Overview

overview

10

Static

static

7

41edc36662...18.exe

windows7-x64

7

41edc36662...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/07/2024, 13:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    41edc36662361c86d089846b69b03014_JaffaCakes118.exe
  • Size 28KB
  • Sample240713-q3vppavfrc
  • SHA256 1eadbd9f664481de2e20c864bad9d88d9f72789f0553a334ac01cfcb26d163b1
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
microsoftpersistencephishingproduct:outlookupx

Malware Config

Signatures

  • Detected microsoft outlook phishing page
    phishingmicrosoftproduct:outlook
  • Executes dropped EXE 1 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\41edc36662361c86d089846b69b03014_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\41edc36662361c86d089846b69b03014_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3588
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:3052

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        results[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MQYRE6E5\results[7].htm
        • Size 1KB
        • SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
        • MD5 SHA1 SHA512
        Submit Download

        search4UYMTQY1.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MQYRE6E5\search4UYMTQY1.htm
        • Size 158KB
        • SHA256 2614666185a6eef2748fc12ee93779973487ab557cb7922c2fbed3b02f22f8c2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchQXEPCT58.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MQYRE6E5\searchQXEPCT58.htm
        • Size 149KB
        • SHA256 86abc58402a2c4d91a22137caf3ef05ff54557cd82cce9d871e9ec06a4766761
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MQYRE6E5\search[5].htm
        • Size 117KB
        • SHA256 1202ac60dd66a40e03358e86b6e25740cc144d3d6cce29351d46f611887c0d3c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        9V7LZP6P.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NTK5APBE\9V7LZP6P.htm
        • Size 176KB
        • SHA256 88a0ea9ebb524f982b29b94d364934fe50534308d8eb54c82bc7d8b70567e245
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NTK5APBE\results[1].htm
        • Size 1KB
        • SHA256 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea
        • MD5 SHA1 SHA512
        Submit Download

        results[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NTK5APBE\results[8].htm
        • Size 1KB
        • SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
        • MD5 SHA1 SHA512
        Submit Download

        search0YBU3N6W.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NTK5APBE\search0YBU3N6W.htm
        • Size 147KB
        • SHA256 603c10eaecfc3432a7737e7d7919449d7e81f664fd063c7e1497522b00b1db32
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search8GGAIV2B.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NTK5APBE\search8GGAIV2B.htm
        • Size 157KB
        • SHA256 1d9bdef018163bfdb18cdfef43791bbdcc8e43d100bf662d91db6190b9a59a24
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchGTMDBXFU.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NTK5APBE\searchGTMDBXFU.htm
        • Size 139KB
        • SHA256 898b8b6d97da35056424a6ba6bc575ecd554418cd00fd73aeb381b51e2e397bd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchRFIGO4WO.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NTK5APBE\searchRFIGO4WO.htm
        • Size 120KB
        • SHA256 0daae9bcf066cdaf434937e05df1612e6515216c0b93bd06717f7b459114f275
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NTK5APBE\search[8].htm
        • Size 121KB
        • SHA256 344d69775cb5e5540bd411d13a52d8c79e87e45a13678edef6c26c905591887d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        defaultQGA6Z179.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\defaultQGA6Z179.htm
        • Size 312B
        • SHA256 3d7c76daab98368a0dd25cd184db039cdd5d1bc9bd6e9bb91b289119047f5432
        • MD5 SHA1 SHA512
        Submit Download

        default[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\default[3].htm
        • Size 312B
        • SHA256 51b67ae1066eb179562cf80a8a156bbd4b139b83072f610bf62c0b6d58ed17f3
        • MD5 SHA1 SHA512
        Submit Download

        searchFOHDJW9F.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\searchFOHDJW9F.htm
        • Size 129KB
        • SHA256 0e8f892296fa59a7a14dec7f7d376df3eaa6629bf1840bdec79554a815b1aabc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchH0Y56WRI.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\searchH0Y56WRI.htm
        • Size 117KB
        • SHA256 8d3365e4b4c2a7aea959382c16be4f051caefb7729bfc265d338c57496b44a86
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchMGTW9GMT.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\searchMGTW9GMT.htm
        • Size 123KB
        • SHA256 5aa2483b0c5f0973ea6932194d5ff950a4fd3883d665bab7a3e8a5670f99fb8c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchTJBCBI8T.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\searchTJBCBI8T.htm
        • Size 145KB
        • SHA256 8420d94cd52227b3ae48d0b619195f1153dd743ad2b3be3f3b43211513ce09c0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchULBH3C8B.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\searchULBH3C8B.htm
        • Size 163KB
        • SHA256 4d98beb86843e5cf4535e89807fc825853b8c5aeeb324e2870a555f9b0a858ca
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\search[4].htm
        • Size 119KB
        • SHA256 c6ffeb4ed64f7f3a9d62cfd1f5acb4774a77c7af0cbf1dfb301eb49e171d52c0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\search[5].htm
        • Size 135KB
        • SHA256 3b7dff3bfb9fcc143f5f5dcfa6d878e31a2ffcbe708c163da09ff97cfa140473
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[10].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S20L3CYC\default[10].htm
        • Size 304B
        • SHA256 ef1f87447ae1ab45548d2934cf0dbd15a32b86359ff9fccfa48d76c1badf6586
        • MD5 SHA1 SHA512
        Submit Download

        search9WHR2QAD.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S20L3CYC\search9WHR2QAD.htm
        • Size 116KB
        • SHA256 4cb2d60ec4a6f20b7d9dfa8a7bc0494e5e3d57067ea6217ec2b09e71c0a568a9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchMPP8IPZF.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S20L3CYC\searchMPP8IPZF.htm
        • Size 142KB
        • SHA256 184575819b3fd910b8b796b36d8b055709d3c19dcea20ade031bb13bec32d0d1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S20L3CYC\search[2].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        search[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S20L3CYC\search[8].htm
        • Size 169KB
        • SHA256 3a559b4fe9a1aa886645a4851f0fc7380bc8d68279f91285cb61a2a261437987
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmp6242.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp6242.tmp
        • Size 28KB
        • SHA256 25bf4545721dfe106aed46f5eadbe5c67b212bba9f9da44c31d43d0d690fb0b3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 f392087626f229212d3680aff5bf3fad8fc6f41bf255d815e005356497b410eb
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 ce7e7157db3d5a9db8592295970fd12322abe7ca4c399c12cb80ce4922a41ec4
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 baccf6e1ef2a8566db527be6180729e1610996c7c970e0dd04f0f799d4933f00
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 5648b6f2753e4968986e5e1da18782bc30556fc5d66de178f606f6b9ba066443
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 8a58f7637cfb0492ef145444ebfe7e70da06a7a6c3a57fac79139f632b4af21b
        • MD5 SHA1 SHA512
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/3052-19-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3052-237-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3052-6-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3052-263-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3052-241-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3052-14-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3052-104-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3052-26-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3052-543-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3052-246-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3052-359-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3052-863-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3052-24-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3052-689-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3052-31-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3588-542-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/3588-30-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/3588-688-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/3588-245-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/3588-862-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/3588-358-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/3588-103-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/3588-0-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/3588-13-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/3588-240-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/3588-236-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/3588-262-0x0000000000500000-0x0000000000510000-memory.dmp
        Download