Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-06-2024 17:28

General

  • Target

    bd1f699ebdbed1859fa33109edf795de_JaffaCakes118.exe

  • Size

    40KB

  • MD5

    bd1f699ebdbed1859fa33109edf795de

  • SHA1

    17229d64d1d2b92e61fe1cee5eed9c53575a5d8c

  • SHA256

    e13d5cbf259d93cc4de2fb782a95f8a429dbec1cb166b3bc60389035c5d0da58

  • SHA512

    e9b77be48b53b3767d3cbf66b0040a505689407297fb98c76269375ce1bbce5274c8c742666f7abec240e315e570eee419c033f038215044eaccea67a76d3c2f

  • SSDEEP

    768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtH9:aqk/Zdic/qjh8w19JDH9

Malware Config

Signatures

  • Detected microsoft outlook phishing page
  • Executes dropped EXE 1 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd1f699ebdbed1859fa33109edf795de_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bd1f699ebdbed1859fa33109edf795de_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1580
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:1624

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\searchQH0CFTMH.htm
    Filesize

    147KB

    MD5

    f1003b67df3d442735e1807584db08e7

    SHA1

    13d46aeea22a37c142d32c2e07bf5d629b1e7a06

    SHA256

    ab6a6a9f765218e788624907c005731546c4f40f3f4eb394dd8b41295378a4ec

    SHA512

    f5ad989ae7d7900c20c0143276c93133b8cac0d0c6d02f093c11fbb314700bed2763aa8523db80168c59becf950f931754bb8049a426bbe6fdd9b7945778d34d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\OUE413E6.htm
    Filesize

    175KB

    MD5

    2bc7055271b342963876f6b5f88dffbf

    SHA1

    a6f10b19d172069d278317641f9c72c111bcd074

    SHA256

    dcbb8eef109e6963c0073f91d926f733c3632c0f13e2d1a86ba90d65e5e5a6b3

    SHA512

    8ae0b15c7dee62674a2ae09b36bf466f2227552572d55a68a1128175679e8b6d2d39ca86e0f85e3766db5f15d55c9bde9de23204567e1740e9e910e0aaba176e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\results[3].htm
    Filesize

    1KB

    MD5

    211da0345fa466aa8dbde830c83c19f8

    SHA1

    779ece4d54a099274b2814a9780000ba49af1b81

    SHA256

    aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5

    SHA512

    37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\search[10].htm
    Filesize

    138KB

    MD5

    89d23a784caea380c1b7fd86866ffd11

    SHA1

    18a24dd68381c659a481476a09d8f313050fcad5

    SHA256

    5aa64151d7039efbc03c9fcce7be5198cac9a377a043ca3ef903465fcc6db7ab

    SHA512

    1516b386744dfe7ea6325c149e15dc89dedeedbd22f7e27a48d4a3d7c5d50d9047911740c47617b34537b88739a04a8f01499279d859999b7a222a30acacac21

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LU15KQ7Y\search5QG7DC39.htm
    Filesize

    164KB

    MD5

    9548d05d7a6e1d180877b041fa0d958a

    SHA1

    8e3a373c69aeb61a02c1fc7ed36240dd32807d20

    SHA256

    15d8b0b9caa3c1e88fb8456473e88a3e9c087c36cf1bc8238db7b88d95208c1f

    SHA512

    1179a04497e7a47b23122f46fea6e9f75c25e1e8755b799018b91125f783d0bec0205aec5904cb5650981b9b70c2da0f4aebf27ba9c4b893e8ca7b0e30aba3ed

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LU15KQ7Y\search[3].htm
    Filesize

    25B

    MD5

    8ba61a16b71609a08bfa35bc213fce49

    SHA1

    8374dddcc6b2ede14b0ea00a5870a11b57ced33f

    SHA256

    6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

    SHA512

    5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V54QW64X\results[3].htm
    Filesize

    1KB

    MD5

    ee4aed56584bf64c08683064e422b722

    SHA1

    45e5ba33f57c6848e84b66e7e856a6b60af6c4a8

    SHA256

    a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61

    SHA512

    058f023cb934a00c8f1c689001438c9bdd067d923ddcbe7a951f54d3ca82218803e0e81fbc9af5c56375ff7961deed0359af1ffa7335d41379ee97d01a76ded6

