Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-06-2024 15:38
Behavioral task
behavioral1
Sample
075d4363d086106e25e858ee868dabc0_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
075d4363d086106e25e858ee868dabc0_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
075d4363d086106e25e858ee868dabc0_JaffaCakes118.exe
-
Size
28KB
-
MD5
075d4363d086106e25e858ee868dabc0
-
SHA1
9f0c15b837192b0e5cca1103138f56471b49c2a4
-
SHA256
eec0ce6205e7c5649791f474146212ac716b4dc7bd422be980117e963ad95779
-
SHA512
8eeb12f632991222646f18f095fb9e995fa05d6c9dcb4213f43b104b7ecbdea9056f3abbccee2b2a5411eeb90cf81bbf68cd9c2ac7d1f781cceab363bdc45c89
-
SSDEEP
384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNhBj:Dv8IRRdsxq1DjJcqfc
Malware Config
Signatures
-
Detected microsoft outlook phishing page
-
Executes dropped EXE 1 IoCs
Processes:
services.exepid process 3144 services.exe -
Processes:
resource yara_rule behavioral2/memory/4740-0-0x0000000000500000-0x0000000000510000-memory.dmp upx C:\Windows\services.exe upx behavioral2/memory/3144-7-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4740-13-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral2/memory/3144-14-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/3144-19-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/3144-24-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/3144-26-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/3144-31-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/3144-36-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/3144-38-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4740-42-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral2/memory/3144-43-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4740-47-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral2/memory/3144-48-0x0000000000400000-0x0000000000408000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\tmp574E.tmp upx behavioral2/memory/4740-233-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral2/memory/3144-234-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4740-237-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral2/memory/3144-238-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/3144-243-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4740-244-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral2/memory/3144-245-0x0000000000400000-0x0000000000408000-memory.dmp upx behavioral2/memory/4740-290-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral2/memory/3144-291-0x0000000000400000-0x0000000000408000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
075d4363d086106e25e858ee868dabc0_JaffaCakes118.exeservices.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe" 075d4363d086106e25e858ee868dabc0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe" services.exe -
Drops file in Windows directory 3 IoCs
Processes:
075d4363d086106e25e858ee868dabc0_JaffaCakes118.exedescription ioc process File created C:\Windows\java.exe 075d4363d086106e25e858ee868dabc0_JaffaCakes118.exe File created C:\Windows\services.exe 075d4363d086106e25e858ee868dabc0_JaffaCakes118.exe File opened for modification C:\Windows\java.exe 075d4363d086106e25e858ee868dabc0_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
075d4363d086106e25e858ee868dabc0_JaffaCakes118.exedescription pid process target process PID 4740 wrote to memory of 3144 4740 075d4363d086106e25e858ee868dabc0_JaffaCakes118.exe services.exe PID 4740 wrote to memory of 3144 4740 075d4363d086106e25e858ee868dabc0_JaffaCakes118.exe services.exe PID 4740 wrote to memory of 3144 4740 075d4363d086106e25e858ee868dabc0_JaffaCakes118.exe services.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\075d4363d086106e25e858ee868dabc0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\075d4363d086106e25e858ee868dabc0_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3760,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\44ZGVQ6R\search[4].htmFilesize
112KB
MD5887babb5a5ff2c0a67b02ec40e6449ee
SHA11addffd26ba72f7485452a63a1ac46b0d70db085
SHA256376dd73a6a70ad7ec79011a19e2c25005be5951dcc1e4235a76ae7b398ca1147
SHA5126cad1849220cf230d45f36dd75c738729a74277d02c96fddbbf07a54fa5c99bc45e12218dd010d2df5447da52ecf8f734a780611a7dba631e833cb4a668e4c1f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7UY3WOJS\search[8].htmFilesize
131KB
MD5e8a7b4cbe8f68c80aa7099a9852302cc
SHA1ea1dadbf83b5dd4b485aa88a4aefd2dcf0c4e05a
SHA256165472dd9be8888377a790325eb567f6cf480f7347394fb9883c66dbef6d85a9
SHA5120db903ed8c28c4e3d4e3ccc431fee178827f02b478a857c7aca35094d2f9c27c5266332ae9c47ac2ef2b8729e5fa47153bc01f57f6b323677070f9a8c28b3d1c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VVOFDIUO\PBK0HGNY.htmFilesize
176KB
MD5d0ad38b81ec98208fd5dc09403f22a40
SHA1a80774bd46563852041c731df56b64b0924ec08d
SHA256603ce4a5b3c80bfec21cc59ea145745fe99c368eaeec9f2df988b2c9fa29f0ce
SHA512cd4247129b79b9e4c6f9bc1945a83a396530a6e75be02ba54e7482ab46c8360c34e9bee9236f6c540c0c3d64695f627826dc9b0b984e3c66388c479fbc2f9cd2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VVOFDIUO\search[6].htmFilesize
116KB
MD599ca52dfe04ad62e3d911bab802ef8d6
SHA1e61f297e8c7be7a605588699f2d918046a4a4aff
SHA2566ec43490f8554c1658128f875c312f40d83d28de4beea3e47d3d64cfddc69c42
SHA5128ac89494d14a1358f75c7ec6a30f07611c91a7ac901c708740a4df77497e6671753b4d1faa562469e54b3142fe0b2c7e1f0a602da09832c5e20b3ab4185dc648
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YOJF4VYG\search[4].htmFilesize
25B
MD58ba61a16b71609a08bfa35bc213fce49
SHA18374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA2566aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
SHA5125855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
-
C:\Users\Admin\AppData\Local\Temp\tmp574E.tmpFilesize
28KB
MD588374c6ec3c7ea58d5f0519075b9e680
SHA189e0ecfc57c5d12e1b15c170bade2563252a1e6c
SHA25654e97c79feefc9059360eef5b3087c1bc45ea9932ba965517d829cd5a768a77f
SHA512adc5de73250a6263af607d0013496c8d1e1310a5fc51a8ba9d0732ed39b1d1a76f4d1c1648e49c53382f66703fca3705766c33a923f58c8c3df83763db8bd05e
-
C:\Users\Admin\AppData\Local\Temp\zincite.logFilesize
1KB
MD51d535bef12bf4055adebc231e57cbe4d
SHA143ed173233e0701757550f82c7bf386b51457e2f
SHA25681ee7633840bc869ad8c0b97ba08a5c166fe69d0d43a015fc5a85c645c19d31c
SHA512b48134f4f5a571908049da4e351c45aeea1dc71610d5dde15205fce4001792adc47bceb361aaba967539b5510f8623c7d1f21753d9ff75bd3f8df7c2c7c01e00
-
C:\Users\Admin\AppData\Local\Temp\zincite.logFilesize
1KB
MD510cf654c81c39df0846bb54cb68013fb
SHA19400bf505724297991bcdbbe7d40a1f2db179c0a
SHA256f4d7249680262066ac24c241421909cab28e2ca30677d5b66c96ad36f3203aa8
SHA512241960110608565c7ecddb076ab6c0b3dbc19deb099493527b2d1630e77a88ebe14d11ed7e5f8bb09e1848786cb9498cb640b2adde8476a780494b26a14eb4af
-
C:\Users\Admin\AppData\Local\Temp\zincite.logMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Windows\services.exeFilesize
8KB
MD5b0fe74719b1b647e2056641931907f4a
SHA1e858c206d2d1542a79936cb00d85da853bfc95e2
SHA256bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
SHA5129c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
-
memory/3144-26-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3144-14-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3144-7-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3144-43-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3144-291-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3144-48-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3144-36-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3144-31-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3144-245-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3144-24-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3144-19-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3144-38-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3144-243-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3144-234-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/3144-238-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/4740-237-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/4740-233-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/4740-244-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/4740-0-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/4740-13-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/4740-290-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/4740-47-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/4740-42-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB