Overview

overview

10

Static

static

7

23ddac1ded...18.exe

windows7-x64

7

23ddac1ded...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 23:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    23ddac1ded978959c3a3c326cd479d1f_JaffaCakes118.exe
  • Size 28KB
  • Sample240703-3lkvdatelc
  • SHA256 a8d7f22be6d24e7010e66359b9d9929af32dadef19e99be9e96b8bbba8df40ac
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
microsoftpersistencephishingproduct:outlookupx

Malware Config

Signatures

  • Detected microsoft outlook phishing page
    phishingmicrosoftproduct:outlook
  • Executes dropped EXE 1 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\23ddac1ded978959c3a3c326cd479d1f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\23ddac1ded978959c3a3c326cd479d1f_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1180
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:552

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DT8Y7FAA.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E9YVC3IR\DT8Y7FAA.htm
        • Size 175KB
        • SHA256 342e6b1aff099e3cca09866da13f839b7158b5d9d260bd7cc13309473c90dcbc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search2ZW1OPG1.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E9YVC3IR\search2ZW1OPG1.htm
        • Size 121KB
        • SHA256 eea9079086c57702ffde8566b9159390db80d64b31994d52cae3be81dcd71882
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchFIMVJNDU.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E9YVC3IR\searchFIMVJNDU.htm
        • Size 109KB
        • SHA256 44a343971496c1ed23364dd5769a20ffd2d15f48205c488b7e1430d5ffa14ab6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchI2Z8PO7D.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E9YVC3IR\searchI2Z8PO7D.htm
        • Size 148KB
        • SHA256 781532d3a7a8f982c15ba0258ce497a2370e64743c019f717b27885edf4b01b3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchJIKYBN6E.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E9YVC3IR\searchJIKYBN6E.htm
        • Size 125KB
        • SHA256 deca85b2869f17236479f2a3bd216beae91877a0d93039838915f95b8da333a7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchXU03YV8E.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E9YVC3IR\searchXU03YV8E.htm
        • Size 170KB
        • SHA256 abb57bc8a0af2b5c2d92e4aa8c666ec41f1704bc468b1dcb841bfcddc6ef6de2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E9YVC3IR\search[2].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        search[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E9YVC3IR\search[5].htm
        • Size 131KB
        • SHA256 00bf77da0c8ecec54937ca715c150b8a4d4911e6bcc2714e9e33ea02e19fe2d9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E9YVC3IR\search[6].htm
        • Size 114KB
        • SHA256 165d7068bb8db4cb0185d9100ed397802b6dd2f6844d919935bf58f411e96964
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[9].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\E9YVC3IR\search[9].htm
        • Size 185KB
        • SHA256 cf02e4b2f4b11ab9c24ddad90263df98a5b462fe889a7c9d7608fc3d7dec55f9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7AAJOBN\default[3].htm
        • Size 312B
        • SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
        • MD5 SHA1 SHA512
        Submit Download

        results[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7AAJOBN\results[6].htm
        • Size 1KB
        • SHA256 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea
        • MD5 SHA1 SHA512
        Submit Download

        search2O7DSLFY.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7AAJOBN\search2O7DSLFY.htm
        • Size 170KB
        • SHA256 4ace873ee0dedb7b0302d4ef57f7d20e71e0a2d370c067c6fd316f458bb740c6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search4Y3LLGC1.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7AAJOBN\search4Y3LLGC1.htm
        • Size 151KB
        • SHA256 38e31e770f61f0487111215d3950fc49a77ec487dc9090ec6e262227523804cc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchCZXOUOZV.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7AAJOBN\searchCZXOUOZV.htm
        • Size 118KB
        • SHA256 149fabf44e53cfafc247896c132737838ddf3dec05da02a9ffbd893f07f6843a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchQ7QCYQP3.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7AAJOBN\searchQ7QCYQP3.htm
        • Size 196KB
        • SHA256 89c724cbc9a78f14a7d3545565cc84a6b07d0f75a21a45e4cabbb6209d099e33
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchSZ2FX82L.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7AAJOBN\searchSZ2FX82L.htm
        • Size 206KB
        • SHA256 6022565df45b6fac403d11f0e48f64dc05e683d3cbb6574a4d0c74ee944bb1c2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchZ0WQA6CV.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7AAJOBN\searchZ0WQA6CV.htm
        • Size 138KB
        • SHA256 2109da353726f6803ca105e0ad60f00ad9ae3f1803b7a65f08aa7d0b6b1bd00f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7AAJOBN\search[8].htm
        • Size 121KB
        • SHA256 fd5582e4bf3fbd7a2e1ba4359db68fd58ab0d85f340ea05400f6a12dc9ff528b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\results[3].htm
        • Size 1KB
        • SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
        • MD5 SHA1 SHA512
        Submit Download

        search1O1G5BIS.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\search1O1G5BIS.htm
        • Size 139KB
        • SHA256 ce6436f4f16f976de2f6f1576ceab4af7553a273de99199d71433dba5f712d3c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search249QVYHO.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\search249QVYHO.htm
        • Size 131KB
        • SHA256 02964922dd86effa8f6f4a5f3bee2610a17e94062b2cbf6c908972ed0a1cf16f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search2DDX7I1B.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\search2DDX7I1B.htm
        • Size 113KB
        • SHA256 6642f1e6668bf5cdb72cfc47c4896139465e73ac5a879f05bf4f4886b48677a0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchQOY2RMQ5.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\searchQOY2RMQ5.htm
        • Size 118KB
        • SHA256 8c84f8a1bd3ccfba3fc03bd38c36fcda946895f2418d6d8c7fceca1b0d652dda
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchVJ50884A.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\searchVJ50884A.htm
        • Size 156KB
        • SHA256 56833546aed623d11292564ff2fdbb86560c37a4af350f15e9e7f16ac8a5f71a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\REQ5K173\search[7].htm
        • Size 130KB
        • SHA256 8d66a7c2b003fe95298d651d01c23329d25061f39bef31685778200a2657e762
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XIQH11PJ\default[1].htm
        • Size 304B
        • SHA256 ef1f87447ae1ab45548d2934cf0dbd15a32b86359ff9fccfa48d76c1badf6586
        • MD5 SHA1 SHA512
        Submit Download

        results[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XIQH11PJ\results[5].htm
        • Size 1KB
        • SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
        • MD5 SHA1 SHA512
        Submit Download

        searchRSNJF34V.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XIQH11PJ\searchRSNJF34V.htm
        • Size 135KB
        • SHA256 f62fc1d8bbee53b8a7a63362d615678a2ba0cc3ce5a90e3532846aa8b9917545
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XIQH11PJ\search[3].htm
        • Size 145KB
        • SHA256 7730ebcaf5cc30bc0d9e607be22cb5160033a9d7d9122409bd010da8d75e4597
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XIQH11PJ\search[6].htm
        • Size 185KB
        • SHA256 40c1ebf161f8ae06675d79f4b4cd483c19af6b7405ae23718016827daaf0c2e1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmp491.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp491.tmp
        • Size 28KB
        • SHA256 0e362520c55ef9115e9892067f26d03e31bc7543f7610f9dcc454532c09d78fb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 3c50d59d296468dc50a9c0a54d99d92ad8810445a6003d3346db896b2746ec3e
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 481242c4043f63c16b6c18d4267c0435aeb689710726bdf812af4789843b1a07
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 e0d75282d5c5763380715a6876c8052f15200e35735d0fc158f991cec5a68999
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 77b1ec76d538f2d3aaf3983d1835a008cea507b003d7567afba3f8e11ac07b04
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 cae113a5fc58f008abb0d49f079ed829258c3b4ca625bbcb28a6d5b82aeefeee
        • MD5 SHA1 SHA512
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/552-320-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/552-571-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/552-19-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/552-14-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/552-31-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/552-24-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/552-457-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/552-316-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/552-1127-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/552-213-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/552-798-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/552-26-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/552-966-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/552-325-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/552-6-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1180-757-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/1180-324-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/1180-965-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/1180-13-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/1180-315-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/1180-25-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/1180-0-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/1180-212-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/1180-1126-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/1180-452-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/1180-30-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/1180-570-0x0000000000500000-0x0000000000510000-memory.dmp
        Download