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V54QW64X\search[2].htm
    Filesize

    160KB

    MD5

    441d06436c1da57863fde2f5e498dc82

    SHA1

    256bb7d6e91afd0dab17dad89e509675be4f55d7

    SHA256

    b114a57fcecb270c036c7f305391b7af62574a50a7be4f3c6ab75d27e31a31f2

    SHA512

    2575cd1e5e6bb1d0d0e0dd1b5ed093e29c7fdedf687185ffc4aed3d884ba47c234fa885a401fd16b4305fee355c623ba055b8a0435ca6b34761f2b32db8a3e4a

  • C:\Users\Admin\AppData\Local\Temp\tmpDFA0.tmp
    Filesize

    40KB

    MD5

    a2db3b725d31d239a3916c663d3dd6f3

    SHA1

    2a709f51aac2da2399b823d7c292fb0934707f5f

    SHA256

    d95ac033adbea43f35118412997c2326f59d2b54b4936054925c741ea71896c9

    SHA512

    4677ce85f3bdb5edf9b7a87bfa8fcf5aab6e1ba78c99a4a109a3f182cd1d6aabcda6dc4b316b4eca4426e0856a302bd78c5e84101f71bf56ce29a518afc3a5b2

  • C:\Users\Admin\AppData\Local\Temp\zincite.log
    Filesize

    1KB

    MD5

    1d38b9a71e39573a64deac0d1090aa54

    SHA1

    592280e4501283ea76c9f185336e0c1d6c74071d

    SHA256

    9fa70df3266b2ca9f009c11a67eee20107b1568c7859aa57911e99f13e5e06e8

    SHA512

    2936f18213d5cc151e973054765c9497af80044e99114dd81c0ac98df9835a98b8514f6684bbba2677709441c1cc3e8b61c33ff44ea374d6d8f68a06461c8250

  • C:\Users\Admin\AppData\Local\Temp\zincite.log
    Filesize

    1KB

    MD5

    f1a5639cd23922d789fdfdb4acf5d2f1

    SHA1

    49219567e5292fc7930852e3d0918c2e43642865

    SHA256

    171850338da2847008303a8d04e5c914da4f41aa0cb3f53048a2a707d3465e46

    SHA512

    a106aac1532d6af1f4443d17f6478d7777331039d3707f18e76eca0e23aefb76905bc07af5b8358a8d5cb63944a7c6d34dbb0c84f1f614bd037fb177e77f5ee8

  • C:\Users\Admin\AppData\Local\Temp\zincite.log
    Filesize

    1KB

    MD5

    89a13552d5e51c5e2de3b8a945a14ccc

    SHA1

    b6d7ecfb2fef5c92d8c54e8d02a22d77e1e49387

    SHA256

    01fb7726376a24c3df004b34680ce15eb24c75a812c0bc2923f570968d04276f

    SHA512

    41cb1eecd0b7f0974d681f63762cd8f8de60fc2b6b073ba332f2a64944e075a9b53f8c3566b4b01e414f3bd0ed0501dc0c1479b4bc21232b155c767a6cec1b6a

  • C:\Users\Admin\AppData\Local\Temp\zincite.log
    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • C:\Windows\services.exe
    Filesize

    8KB

    MD5

    b0fe74719b1b647e2056641931907f4a

    SHA1

    e858c206d2d1542a79936cb00d85da853bfc95e2

    SHA256

    bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

    SHA512

    9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

  • memory/1580-0-0x0000000000500000-0x000000000050D000-memory.dmp
    Filesize

    52KB

  • memory/1624-243-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/1624-297-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/1624-22-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/1624-21-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/1624-30-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/1624-106-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/1624-17-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/1624-26-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/1624-298-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/1624-302-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/1624-39-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/1624-13-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/1624-35-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/1624-6-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB

  • memory/1624-31-0x0000000000400000-0x0000000000408000-memory.dmp
    Filesize

    32KB