Overview

overview

10

Static

static

7

3d3a7094fb...18.exe

windows7-x64

7

3d3a7094fb...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/07/2024, 11:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3d3a7094fb7b8e62748e5854c4b26d79_JaffaCakes118.exe
  • Size 28KB
  • Sample240712-ns449stglg
  • SHA256 bef1ad6f3784162dc2a1747efb05d05739f8bf2902d040cae1430faf8f163756
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
microsoftpersistencephishingproduct:outlookupx

Malware Config

Signatures

  • Detected microsoft outlook phishing page
    phishingmicrosoftproduct:outlook
  • Executes dropped EXE 1 IoCs
  • UPX packed file 27 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d3a7094fb7b8e62748e5854c4b26d79_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3d3a7094fb7b8e62748e5854c4b26d79_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3964
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:432

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        default[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CWF229A2\default[1].htm
        • Size 304B
        • SHA256 a81000fc443c3c99e0e653cca135e16747e63bccebd5052ed64d7ae6f63f227f
        • MD5 SHA1 SHA512
        Submit Download

        default[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CWF229A2\default[4].htm
        • Size 311B
        • SHA256 312bf5c9a1a122abc6361bf8ed01a44346285b962c0d273ef2de0eb796ae1b15
        • MD5 SHA1 SHA512
        Submit Download

        search0JH2H9NI.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CWF229A2\search0JH2H9NI.htm
        • Size 118KB
        • SHA256 a07bb5cc774b9e931e366d0bdecb80c45b79cf8a6a36d2d45adc09b89d80b489
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchG2ZP7RFM.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CWF229A2\searchG2ZP7RFM.htm
        • Size 103KB
        • SHA256 6a9709c50d1da4fa2a18d33aba6af2fa5ff0d3503eae1a39679051e7eb28792d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchKAK353A1.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CWF229A2\searchKAK353A1.htm
        • Size 137KB
        • SHA256 79378e9628ca842e1ceae64ce1c3fc933a8b1f406833cec4947a18bd3d8e7c22
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchZSY1MO66.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CWF229A2\searchZSY1MO66.htm
        • Size 114KB
        • SHA256 b6f82673f36251353301325401fda15de07afd7c7e5b9e3525843408b8d3c0c8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CWF229A2\search[1].htm
        • Size 193KB
        • SHA256 c4788ba72b625189c75e998109a7124f589fc2228eba9c2a931ea7656d4a2213
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[9].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\CWF229A2\search[9].htm
        • Size 171KB
        • SHA256 079f837181cd8529729d2bb505e5485d8115b9905a31d6e4661a24839da1bc13
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FMLLHXYA\results[4].htm
        • Size 1KB
        • SHA256 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea
        • MD5 SHA1 SHA512
        Submit Download

        results[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FMLLHXYA\results[5].htm
        • Size 1KB
        • SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
        • MD5 SHA1 SHA512
        Submit Download

        search6FPGAGN7.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FMLLHXYA\search6FPGAGN7.htm
        • Size 138KB
        • SHA256 9880e33be75b787055aa0d21dd06d4c2d0799f84210a3ec7023c6bd2700e767e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchCMMSGF2U.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FMLLHXYA\searchCMMSGF2U.htm
        • Size 146KB
        • SHA256 258d7935e1fcf94547ce395a34db0bf6e17515b7fa0dace3ff997ec7b8aaed3d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FMLLHXYA\search[1].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        search[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FMLLHXYA\search[5].htm
        • Size 147KB
        • SHA256 11758f6642463e860d2ce9c9aa7b46bd6eede0bf1d3ec420813963aca3a3db38
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RYWXIGZS.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCRJMNF7\RYWXIGZS.htm
        • Size 175KB
        • SHA256 1f3d31ee774f9887f39aa51d05fe610e4b639dd33873305bf17acfc998d24feb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCRJMNF7\results[7].htm
        • Size 1KB
        • SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
        • MD5 SHA1 SHA512
        Submit Download

        searchA6RDWSOV.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCRJMNF7\searchA6RDWSOV.htm
        • Size 181KB
        • SHA256 587696206f027ccfacc364ec6f7e2e4a3aa70c07376b1957255e7351c910baa4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchX28X2W4A.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCRJMNF7\searchX28X2W4A.htm
        • Size 150KB
        • SHA256 c04edd036105265f03f9e6434901443db69495bef6ab41739e108fdd5e38f28c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        LGNKSMBP.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q90VG4IN\LGNKSMBP.htm
        • Size 175KB
        • SHA256 3d84ceab027e654c1b5d4bb12b9c5687394894f03beacea6182edbb444a39c03
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchL2PKWY6J.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q90VG4IN\searchL2PKWY6J.htm
        • Size 124KB
        • SHA256 60172781c721b696ca874103a975f0243af76eb4e134a8a6bdf638808f4267b0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchON52O4Y8.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q90VG4IN\searchON52O4Y8.htm
        • Size 130KB
        • SHA256 ec4d8e08cf4fe78b8aee8dd93cd368f873318ab0b334c450f7df762496fe5c96
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchX642ZX5F.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q90VG4IN\searchX642ZX5F.htm
        • Size 115KB
        • SHA256 7cb2e252e8d94927a976938377510c4ea69403edbb2ad28117dfa7952a3e6185
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q90VG4IN\search[3].htm
        • Size 118KB
        • SHA256 5667a7c8b2ff4f483f79a70a07c895fff8eaaf49043380d8921433c0992fd105
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q90VG4IN\search[5].htm
        • Size 137KB
        • SHA256 2fb9c10e3876b1ff223912b673ab673d45d1aff79578222615430637ce9d6dfe
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmpA9C8.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmpA9C8.tmp
        • Size 28KB
        • SHA256 03bf5cf5b1112f3f5b855cb7b0ab3b295e77e34ea49398ab4d105f9e4df8cfc3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 6f69ee50e8f3b3e4f221e50dbe5e739a40682207a43f669576a8dbe2366ac971
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 a38db4db16acb2489f128dfa93e6d75c5ac9f2c76fdf9a72e436d10382f41c04
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 826afbedc9a3da71c4e25ff1dd26665ac4c4ecfad3d2a1afe15b5d075dccb4a2
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 16972987238af0507b9a2f5cc1c90a6436688bdcee2bce18bddc2961b08a677e
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 363b086cced19109a4edd790aa038b7597ec2871e92da95d63b17c50923c5680
        • MD5 SHA1 SHA512
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/432-292-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/432-522-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/432-36-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/432-306-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/432-31-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/432-26-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/432-136-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/432-831-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/432-24-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/432-19-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/432-14-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/432-680-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/432-290-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/432-286-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/432-7-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3964-305-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/3964-679-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/3964-13-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/3964-521-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/3964-35-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/3964-830-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/3964-0-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/3964-291-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/3964-285-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/3964-135-0x0000000000500000-0x0000000000510000-memory.dmp
        Download