Overview

overview

10

Static

static

7

4875d08f45...18.exe

windows7-x64

7

4875d08f45...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2024, 05:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4875d08f45c77bed0dbf13a1d132148b_JaffaCakes118.exe
  • Size 28KB
  • Sample240715-gd28sstdme
  • SHA256 48a1920b17a4bdf3d99e0f314e32a241d9cf06f59e4cb343d208baec91a22d15
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
microsoftpersistencephishingproduct:outlookupx

Malware Config

Signatures

  • Detected microsoft outlook phishing page
    phishingmicrosoftproduct:outlook
  • Executes dropped EXE 1 IoCs
  • UPX packed file 30 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4875d08f45c77bed0dbf13a1d132148b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4875d08f45c77bed0dbf13a1d132148b_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:3856

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        search72XAPPVX.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LIDWBKOU\search72XAPPVX.htm
        • Size 115KB
        • SHA256 426396c35b7432980bff59d13fd7987b3c1e8b29ed9606ea112c7df3f973e108
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchXI11EQKA.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LIDWBKOU\searchXI11EQKA.htm
        • Size 145KB
        • SHA256 e1b2627c183d15452b1cafc7fcdefe385d9a0df180097a30d8dd8a9582b6f575
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LIDWBKOU\search[3].htm
        • Size 149KB
        • SHA256 e7ef6edb45eb395cac367d6a8797d2d03e70c8953e2badf2afe50183fa467295
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        CN8397YR.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QOWVUGSW\CN8397YR.htm
        • Size 175KB
        • SHA256 426710f61123c90825edfd04bd9502e13b9171a8dec7c3b5ff78fcec627d37e6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QOWVUGSW\default[1].htm
        • Size 315B
        • SHA256 202eada95ef503b303a05caf5a666f538236c7e697f5301fd178d994fa6e24cf
        • MD5 SHA1 SHA512
        Submit Download

        results[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QOWVUGSW\results[4].htm
        • Size 1KB
        • SHA256 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea
        • MD5 SHA1 SHA512
        Submit Download

        search[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QOWVUGSW\search[5].htm
        • Size 138KB
        • SHA256 b193beaeb645dd1f4e7226d6433f5519bcfc45f6bb2caff56916dcb45f33868d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QQL8WXAG\results[6].htm
        • Size 1KB
        • SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
        • MD5 SHA1 SHA512
        Submit Download

        search8CCB9A9U.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QQL8WXAG\search8CCB9A9U.htm
        • Size 117KB
        • SHA256 757d26d952c6c48ec1f2bf50419d17071d040f0b0b338874969197f5e7c60203
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchEVAO30W5.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QQL8WXAG\searchEVAO30W5.htm
        • Size 144KB
        • SHA256 de3c9e1a59b436f46bb4f12bcaae4d020896d41cb2b10db1bcad4c97dde094c0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchIMJ65GRD.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QQL8WXAG\searchIMJ65GRD.htm
        • Size 121KB
        • SHA256 12de9c99716690582b40efdf870df3bec04bb9b03d3c3a354a6b8a0db7a530b2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchO2DFRDDG.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QQL8WXAG\searchO2DFRDDG.htm
        • Size 108KB
        • SHA256 b5258b8d72de95fd7cda4e37399d8026732b61b772bc689a04a31b6cdf321a91
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchQXB23URG.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QQL8WXAG\searchQXB23URG.htm
        • Size 106KB
        • SHA256 981a10c8cd7467b99fee0461a499a7b3c6c76566626d4ac458b89f472bf760a9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QSEI9KX6\default[1].htm
        • Size 304B
        • SHA256 ef1f87447ae1ab45548d2934cf0dbd15a32b86359ff9fccfa48d76c1badf6586
        • MD5 SHA1 SHA512
        Submit Download

        default[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QSEI9KX6\default[2].htm
        • Size 310B
        • SHA256 231fe7c979332b82ceccc3b3c0c2446bc2c3cab5c46fb7687c4bb579a8bba7ce
        • MD5 SHA1 SHA512
        Submit Download

        results[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QSEI9KX6\results[3].htm
        • Size 1KB
        • SHA256 a4e6ba8c1fe3df423e6f17fcbeeaa7e90e2bd2fffe8f98ff4b3e6ed970e32c61
        • MD5 SHA1 SHA512
        Submit Download

        search8KTHU5BJ.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QSEI9KX6\search8KTHU5BJ.htm
        • Size 120KB
        • SHA256 41cf844a96615a06c55c039df1f444687c7e3969105c4a1440616d072169fa99
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QSEI9KX6\search[2].htm
        • Size 143KB
        • SHA256 2747e1d9ab513701eb19c87dd8be743c43a7e84573717f22aafa1f6bc2cbd65a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QSEI9KX6\search[4].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        search[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QSEI9KX6\search[5].htm
        • Size 115KB
        • SHA256 ba33556d7a0f4f66cf5803582137dfdd61ab76172b6d34af9794e8c6ef349f85
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QSEI9KX6\search[6].htm
        • Size 155KB
        • SHA256 a8c65fa88a348adeb48d0d77eef5b50b4d2d7d594e02799218035f9aee332e19
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QSEI9KX6\search[8].htm
        • Size 135KB
        • SHA256 6b705f62b402456928d361cff8577488b6399afefd615373636958ce9b6a375d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tmp4AD2.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp4AD2.tmp
        • Size 28KB
        • SHA256 c78ad62dcd7fb19b1597b0fb0316593cada6e2fe483f96c83ce7637e173b8015
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 658c8399324f123aede17854a363b8db1da5e9b45cb1d110bfdadb7fd69ca260
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 057373bfbe0c2ee86f3b341e664da3038375ad2f09c56f706ebf7cf1375d3b19
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 52e347b94736e2a7fd7a6985dfea10ff4e96c176f1829c15244482ee1f927abe
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 54dfa7ac377e5aa9daee24f01e9500eb80043a9985d4ed457f14f28da7e8245b
        • MD5 SHA1 SHA512
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/2488-196-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2488-471-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2488-0-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2488-13-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2488-318-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2488-637-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2488-192-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2488-25-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2488-182-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2488-119-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2488-171-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2488-164-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/2488-166-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/3856-183-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3856-197-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3856-165-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3856-167-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3856-120-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3856-172-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3856-26-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3856-472-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3856-24-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3856-19-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3856-319-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3856-638-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3856-14-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3856-193-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/3856-7-0x0000000000400000-0x0000000000408000-memory.dmp
        Download