b71824bbf27c3a95df67f6fd5b0c5c2c0703e13207dbc82c75bd34a8f24a6d56

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 02:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
43e2d63f9a90666fb67826e858070bf5_JaffaCakes118.exe
Size 28KB
Sample240714-cnfqbssgrm
SHA256 b71824bbf27c3a95df67f6fd5b0c5c2c0703e13207dbc82c75bd34a8f24a6d56
MD5 43e2d63f9a90666fb67826e858070bf5
SHA1 9410f9d04167e92f389e06ca1d0dda746a8318e7
SHA512 865f0bdc2017e6b830d126d3a48445beb806461e1f25b5f6295c6f1a202573fdcaae51f45fdcff588b118788f7362de76477d8c7f6008991f51765f740aa92d4
SSDEEP 384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNgZPV:Dv8IRRdsxq1DjJcqfbV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

microsoft persistence phishing product:outlook upx

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook

Executes dropped EXE 1 IoCs

pid	Process
3320	services.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5064-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x0008000000023515-4.dat	upx
behavioral2/memory/3320-7-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5064-13-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/3320-14-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3320-19-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3320-24-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3320-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3320-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3320-36-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3320-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5064-42-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/3320-43-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/files/0x000900000002349b-56.dat	upx
behavioral2/memory/5064-104-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/3320-105-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5064-273-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/3320-274-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5064-296-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/3320-297-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3320-302-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5064-303-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/3320-304-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5064-422-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/3320-423-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	43e2d63f9a90666fb67826e858070bf5_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\java.exe	43e2d63f9a90666fb67826e858070bf5_JaffaCakes118.exe
File created	C:\Windows\services.exe	43e2d63f9a90666fb67826e858070bf5_JaffaCakes118.exe
File opened for modification	C:\Windows\java.exe	43e2d63f9a90666fb67826e858070bf5_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 3320	5064	43e2d63f9a90666fb67826e858070bf5_JaffaCakes118.exe	83
PID 5064 wrote to memory of 3320	5064	43e2d63f9a90666fb67826e858070bf5_JaffaCakes118.exe	83
PID 5064 wrote to memory of 3320	5064	43e2d63f9a90666fb67826e858070bf5_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\43e2d63f9a90666fb67826e858070bf5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\43e2d63f9a90666fb67826e858070bf5_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:3320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

results[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\09XH2190\results[2].htm
Size 1KB
SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
MD5 ee4aed56584bf64c08683064e422b722
SHA1 45e5ba33f57c6848e84b66e7e856a6b60af6c4a8
SHA512 058f023cb934a00c8f1c689001438c9bdd067d923ddcbe7a951f54d3ca82218803e0e81fbc9af5c56375ff7961deed0359af1ffa7335d41379ee97d01a76ded6
MD5 SHA1 SHA512

Submit Download

searchACTMF4J3.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\09XH2190\searchACTMF4J3.htm
Size 123KB
SHA256 6762fb443a23ec2f799a5a8068b1336800468c4f889235393a102f4166c3d0d3
MD5 fcf05d669d022c070f815ef4fa4f7a50
SHA1 9efb21bfeb1ea7b12d3039196dad6832060346f0
SHA512 15a626fd528935aaf5a85d673c049c0d4153e79a2d541f8ad35d6cbfe6934caae4af4fddcd98fb49b45e8a801b7cd78add4eb3b9ea16a15d6bc56573499a6b8d
SSDEEP 3072:hWIe/FzibJjLBhYLZmvImXkrrRd/64dWAK0:hmJdWz0
MD5 SHA1 SHA512 SSDEEP

Submit Download

searchM9E9TPIF.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\09XH2190\searchM9E9TPIF.htm
Size 117KB
SHA256 f453df5d73d1b42639d1046db0b359edf767b21ea267bfc23045b7aa2b1e0773
MD5 616e1aaae0c62c6df85dfee9170a35e7
SHA1 baba2f904a0865611d3529fff31af70185529ff4
SHA512 714eae345e870d45aae9b9824304a6958e3151bc757621c8c0a2cdd83fae91b71d26c902d5d2196b48713bf13859cf0f5dd8d2bcdd909770b9adff6601f2b29c
SSDEEP 3072:LWIe4JbVF33FIYeY9GiDtZoBlrqoLAZ8D8K8J8V8O828V8R4mFgN:L9JbVt3FIp4n2i7TiWm6N
MD5 SHA1 SHA512 SSDEEP

Submit Download

search[5].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\09XH2190\search[5].htm
Size 114KB
SHA256 46d7180af6bd413f1d58073de85a01cc2f360651852b780a05ab53b81a61bcb7
MD5 71d35922b95303f308077edcf17f74ab
SHA1 b4cb914a021a5ef44c5dd5b06f886821803a1f42
SHA512 4fb13e19db00bce51e6b83f997ed873d74ab0105d6fe11128039cecd9eddd339638da86bee2794f216b9c444dadf03db06bc68b18c7bc3d74d8773248a1e0036
SSDEEP 3072:xWIeUaE5StNFOrsqmSiN6lmCJ9SlpcL8+8G8Q8aCwDVa:xVaE5kNFOyccDtPwpa
MD5 SHA1 SHA512 SSDEEP

Submit Download

N2U2RZRS.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5HI12B12\N2U2RZRS.htm
Size 175KB
SHA256 adbdfc5f4ea8a4745e5efc9be9045e9adadc08341dd84a46a8cbb37e9c5d24b4
MD5 21f07dde5c1789f3916e94f97194726d
SHA1 454689555c23470188d215a578c80d1559cda015
SHA512 bd2c7f9d61fd6d7a1859f314a0e3227eba83a840d9602f33d41bc6e78e2dfedcdc2e98b6712807cde08054a4536ab8bfd77d78286a47e3685428ffbaff0b8efc
SSDEEP 1536:4jQDsEoamI1MGAzVbGAQU7+P1S0kyFK++zG58TJLDtrN3oamI1MGoamI1M84QY7h:DAIeGAzVCbS0ZK+QG58TJL8IetIelJtT
MD5 SHA1 SHA512 SSDEEP

Submit Download

results[5].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5HI12B12\results[5].htm
Size 1KB
SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
MD5 211da0345fa466aa8dbde830c83c19f8
SHA1 779ece4d54a099274b2814a9780000ba49af1b81
SHA512 37fd7ef6e11a1866e844439318ae813059106fbd52c24f580781d90da3f64829cf9654acac0dd0f2098081256c5dcdf35c70b2cbef6cbe3f0b91bd2d8edd22ca
MD5 SHA1 SHA512

Submit Download

search[8].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5HI12B12\search[8].htm
Size 157KB
SHA256 309ddbb748e64269ea0cc7ae225bac301522aad34510192265abb2a26da9e068
MD5 2e77f7b2516e6cdb7b5b85ad2fde7e73
SHA1 41ad8dc5defe07a5ba985ae6af2be4b4149ac9a1
SHA512 9073c241ee2531c227115fc74f7961d2d48dc2c61e830721c7e6eb62946ee39abb31d8e715d3a8dcc4f8cba1bf74ea660a6bcf5e5ff478892c6a6493912a6fbf
SSDEEP 3072:/WIeYLq6GFPzpolAblw4z/JF/89MwsBInO8K8I8K8V8l8p8P8ELDMui:/vgFSnVniSW00DDi
MD5 SHA1 SHA512 SSDEEP

Submit Download

search9FEHTJ1A.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5T79XY6A\search9FEHTJ1A.htm
Size 136KB
SHA256 e0241d1d8fd493c89479e1b2c4a7d18217bb12b8f94aa0ce774e6081e0c69dfc
MD5 9d36e610f4bfafd9c6947f24d7175d5e
SHA1 9bde24240bcf1c1041dd2eff64b0a4b859781f06
SHA512 4fae140d93731d83bf50c14733834d323b864223b46d39ddd77a0c4ccb8cd64e6d3311394de337860af19194112c44a0d067b8a3aba12e1d7df124e19d23444b
SSDEEP 3072:rWIeSqn71sC7YxewiFzKw2fHBXCYPThv6zYuk9jbhXm+zf8z848Z8g84WahSjF:rcnF8yIlmdlao5
MD5 SHA1 SHA512 SSDEEP

Submit Download

search[3].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5T79XY6A\search[3].htm
Size 25B
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
MD5 SHA1 SHA512

Submit Download

search[8].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5T79XY6A\search[8].htm
Size 156KB
SHA256 872888e9c95805a25d622de266a50e5701c618444ed203dafa924ec8e251a68e
MD5 54f9835b5987e660ea0146d58abff4e9
SHA1 e26bfe97f0e26b9052f124813e9ee956b0d83f5d
SHA512 90f5c77b3c8d921fd343302cde8c29962e4d5d6553082f054d561b2e26ea708c114708c0009b9e29a608375c73ec3362e5d759d7ebf15124c3df08b98a6e6d65
SSDEEP 3072:XWIeVByGFkkeSO2RK/rh6kIBs1gijShrooc8eJlcjiXTbsHTAY/T9cIA738j8l8J:XOZFw3sHT5YSCrrJjQW96
MD5 SHA1 SHA512 SSDEEP

Submit Download

searchUB6MYRVP.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F954GPP7\searchUB6MYRVP.htm
Size 104KB
SHA256 4a93d4a812f61a8d437ca69682b617092d2df31abbb4cdc248ab69ad6f042d31
MD5 46c5119fd8018a17fc120b6a49807494
SHA1 88f8fd1cba3fbc0199cba860fae479aac37454d8
SHA512 78d1f2d194e6c9f248dcbee3325256bd09110fe98fe8c2c3d3046e149616449bcf3335f617161735f4028f8ea9d2eb0a8334edf5df421b1609aeab8126489e85
SSDEEP 1536:ndD/DsqoamI1MYOzi0V+W1dCy/7K2KDxTlQ7y7C7wcbD9QkGvSooDMETQPB0kK8p:JWIemw7HmWwSD6NvXooEMP+ST+C2i
MD5 SHA1 SHA512 SSDEEP

Submit Download

searchUST7CXSU.htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F954GPP7\searchUST7CXSU.htm
Size 129KB
SHA256 15669be514a68c9c05b9b8351e1798495c8deb2f616ac6e4dd8edc85bc3c6d13
MD5 242a1f9200bfa570db51513daaad7f5a
SHA1 bc70ee3ed9163d8426bfe2d1298c8f1ca4042ef2
SHA512 a23cc925cbce5bf0bc5ee05edf65b0acf67dea4e14fef6fe3197ee207c8bc57c27592bd21cab024e926ce4fc0e91a47a051d61ae3de5ad9a6be0505ea5276cd2
SSDEEP 3072:rWIeohSFiGE9IXRJA1HoVf7szT8R8Q82j+lCa:rPYFlutK+Aa
MD5 SHA1 SHA512 SSDEEP

Submit Download

search[3].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F954GPP7\search[3].htm
Size 116KB
SHA256 5236985430dab79ddcdd04bbe22f193d835ceaaed48b39d0ecd8b521d822eaca
MD5 c477c80466569b02f49920d41e5fdd17
SHA1 c2c79e0dc67d3a21289fa069502e56b4e2def965
SHA512 ee0e6ad63b150c381c68f2815ef716417692a2494d4389cad37b5a8028727fa0a441ff6f1f55e2ff9086dfe7cc01d7d8b069809e317db7703cc77da98eb8980b
SSDEEP 3072:DWIekJqkSFraKiN9CTskUSvLa8FpEY81828XpWRLe:DDqLFkCTZWxe
MD5 SHA1 SHA512 SSDEEP

Submit Download

search[6].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\F954GPP7\search[6].htm
Size 136KB
SHA256 3a0bde9ae654e4168e46529f8a6365c694ecc3571eeca586d81bb2ce4f9f1f84
MD5 ca2726a40736ffae62de146dbca7066a
SHA1 ed538e70409a84f20dadb148346fb1e77e6dbc57
SHA512 97c74e9dbc3267e7e6c300fcaff54557fd5fee82a10a1a0c3a92ab59900426072bee95072874f587582dc3957af2ee6649c8180ddd22fcee87e6793c0e50c2bc
SSDEEP 3072:dWIea8eFLNd0SpWHBTG4aJvOtWyYZ8+818K8A8a8O8I8BmE9kU:dNLF2LCn9X7V8E+U
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpA4.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpA4.tmp
Size 28KB
SHA256 d73e96827c6298cfac391c1a5e6d445edf8e1fc5db25fd278008b265dfab8af6
MD5 1f08f628b1111ecff101a20bb03978b7
SHA1 24f1c130dfa8bd2f0a18c66339d820507d3d1cdb
SHA512 98f3ac350857f1f4f882ae49db5fb6785915cceda0d6253b81f312c2c8af595836e29c9c53fbea18cb6f4cbcf6677b6bcf0c2bce41b3293a3053fe1fb57fe93d
SSDEEP 384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyN7r8wB:Dv8IRRdsxq1DjJcqf1wB
MD5 SHA1 SHA512 SSDEEP

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 1KB
SHA256 635d1857d0b392e40d523e000875ecc0c88b5f582bfc28b5991bdfa3cadc39f6
MD5 bfd45384255752c82a84384b61982c09
SHA1 3d1f0c293402d7a024a7f371d3ea9a3d15e74c04
SHA512 789bb6596d2c6b73d48d507642a6365e8c464861cd9c771daf9a8069c57055c67d6ea1b7e5b59f2aa984e49bf9ef3811e7d582ad93bcd6c6cfc194eb0e4a022b
MD5 SHA1 SHA512

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 1KB
SHA256 22fe8bb605d6b6fc7fd0b39ddb936125c4a92c6803c13d2dd91b86b3a52f46e5
MD5 34e42dd26c95c3db898ef763f2995d18
SHA1 9e73b224289cb7514a23e178dd2af906216ec344
SHA512 76600f4993d230bb7721724b85fe8c0c2ac94104e3af151ec9ffed8817f2eda222fdc33aa72b6db82266a8ef726a75cd547838b8cb8c0a712ac685344d4466e9
MD5 SHA1 SHA512

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 1KB
SHA256 cc7894f8c26abcff043a95bce29980285be1171158e209344e94d26d8bcba0aa
MD5 14f51eabed9c7af871ec24099d5ed4e5
SHA1 44ac6df9e086b485af45795bb5939aa95154c214
SHA512 1308e08b255b9c6b8f6edca01763f5633fafccaca07631a515698c9bf3303842b177bfdc317fc1a39520f484f8f757ea361e5868a0c79547838ddb31169ce816
MD5 SHA1 SHA512

Submit Download

services.exe

Path C:\Windows\services.exe
Size 8KB
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
SSDEEP 192:tZWNqWKIzebvOZnzCj6juhEJS3/Uf/tpfmG62X9f3:tZ6qWTYvczfahX/UHtF6e9f3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3320-24-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3320-31-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3320-36-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3320-105-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3320-274-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3320-7-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3320-297-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3320-302-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3320-43-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3320-304-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3320-14-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3320-38-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3320-19-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3320-26-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3320-423-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5064-422-0x0000000000500000-0x0000000000510000-memory.dmp

Download

memory/5064-104-0x0000000000500000-0x0000000000510000-memory.dmp

Download

memory/5064-42-0x0000000000500000-0x0000000000510000-memory.dmp

Download

memory/5064-0-0x0000000000500000-0x0000000000510000-memory.dmp

Download

memory/5064-13-0x0000000000500000-0x0000000000510000-memory.dmp

Download

memory/5064-303-0x0000000000500000-0x0000000000510000-memory.dmp

Download

memory/5064-296-0x0000000000500000-0x0000000000510000-memory.dmp

Download

memory/5064-273-0x0000000000500000-0x0000000000510000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads