Overview

overview

10

Static

static

7

41eeebc1fa...18.exe

windows7-x64

7

41eeebc1fa...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/07/2024, 13:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    41eeebc1fad0bcc78a74ae02453791a0_JaffaCakes118.exe
  • Size 28KB
  • Sample240713-q4rdnavgkc
  • SHA256 111f1ea8e1c240e36541e8c3f58a5fdb300a7276309fa2825fea18b787bead2c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
microsoftpersistencephishingproduct:outlookupx

Malware Config

Signatures

  • Detected microsoft outlook phishing page
    phishingmicrosoftproduct:outlook
  • Executes dropped EXE 1 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\41eeebc1fad0bcc78a74ae02453791a0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\41eeebc1fad0bcc78a74ae02453791a0_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:2084

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        search1I27X2ZU.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0HGGBLFL\search1I27X2ZU.htm
        • Size 157KB
        • SHA256 6e1c47ed2690329125c0b5428a046bcea9552004b3dc8460b38af064f48ff8b1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchQ0JJSD4U.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0HGGBLFL\searchQ0JJSD4U.htm
        • Size 120KB
        • SHA256 eb9ef5d76473e4c11f1e5d6125480188902df26b21e7360db4d596cc271f248c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchYEMXAUNC.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0HGGBLFL\searchYEMXAUNC.htm
        • Size 168KB
        • SHA256 fd2cb41a8b9431136ce917e89a7a90609e753721835e041e07e77d6cdc044323
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1AP1AEC\default[5].htm
        • Size 312B
        • SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
        • MD5 SHA1 SHA512
        Submit Download

        results[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1AP1AEC\results[1].htm
        • Size 1KB
        • SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
        • MD5 SHA1 SHA512
        Submit Download

        results[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1AP1AEC\results[4].htm
        • Size 1KB
        • SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
        • MD5 SHA1 SHA512
        Submit Download

        search9GZA10RG.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1AP1AEC\search9GZA10RG.htm
        • Size 121KB
        • SHA256 221fffe2ccf8fc29d205a3fb2e8927dd308b75da6c82431428019ef52bf3ab58
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchXSULCV9T.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1AP1AEC\searchXSULCV9T.htm
        • Size 104KB
        • SHA256 e00045baa3e7979a4286eb5a71eb148410a2371da35b4876aea75b528b1d9263
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1AP1AEC\search[3].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        search[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1AP1AEC\search[3].htm
        • Size 131KB
        • SHA256 480cee4b808642f610e124b1536497125f57b8ebf11ea5a2e985f9912f44be07
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1AP1AEC\search[5].htm
        • Size 121KB
        • SHA256 b40c01600c59b77e75db9a28cb8289ba5f17a6a8faeb25f8bcb2e2eaeb0b566f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D1AP1AEC\search[7].htm
        • Size 118KB
        • SHA256 3ab4272641779df15f42b721969dd7a572e443b961bc5d90f566c68af0cdf52d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SNW382U2.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\SNW382U2.htm
        • Size 176KB
        • SHA256 4ae18fd826ed2e5ed0e8fe2a1e7646354d078adcacf0badc714b8b59d3796ef7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search6IDJGA54.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\search6IDJGA54.htm
        • Size 137KB
        • SHA256 77b3bc2a6d62d749fb168ede496c051a4e767302cfaf737f14f2acf446d59ffa
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search9FDQV5T1.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\search9FDQV5T1.htm
        • Size 138KB
        • SHA256 a3b0e70b3199040f54f79509372edb11398bc9d57a8df728b436c307d6bbc551
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[10].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\I0E3LJN0\search[10].htm
        • Size 130KB
        • SHA256 9993ffccb03b0ff6687ccd75841872c25328c1b39582590229592d4055caa5f6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OZDMMIJY\default[2].htm
        • Size 313B
        • SHA256 7bd7c3676e98ddde8e0d5b63dd22cb9379d975bcd1d68884c97565cdd8d03660
        • MD5 SHA1 SHA512
        Submit Download

        search04EASK4G.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OZDMMIJY\search04EASK4G.htm
        • Size 136KB
        • SHA256 ffec240c36def301966e677210b4e986c52b424ea5d808992b30ee2927b08587
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search5H6X0K2S.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OZDMMIJY\search5H6X0K2S.htm
        • Size 149KB
        • SHA256 c0e748b51dd92312d9cafb04da41ae71f9682a64672458a8b525be50bdf19f7e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchHTRRAYGY.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OZDMMIJY\searchHTRRAYGY.htm
        • Size 151KB
        • SHA256 c6634f95e3029e954722f5f0148008080110d8cd88018867ccf9dd726e5ab93a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchYEPZY4E3.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OZDMMIJY\searchYEPZY4E3.htm
        • Size 115KB
        • SHA256 e5cf636f89f15454d651ded87e7130a15e60628bc8979e7b15bf2293ff8e3a12
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[10].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OZDMMIJY\search[10].htm
        • Size 160KB
        • SHA256 fac2bead3b50234aac950180c365c54754f63ed13fbec760b6667254c656cfb9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OZDMMIJY\search[4].htm
        • Size 106KB
        • SHA256 6164a20e777a21dafd6036eb139c476b7c754f74c9de2a35301dbe4c8c81502a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OZDMMIJY\search[5].htm
        • Size 144KB
        • SHA256 6ee21f5d18ac607427b86490ea20560b3aa81e77dc668dfe6808441e99201bb0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[7].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OZDMMIJY\search[7].htm
        • Size 160KB
        • SHA256 6b945b7fa94567f662a10c92b5086b5fa6e864f2e1a90c53cfc1a28dd2df6159
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmp52AF.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp52AF.tmp
        • Size 28KB
        • SHA256 e8f3b702fee0d1b9a9b0af4b28d956ed877ee44f30cf3b61bc3487c24993c21a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 e9ac2fbc0b3d40aca60284ae4ac5d4c405b836741a7750fea704e1bd0d2ab53f
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 71790e3cf35021511562227249a941c9fcd50a46bdbc68bfa29af5f065ce0ccf
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 71df91718f7821e8a9ae95ac7fce20c87b8e2bfea5c9645c4d3bf51fc141970d
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 d3c21b8e41b3d97551ea751b707996fa7c088b3b7ecc697b3e32a27bc29d2aac
        • MD5 SHA1 SHA512
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/2084-7-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2084-230-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2084-771-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2084-434-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2084-626-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2084-276-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2084-389-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2084-280-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2084-14-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2084-84-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2084-19-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2084-506-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2084-24-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2084-285-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2084-26-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/2124-505-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2124-625-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2124-25-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2124-83-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2124-0-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2124-229-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2124-13-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2124-275-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2124-770-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2124-433-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2124-284-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2124-388-0x0000000000500000-0x0000000000510000-memory.dmp
        Download