Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
18-06-2024 17:28
Static task
static1
Behavioral task
behavioral1
Sample
bd1f699ebdbed1859fa33109edf795de_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
bd1f699ebdbed1859fa33109edf795de_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
bd1f699ebdbed1859fa33109edf795de_JaffaCakes118.exe
-
Size
40KB
-
MD5
bd1f699ebdbed1859fa33109edf795de
-
SHA1
17229d64d1d2b92e61fe1cee5eed9c53575a5d8c
-
SHA256
e13d5cbf259d93cc4de2fb782a95f8a429dbec1cb166b3bc60389035c5d0da58
-
SHA512
e9b77be48b53b3767d3cbf66b0040a505689407297fb98c76269375ce1bbce5274c8c742666f7abec240e315e570eee419c033f038215044eaccea67a76d3c2f
-
SSDEEP
768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtH9:aqk/Zdic/qjh8w19JDH9
Malware Config
Signatures
-
Detected microsoft outlook phishing page
-
Executes dropped EXE 1 IoCs
Processes:
services.exepid process 1624 services.exe -
Processes:
resource yara_rule C:\Windows\services.exe upx behavioral2/memory/1624-6-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1624-13-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1624-17-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1624-21-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1624-22-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1624-26-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1624-30-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1624-31-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1624-35-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1624-39-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1624-106-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1624-243-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1624-297-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1624-298-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/1624-302-0x0000000000400000-0x0000000000408000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
bd1f699ebdbed1859fa33109edf795de_JaffaCakes118.exeservices.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" bd1f699ebdbed1859fa33109edf795de_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" services.exe -
Drops file in Windows directory 3 IoCs
Processes:
bd1f699ebdbed1859fa33109edf795de_JaffaCakes118.exedescription ioc process File created C:\Windows\services.exe bd1f699ebdbed1859fa33109edf795de_JaffaCakes118.exe File opened for modification C:\Windows\java.exe bd1f699ebdbed1859fa33109edf795de_JaffaCakes118.exe File created C:\Windows\java.exe bd1f699ebdbed1859fa33109edf795de_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
bd1f699ebdbed1859fa33109edf795de_JaffaCakes118.exedescription pid process target process PID 1580 wrote to memory of 1624 1580 bd1f699ebdbed1859fa33109edf795de_JaffaCakes118.exe services.exe PID 1580 wrote to memory of 1624 1580 bd1f699ebdbed1859fa33109edf795de_JaffaCakes118.exe services.exe PID 1580 wrote to memory of 1624 1580 bd1f699ebdbed1859fa33109edf795de_JaffaCakes118.exe services.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd1f699ebdbed1859fa33109edf795de_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bd1f699ebdbed1859fa33109edf795de_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4NMOWK91\searchQH0CFTMH.htmFilesize
147KB
MD5f1003b67df3d442735e1807584db08e7
SHA113d46aeea22a37c142d32c2e07bf5d629b1e7a06
SHA256ab6a6a9f765218e788624907c005731546c4f40f3f4eb394dd8b41295378a4ec
SHA512f5ad989ae7d7900c20c0143276c93133b8cac0d0c6d02f093c11fbb314700bed2763aa8523db80168c59becf950f931754bb8049a426bbe6fdd9b7945778d34d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\OUE413E6.htmFilesize
175KB
MD52bc7055271b342963876f6b5f88dffbf
SHA1a6f10b19d172069d278317641f9c72c111bcd074
SHA256dcbb8eef109e6963c0073f91d926f733c3632c0f13e2d1a86ba90d65e5e5a6b3
SHA5128ae0b15c7dee62674a2ae09b36bf466f2227552572d55a68a1128175679e8b6d2d39ca86e0f85e3766db5f15d55c9bde9de23204567e1740e9e910e0aaba176e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\results[3].htmFilesize
1KB
MD5211da0345fa466aa8dbde830c83c19f8
SHA1779ece4d54a099274b2814a9780000ba49af1b81
SHA256aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
