Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 15:38

General

  • Target

    075d4363d086106e25e858ee868dabc0_JaffaCakes118.exe

  • Size

    28KB

  • MD5

    075d4363d086106e25e858ee868dabc0

  • SHA1

    9f0c15b837192b0e5cca1103138f56471b49c2a4

  • SHA256

    eec0ce6205e7c5649791f474146212ac716b4dc7bd422be980117e963ad95779

  • SHA512

    8eeb12f632991222646f18f095fb9e995fa05d6c9dcb4213f43b104b7ecbdea9056f3abbccee2b2a5411eeb90cf81bbf68cd9c2ac7d1f781cceab363bdc45c89

  • SSDEEP

    384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNhBj:Dv8IRRdsxq1DjJcqfc

Malware Config

Signatures

  • Detected microsoft outlook phishing page
  • Executes dropped EXE 1 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\075d4363d086106e25e858ee868dabc0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\075d4363d086106e25e858ee868dabc0_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4740
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:3144
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3760,i,15140928051103392835,1612840580898364401,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:8
    1⤵
      PID:1000

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\44ZGVQ6R\search[4].htm
      Filesize

      112KB

      MD5

      887babb5a5ff2c0a67b02ec40e6449ee

      SHA1

      1addffd26ba72f7485452a63a1ac46b0d70db085

      SHA256

      376dd73a6a70ad7ec79011a19e2c25005be5951dcc1e4235a76ae7b398ca1147

      SHA512

      6cad1849220cf230d45f36dd75c738729a74277d02c96fddbbf07a54fa5c99bc45e12218dd010d2df5447da52ecf8f734a780611a7dba631e833cb4a668e4c1f

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7UY3WOJS\search[8].htm
      Filesize

      131KB

      MD5

      e8a7b4cbe8f68c80aa7099a9852302cc

      SHA1

      ea1dadbf83b5dd4b485aa88a4aefd2dcf0c4e05a

      SHA256

      165472dd9be8888377a790325eb567f6cf480f7347394fb9883c66dbef6d85a9

      SHA512

      0db903ed8c28c4e3d4e3ccc431fee178827f02b478a857c7aca35094d2f9c27c5266332ae9c47ac2ef2b8729e5fa47153bc01f57f6b323677070f9a8c28b3d1c

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VVOFDIUO\PBK0HGNY.htm
      Filesize

      176KB

      MD5

      d0ad38b81ec98208fd5dc09403f22a40

      SHA1

      a80774bd46563852041c731df56b64b0924ec08d

      SHA256

      603ce4a5b3c80bfec21cc59ea145745fe99c368eaeec9f2df988b2c9fa29f0ce

      SHA512

      cd4247129b79b9e4c6f9bc1945a83a396530a6e75be02ba54e7482ab46c8360c34e9bee9236f6c540c0c3d64695f627826dc9b0b984e3c66388c479fbc2f9cd2

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VVOFDIUO\search[6].htm
      Filesize

      116KB

      MD5

      99ca52dfe04ad62e3d911bab802ef8d6

      SHA1

      e61f297e8c7be7a605588699f2d918046a4a4aff

      SHA256

      6ec43490f8554c1658128f875c312f40d83d28de4beea3e47d3d64cfddc69c42

      SHA512

      8ac89494d14a1358f75c7ec6a30f07611c91a7ac901c708740a4df77497e6671753b4d1faa562469e54b3142fe0b2c7e1f0a602da09832c5e20b3ab4185dc648

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YOJF4VYG\search[4].htm
      Filesize

      25B

      MD5

      8ba61a16b71609a08bfa35bc213fce49

      SHA1

      8374dddcc6b2ede14b0ea00a5870a11b57ced33f

      SHA256

      6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

      SHA512

      5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

    • C:\Users\Admin\AppData\Local\Temp\tmp574E.tmp
      Filesize

      28KB

      MD5

      88374c6ec3c7ea58d5f0519075b9e680

      SHA1

      89e0ecfc57c5d12e1b15c170bade2563252a1e6c

      SHA256

      54e97c79feefc9059360eef5b3087c1bc45ea9932ba965517d829cd5a768a77f

      SHA512

      adc5de73250a6263af607d0013496c8d1e1310a5fc51a8ba9d0732ed39b1d1a76f4d1c1648e49c53382f66703fca3705766c33a923f58c8c3df83763db8bd05e

    • C:\Users\Admin\AppData\Local\Temp\zincite.log
      Filesize

      1KB

      MD5

      1d535bef12bf4055adebc231e57cbe4d

      SHA1

      43ed173233e0701757550f82c7bf386b51457e2f

      SHA256

      81ee7633840bc869ad8c0b97ba08a5c166fe69d0d43a015fc5a85c645c19d31c

      SHA512

      b48134f4f5a571908049da4e351c45aeea1dc71610d5dde15205fce4001792adc47bceb361aaba967539b5510f8623c7d1f21753d9ff75bd3f8df7c2c7c01e00

    • C:\Users\Admin\AppData\Local\Temp\zincite.log
      Filesize

      1KB

      MD5

      10cf654c81c39df0846bb54cb68013fb

      SHA1

      9400bf505724297991bcdbbe7d40a1f2db179c0a

      SHA256

      f4d7249680262066ac24c241421909cab28e2ca30677d5b66c96ad36f3203aa8

      SHA512

      241960110608565c7ecddb076ab6c0b3dbc19deb099493527b2d1630e77a88ebe14d11ed7e5f8bb09e1848786cb9498cb640b2adde8476a780494b26a14eb4af

    • C:\Users\Admin\AppData\Local\Temp\zincite.log
      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • C:\Windows\services.exe
      Filesize

      8KB

      MD5

      b0fe74719b1b647e2056641931907f4a

      SHA1

      e858c206d2d1542a79936cb00d85da853bfc95e2

      SHA256

      bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

      SHA512

      9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

    • memory/3144-26-0x0000000000400000-0x0000000000408000-memory.dmp
      Filesize

      32KB

    • memory/3144-14-0x0000000000400000-0x0000000000408000-memory.dmp
      Filesize

      32KB

    • memory/3144-7-0x0000000000400000-0x0000000000408000-memory.dmp
      Filesize

      32KB

    • memory/3144-43-0x0000000000400000-0x0000000000408000-memory.dmp
      Filesize

      32KB

    • memory/3144-291-0x0000000000400000-0x0000000000408000-memory.dmp
      Filesize

      32KB

    • memory/3144-48-0x0000000000400000-0x0000000000408000-memory.dmp
      Filesize

      32KB

    • memory/3144-36-0x0000000000400000-0x0000000000408000-memory.dmp
      Filesize

      32KB

    • memory/3144-31-0x0000000000400000-0x0000000000408000-memory.dmp
      Filesize

      32KB

    • memory/3144-245-0x0000000000400000-0x0000000000408000-memory.dmp
      Filesize

      32KB

    • memory/3144-24-0x0000000000400000-0x0000000000408000-memory.dmp
      Filesize

      32KB

    • memory/3144-19-0x0000000000400000-0x0000000000408000-memory.dmp
      Filesize

      32KB

    • memory/3144-38-0x0000000000400000-0x0000000000408000-memory.dmp
      Filesize

      32KB

    • memory/3144-243-0x0000000000400000-0x0000000000408000-memory.dmp
      Filesize

      32KB

    • memory/3144-234-0x0000000000400000-0x0000000000408000-memory.dmp
      Filesize

      32KB

    • memory/3144-238-0x0000000000400000-0x0000000000408000-memory.dmp
      Filesize

      32KB

    • memory/4740-237-0x0000000000500000-0x0000000000510000-memory.dmp
      Filesize

      64KB

    • memory/4740-233-0x0000000000500000-0x0000000000510000-memory.dmp
      Filesize

      64KB

    • memory/4740-244-0x0000000000500000-0x0000000000510000-memory.dmp
      Filesize

      64KB

    • memory/4740-0-0x0000000000500000-0x0000000000510000-memory.dmp
      Filesize

      64KB

    • memory/4740-13-0x0000000000500000-0x0000000000510000-memory.dmp
      Filesize

      64KB

    • memory/4740-290-0x0000000000500000-0x0000000000510000-memory.dmp
      Filesize

      64KB

    • memory/4740-47-0x0000000000500000-0x0000000000510000-memory.dmp
      Filesize

      64KB

    • memory/4740-42-0x0000000000500000-0x0000000000510000-memory.dmp
      Filesize

      64KB