Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
02/07/2024, 17:35
General
- Target 2039eaa3b12fe61374e0c4b977366c4d_JaffaCakes118.exe
- Size 28KB
- Sample240702-v6db2atekg
- SHA256 557548955d31a8e2d0a2ff5f93e6149c367f6b3a606376282fa35a9d9aa69d0a
Malware Config
Signatures
- Detected microsoft outlook phishing page
- Executes dropped EXE 1 IoCs
- UPX packed file 26 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in Windows directory 3 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2039eaa3b12fe61374e0c4b977366c4d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2039eaa3b12fe61374e0c4b977366c4d_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\services.exe"C:\Windows\services.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
searchLFEXY445.htm
search[3].htm
search[4].htm
results[2].htm
searchTGQH9DUM.htm
searchA355G5JV.htm
E8E0V98Q.htm
results[5].htm
searchPO9J0YF2.htm
searchYY66KW60.htm
tmpAAA3.tmp
zincite.log
zincite.log
zincite.log
zincite.log
services.exe
memory/3284-282-0x0000000000500000-0x0000000000510000-memory.dmp
memory/3284-263-0x0000000000500000-0x0000000000510000-memory.dmp
memory/3284-110-0x0000000000500000-0x0000000000510000-memory.dmp
memory/3284-13-0x0000000000500000-0x0000000000510000-memory.dmp
memory/3284-42-0x0000000000500000-0x0000000000510000-memory.dmp
memory/3284-248-0x0000000000500000-0x0000000000510000-memory.dmp
memory/3284-450-0x0000000000500000-0x0000000000510000-memory.dmp
memory/3284-252-0x0000000000500000-0x0000000000510000-memory.dmp
memory/3284-0-0x0000000000500000-0x0000000000510000-memory.dmp
memory/3324-249-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3324-111-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3324-264-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3324-36-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3324-253-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3324-283-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3324-31-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3324-38-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3324-451-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3324-26-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3324-24-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3324-19-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3324-14-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3324-43-0x0000000000400000-0x0000000000408000-memory.dmp
memory/3324-5-0x0000000000400000-0x0000000000408000-memory.dmp