SHA51237fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AKM56LDW\search[10].htmFilesize
138KB
MD589d23a784caea380c1b7fd86866ffd11
SHA118a24dd68381c659a481476a09d8f313050fcad5
SHA2565aa64151d7039efbc03c9fcce7be5198cac9a377a043ca3ef903465fcc6db7ab
SHA5121516b386744dfe7ea6325c149e15dc89dedeedbd22f7e27a48d4a3d7c5d50d9047911740c47617b34537b88739a04a8f01499279d859999b7a222a30acacac21
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LU15KQ7Y\search5QG7DC39.htmFilesize
164KB
MD59548d05d7a6e1d180877b041fa0d958a
SHA18e3a373c69aeb61a02c1fc7ed36240dd32807d20
SHA25615d8b0b9caa3c1e88fb8456473e88a3e9c087c36cf1bc8238db7b88d95208c1f
SHA5121179a04497e7a47b23122f46fea6e9f75c25e1e8755b799018b91125f783d0bec0205aec5904cb5650981b9b70c2da0f4aebf27ba9c4b893e8ca7b0e30aba3ed
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LU15KQ7Y\search[3].htmFilesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V54QW64X\results[3].htmFilesize
1KB
MD5ee4aed56584bf64c08683064e422b722
SHA145e5ba33f57c6848e84b66e7e856a6b60af6c4a8
SHA256a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
SHA512058f023cb934a00c8f1c689001438c9bdd067d923ddcbe7a951f54d3ca82218803e0e81fbc9af5c56375ff7961deed0359af1ffa7335d41379ee97d01a76ded6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V54QW64X\search[2].htmFilesize
160KB
MD5441d06436c1da57863fde2f5e498dc82
SHA1256bb7d6e91afd0dab17dad89e509675be4f55d7
SHA256b114a57fcecb270c036c7f305391b7af62574a50a7be4f3c6ab75d27e31a31f2
SHA5122575cd1e5e6bb1d0d0e0dd1b5ed093e29c7fdedf687185ffc4aed3d884ba47c234fa885a401fd16b4305fee355c623ba055b8a0435ca6b34761f2b32db8a3e4a
-
C:\Users\Admin\AppData\Local\Temp\tmpDFA0.tmpFilesize
40KB
MD5a2db3b725d31d239a3916c663d3dd6f3
SHA12a709f51aac2da2399b823d7c292fb0934707f5f
SHA256d95ac033adbea43f35118412997c2326f59d2b54b4936054925c741ea71896c9
SHA5124677ce85f3bdb5edf9b7a87bfa8fcf5aab6e1ba78c99a4a109a3f182cd1d6aabcda6dc4b316b4eca4426e0856a302bd78c5e84101f71bf56ce29a518afc3a5b2
-
C:\Users\Admin\AppData\Local\Temp\zincite.logFilesize
1KB
MD51d38b9a71e39573a64deac0d1090aa54
SHA1592280e4501283ea76c9f185336e0c1d6c74071d
SHA2569fa70df3266b2ca9f009c11a67eee20107b1568c7859aa57911e99f13e5e06e8
SHA5122936f18213d5cc151e973054765c9497af80044e99114dd81c0ac98df9835a98b8514f6684bbba2677709441c1cc3e8b61c33ff44ea374d6d8f68a06461c8250
-
C:\Users\Admin\AppData\Local\Temp\zincite.logFilesize
1KB
MD5f1a5639cd23922d789fdfdb4acf5d2f1
SHA149219567e5292fc7930852e3d0918c2e43642865
SHA256171850338da2847008303a8d04e5c914da4f41aa0cb3f53048a2a707d3465e46
SHA512a106aac1532d6af1f4443d17f6478d7777331039d3707f18e76eca0e23aefb76905bc07af5b8358a8d5cb63944a7c6d34dbb0c84f1f614bd037fb177e77f5ee8
-
C:\Users\Admin\AppData\Local\Temp\zincite.logFilesize
1KB
MD589a13552d5e51c5e2de3b8a945a14ccc
SHA1b6d7ecfb2fef5c92d8c54e8d02a22d77e1e49387
SHA25601fb7726376a24c3df004b34680ce15eb24c75a812c0bc2923f570968d04276f
SHA51241cb1eecd0b7f0974d681f63762cd8f8de60fc2b6b073ba332f2a64944e075a9b53f8c3566b4b01e414f3bd0ed0501dc0c1479b4bc21232b155c767a6cec1b6a
-
C:\Users\Admin\AppData\Local\Temp\zincite.logMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\services.exeFilesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
memory/1580-0-0x0000000000500000-0x000000000050D000-memory.dmpFilesize
52KB
-
memory/1624-243-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1624-297-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1624-22-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1624-21-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1624-30-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1624-106-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1624-17-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1624-26-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1624-298-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1624-302-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1624-39-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1624-13-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1624-35-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1624-6-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/1624-31-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB