.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| US | 209.202.254.10:80 | search.lycos.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 209.202.254.10:80 | search.lycos.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| GB | 142.250.187.196:80 | www.google.com | tcp |
| US | 209.202.254.10:443 | search.lycos.com | tcp |
| US | 16.129.12.93:1034 | tcp | |
| US | 8.8.8.8:53 | 18.173.189.20.in-addr.arpa | udp |
Files
memory/1008-0-0x0000000000500000-0x000000000050D000-memory.dmp
C:\Windows\services.exe
| MD5 | b0fe74719b1b647e2056641931907f4a |
| SHA1 | e858c206d2d1542a79936cb00d85da853bfc95e2 |
| SHA256 | bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c |
| SHA512 | 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2 |
memory/756-6-0x0000000000400000-0x0000000000408000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\zincite.log
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
memory/756-13-0x0000000000400000-0x0000000000408000-memory.dmp
memory/756-17-0x0000000000400000-0x0000000000408000-memory.dmp
memory/756-21-0x0000000000400000-0x0000000000408000-memory.dmp
memory/756-22-0x0000000000400000-0x0000000000408000-memory.dmp
memory/756-26-0x0000000000400000-0x0000000000408000-memory.dmp
memory/756-30-0x0000000000400000-0x0000000000408000-memory.dmp
memory/756-31-0x0000000000400000-0x0000000000408000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\m0pglyfoDp.log
| MD5 | c77ca48e6125c0e8bba2e81e9f9ae4c4 |
| SHA1 | 66c8cf168cde7961a3c3180f3c047277597194d0 |
| SHA256 | 546c8204c3469bad17787721e3117bd5658bee16a5dd7546179e1b0c3702ba82 |
| SHA512 | cbc6ce5360369fd17284646fa73797e071b700ff4e11bb83023c4afcf5219c6e5be59fddf15f4e54ecded32085890cae72dc7e5ac1d971e1da90d0a1edc60da8 |
memory/756-35-0x0000000000400000-0x0000000000408000-memory.dmp
memory/756-39-0x0000000000400000-0x0000000000408000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\zincite.log
| MD5 | 2463269f21e9714a15c6478b05b80cb0 |
| SHA1 | ef9712e7b1e28c8ed690bb8a95d5c3771416dcda |
| SHA256 | 676e746faa3dd9332a4acc2f64f7b6d2bcc9c09a647d55618702d46daf48ca61 |
| SHA512 | e688a5f4e49c7e5d43f92cbfb7f5bd638457584c27c699c7ed27e425bffae8501e2da5c553a962a8c131a1ab93338cb5671b9b85357a830cccb93dce3a395482 |
C:\Users\Admin\AppData\Local\Temp\tmpA5D2.tmp
| MD5 | aa4de7001df04077777f25710c76a023 |
| SHA1 | 156dfd67cf211d7d1459b01b51d73591736c5ff5 |
| SHA256 | 7e1a955ad60e3c59fad684e4f76dac37e4f590f1641d3e9e26e8c4b108655195 |
| SHA512 | dcea3eff0ce1babcb19084ec2e902e9b36136ad9a78240897afd06f86970e072b8d76373b717206e1aced7aea94da8f30bf0ddecc7804f57396326ff76045c19 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GU2A83AM\Z7078H6I.htm
| MD5 | 5803d597265b408f61f739360bbf67b0 |
| SHA1 | 0eae069e466ce587ce7b296df24454f5ed43a389 |
| SHA256 | 941aabba4761bf1a1e6483f1bd638c0c074195c263ccbdefe5e9c90483c145ee |
| SHA512 | 4070c8c1be676380e37551a8f704c8285eb9f433dac73bd5faa69acb1d654d98efea48990b835a07d45508f66c4c866338e3c81bddb05e17d93d0a81d2ad92d2 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUGBEKKF\search[2].htm
| MD5 | 8ba61a16b71609a08bfa35bc213fce49 |
| SHA1 | 8374dddcc6b2ede14b0ea00a5870a11b57ced33f |
| SHA256 | 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1 |
| SHA512 | 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GU2A83AM\results[2].htm
| MD5 | 35a826c9d92a048812533924ecc2d036 |
| SHA1 | cc2d0c7849ea5f36532958d31a823e95de787d93 |
| SHA256 | 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea |
| SHA512 | fd385904a466768357de812d0474e34a0b5f089f1de1e46bd032d889b28f10db84c869f5e81a0e2f1c8ffdd8a110e0736a7d63c887d76de6f0a5fd30bb8ebecd |
memory/756-172-0x0000000000400000-0x0000000000408000-memory.dmp
memory/756-202-0x0000000000400000-0x0000000000408000-memory.dmp
memory/756-206-0x0000000000400000-0x0000000000408000-memory.dmp
memory/756-207-0x0000000000400000-0x0000000000408000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\zincite.log
| MD5 | 826212ed3da5c247c2d416c7f8bb4a9c |
| SHA1 | 17ec02caafcc6d4a8e0fa9a32c6c7767346ac895 |
| SHA256 | 90cf54e7bb52cd1883bf3859c24e94bf538997c70cf94ea8adacc633033ad8b1 |
| SHA512 | 33bc7450d672248fcc57cb53728aa2aae474264a7bfc213d828129b47b78cf951bf0ee2f8a420bbfe0d6bdd3573afd18745c9ccf8c63e1c800e35e6754e52634 |
memory/756-231-0x0000000000400000-0x0000000000408000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GU2A83AM\search[5].htm
| MD5 | 04f83ca82ab824872ff55ad013ddfc53 |
| SHA1 | cfa52c88883eca4b2b68e257f48f1b033b892e78 |
| SHA256 | 957ccb45be6cf9f228100662491a35160552adfb7ffc9e1373aa46ce149e7f28 |
| SHA512 | 5a067630853e6e4b1df8037ea6142d2d9f3240706ec5b96c7e8be804f6a018005f618492a68dfa24077a3da9d036a3f4928c9ce45049d363ea7dd86bc2a25006 |
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-15 15:00
Reported
2024-06-15 15:02
Platform
win7-20240508-en
Max time kernel
150s
Max time network
149s
Command Line
Signatures
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\services.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" | C:\Users\Admin\AppData\Local\Temp\aefd34f8cf2107c5f7fcf4ec35e8467c_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" | C:\Windows\services.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\java.exe | C:\Users\Admin\AppData\Local\Temp\aefd34f8cf2107c5f7fcf4ec35e8467c_JaffaCakes118.exe | N/A |
| File created | C:\Windows\java.exe | C:\Users\Admin\AppData\Local\Temp\aefd34f8cf2107c5f7fcf4ec35e8467c_JaffaCakes118.exe | N/A |
| File created | C:\Windows\services.exe | C:\Users\Admin\AppData\Local\Temp\aefd34f8cf2107c5f7fcf4ec35e8467c_JaffaCakes118.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2968 wrote to memory of 3004 | N/A | C:\Users\Admin\AppData\Local\Temp\aefd34f8cf2107c5f7fcf4ec35e8467c_JaffaCakes118.exe | C:\Windows\services.exe |
| PID 2968 wrote to memory of 3004 | N/A | C:\Users\Admin\AppData\Local\Temp\aefd34f8cf2107c5f7fcf4ec35e8467c_JaffaCakes118.exe | C:\Windows\services.exe |
| PID 2968 wrote to memory of 3004 | N/A | C:\Users\Admin\AppData\Local\Temp\aefd34f8cf2107c5f7fcf4ec35e8467c_JaffaCakes118.exe | C:\Windows\services.exe |
| PID 2968 wrote to memory of 3004 | N/A | C:\Users\Admin\AppData\Local\Temp\aefd34f8cf2107c5f7fcf4ec35e8467c_JaffaCakes118.exe | C:\Windows\services.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\aefd34f8cf2107c5f7fcf4ec35e8467c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aefd34f8cf2107c5f7fcf4ec35e8467c_JaffaCakes118.exe"
C:\Windows\services.exe
"C:\Windows\services.exe"
Network
| Country | Destination | Domain | Proto |
| BD | 123.49.14.252:1034 | tcp | |
| US | 15.204.119.206:1034 | tcp | |
| BD | 202.191.120.160:1034 | tcp | |
| BD | 202.191.120.160:1034 | tcp | |
| N/A | 172.16.0.40:1034 | tcp | |
| US | 8.8.8.8:53 | alumni.caltech.edu | udp |
| US | 8.8.8.8:53 | gzip.org | udp |
| US | 8.8.8.8:53 | alumni.caltech.edu | udp |
| US | 8.8.8.8:53 | gzip.org | udp |
| IM | 81.88.166.9:1034 | tcp | |
| US | 8.8.8.8:53 | alumni.caltech.edu | udp |
| US | 8.8.8.8:53 | gzip.org | udp |
| US | 16.28.192.43:1034 | tcp | |
| US | 8.8.8.8:53 | gzip.org | udp |
| US | 16.129.12.93:1034 | tcp | |
| US | 8.8.8.8:53 | udp |
Files
memory/2968-0-0x0000000000500000-0x000000000050D000-memory.dmp
memory/2968-4-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3004-11-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2968-10-0x0000000000400000-0x0000000000408000-memory.dmp
C:\Windows\services.exe
| MD5 | b0fe74719b1b647e2056641931907f4a |
| SHA1 | e858c206d2d1542a79936cb00d85da853bfc95e2 |
| SHA256 | bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c |
| SHA512 | 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2 |
C:\Users\Admin\AppData\Local\Temp\zincite.log
| MD5 | d41d8cd98f00b204e9800998ecf8427e |
| SHA1 | da39a3ee5e6b4b0d3255bfef95601890afd80709 |
| SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 |
| SHA512 | cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e |
memory/3004-17-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3004-21-0x0000000000400000-0x0000000000408000-memory.dmp
memory/2968-22-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3004-26-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3004-27-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3004-31-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3004-35-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3004-36-0x0000000000400000-0x0000000000408000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\atbdeE.log
| MD5 | a5a510275b9c82f4cb32fb3bc0599f9b |
| SHA1 | a7b7130fc72203e81ba621d6573a0451a6e8149d |
| SHA256 | 85c4aceea0522f324152d69a6c0dbf4a7b72bbf1656b3096c2a6eb0fd96e87bb |
| SHA512 | e698fa529d1d0a9d9b17f287c71bc364ec23638f315fe62a51d1ce5ca516b3147d5997edde36dac16cd2025121661555d27766f716c62f0f5b5abee944714c7a |
memory/3004-40-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3004-44-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3004-45-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3004-49-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3004-53-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3004-54-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3004-58-0x0000000000400000-0x0000000000408000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\zincite.log
| MD5 | d6d29a7ff17c3230bb3830b7aa8f5d17 |
| SHA1 | f3148698084698ddc9aca09f7174e499865a77dd |
| SHA256 | 21cea4280a6bc7ee6a4eea27a0827859e72d7e6fd550823f4377d18f4b9c67ea |
| SHA512 | 04bf0ccf2517c54a865462b8f6183d3ded0a7171b9999a1f911d661797d8e80bc7ed9136eff40deb9d40385bb0701933cacc613c2573fd9fb6404801593d3196 |