Overview

overview

10

Static

static

7

2fd5336b6f...18.exe

windows7-x64

7

2fd5336b6f...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240708-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240708-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/07/2024, 09:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2fd5336b6fb7bbcfa87714f6b27e7874_JaffaCakes118.exe
  • Size 28KB
  • Sample240709-lhny7azbme
  • SHA256 ce5d0f4c44cb9def975a51a20433a8b6214bb7c1270aca61156db7dc37395c97
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
microsoftpersistencephishingproduct:outlookupx

Malware Config

Signatures

  • Detected microsoft outlook phishing page
    phishingmicrosoftproduct:outlook
  • Executes dropped EXE 1 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2fd5336b6fb7bbcfa87714f6b27e7874_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2fd5336b6fb7bbcfa87714f6b27e7874_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2300
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:3432

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        search34B6ON7V.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\228EM42T\search34B6ON7V.htm
        • Size 130KB
        • SHA256 dd02fe5e528dd35fba2ed5ac1be29af931151deffe71cd4889d912cde6d37b64
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchKSP2KOB4.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\228EM42T\searchKSP2KOB4.htm
        • Size 130KB
        • SHA256 8571e6933b8d029cc81b58729e83122bed615d1eb8b2f8582804c271fbf14e01
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchZ23LWHD7.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\228EM42T\searchZ23LWHD7.htm
        • Size 156KB
        • SHA256 2480ad8eefdf984694c6abf15f33ee0c9cf0d0f52fbb2a93052755135bde980a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\228EM42T\search[7].htm
        • Size 118KB
        • SHA256 1466712b94c3748e9dc935aeb96eb6b88efdc571c7a3ea6a698c03bee22e3019
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4DQBYRAH\results[1].htm
        • Size 1KB
        • SHA256 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea
        • MD5 SHA1 SHA512
        Submit Download

        search2R442FFI.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4DQBYRAH\search2R442FFI.htm
        • Size 145KB
        • SHA256 bc298a8d7e78070277de11f34f1cc6aa8e8e06b294bc1196728303c90f431131
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchF85Z4KXY.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4DQBYRAH\searchF85Z4KXY.htm
        • Size 105KB
        • SHA256 6ac2fc1f65074f3d407f50b0e2cf2f2bb5a478655ede5450280c8f42db3c0555
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchPX3BJ3C8.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4DQBYRAH\searchPX3BJ3C8.htm
        • Size 134KB
        • SHA256 aa70b12dbd9c59b7bfb6edda4d43a27b7331cd2797bb9b94144fd00021bf51c2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchRRGNNEPD.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4DQBYRAH\searchRRGNNEPD.htm
        • Size 173KB
        • SHA256 a6184eb615ae34dbe8c2def4c77a61c80673df95ca26a145338cec0136e33149
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[10].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4DQBYRAH\search[10].htm
        • Size 137KB
        • SHA256 ce9007f1b887f2397630f788cf528467444d4060f73cf4159a14d2bbed676df6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4DQBYRAH\search[1].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        search[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4DQBYRAH\search[4].htm
        • Size 121KB
        • SHA256 d998cb0dacc69fa794630fbdcec0583f291d7797c1c9d427ae97010401011d41
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4DQBYRAH\search[7].htm
        • Size 157KB
        • SHA256 1cad796b350f64934c2e76e8deb72a50d7a7eb9d25c1a17592366744401359cf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        LVKZ1ZFO.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D22KCZMP\LVKZ1ZFO.htm
        • Size 175KB
        • SHA256 55cbd5c007b423855da6c4d4b39626d1409af9a6733098c860119d606fc8286e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D22KCZMP\results[3].htm
        • Size 1KB
        • SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
        • MD5 SHA1 SHA512
        Submit Download

        searchI71BMAZ1.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D22KCZMP\searchI71BMAZ1.htm
        • Size 129KB
        • SHA256 e0fcd3261d8b44d3a8ddcbd841158a6251b1705747eccb8fbc5ab8fe9593ea89
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchOHH6JXX2.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D22KCZMP\searchOHH6JXX2.htm
        • Size 147KB
        • SHA256 3f091c1a159ba9f9c437cd3d190a5df8d4569b8e5ebbf01b213069691bafd9d5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchTG2PVWBC.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D22KCZMP\searchTG2PVWBC.htm
        • Size 172KB
        • SHA256 d149eaab0d342f9adc25860b42583436e8f988ddb92fe158d21c6a87b36605dc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SBQGDSDR\default[3].htm
        • Size 312B
        • SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
        • MD5 SHA1 SHA512
        Submit Download

        results[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SBQGDSDR\results[4].htm
        • Size 1KB
        • SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
        • MD5 SHA1 SHA512
        Submit Download

        search0054PXK3.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SBQGDSDR\search0054PXK3.htm
        • Size 151KB
        • SHA256 bf6602ed5970c15e548a5591822c63d497e77935e91c0d566794ebc5340c0515
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search4V31A8U7.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SBQGDSDR\search4V31A8U7.htm
        • Size 116KB
        • SHA256 76f02ef84e8bbd328aaaf40cfb58c6c4812eb7b4a4896ab4b434eafe11136c10
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchDTRA7J5I.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SBQGDSDR\searchDTRA7J5I.htm
        • Size 102KB
        • SHA256 0727d0f4959cd7947551c075f241bd508e9f7b8215c382b2ab3db8f3d74e7170
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[10].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SBQGDSDR\search[10].htm
        • Size 103KB
        • SHA256 f7297bdc4173fb642d14f7ccceb64082f6bbc3483221a409b25d887fbc23c78e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[9].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\SBQGDSDR\search[9].htm
        • Size 122KB
        • SHA256 70735c38e2fd156db8bca4a93f427f7eef64651ab88ea34dce16923bcdba01f5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmp36A8.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp36A8.tmp
        • Size 28KB
        • SHA256 be4111dd9e94c2e5b39204e86abd5ca3b92b1d3de5562a654a17c49f4ea3db20
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 a3164010173382ece526e284f1f33fb39830c202dce00ce80a98bab00920551e
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 e5094b6d6e7ae8c07fa3e392c455ff02d068a97eae5ddd55e7d7ee858b903443
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 12a5252de7762a43931f7fa80d2807cee474dbbf858545006e5a8b165c1183fa
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 77e6705fecdb7aeb64436d93746cf25d1a811759e896c94a5470e228d88b2b6b
        • MD5 SHA1 SHA512
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/2300-369-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2300-35-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2300-236-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2300-37-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2300-188-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2300-547-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2300-702-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2300-243-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2300-13-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2300-0-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/3432-237-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3432-38-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3432-189-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3432-36-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3432-239-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3432-31-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3432-26-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3432-24-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3432-19-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3432-14-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3432-244-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3432-703-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3432-6-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3432-548-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3432-370-0x0000000000400000-0x0000000000408000-memory.dmp
        Download