Overview

overview

10

Static

static

7

4d99ab1315...18.exe

windows7-x64

7

4d99ab1315...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/07/2024, 08:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4d99ab1315d4d11454bf007d4cb6a61a_JaffaCakes118.exe
  • Size 28KB
  • Sample240716-krhyvsxblc
  • SHA256 67af480346953e878d5f74c23954cb18265982260d8412326456f740893046f4
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
microsoftpersistencephishingproduct:outlookupx

Malware Config

Signatures

  • Detected microsoft outlook phishing page
    phishingmicrosoftproduct:outlook
  • Executes dropped EXE 1 IoCs
  • UPX packed file 29 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4d99ab1315d4d11454bf007d4cb6a61a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4d99ab1315d4d11454bf007d4cb6a61a_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1776
    • C:\Windows\services.exe
      "C:\Windows\services.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      PID:1996

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        search1FQL2RBJ.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MQYRE6E5\search1FQL2RBJ.htm
        • Size 164KB
        • SHA256 d9e38e6f6aeb87d154617537a1d4e563cc6ffa416ba2296566e2ae75e522095e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search4GGDFDA1.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MQYRE6E5\search4GGDFDA1.htm
        • Size 144KB
        • SHA256 d2eca10aefc13114596a9f86a2e16253b23c653602291af92fd7f561965bb1bc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search4I57WK0P.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MQYRE6E5\search4I57WK0P.htm
        • Size 122KB
        • SHA256 28563920d6cbb3eac25a693fbb58afa15057d726a63da4b6b989566518f72d8c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchLACDZ1HI.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MQYRE6E5\searchLACDZ1HI.htm
        • Size 202KB
        • SHA256 26567fcd8a6a03d575d5a5fc3244d2ba1f128a30533640e7b170bf6103e30760
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchT49WK1MP.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MQYRE6E5\searchT49WK1MP.htm
        • Size 123KB
        • SHA256 8fd391cd49cc1efbc1e839c5b21a7fa81d9b49bed901ad728abd3f8877a9745f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchX87Y3EVF.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MQYRE6E5\searchX87Y3EVF.htm
        • Size 115KB
        • SHA256 a2fbd031586f353004cec95b5bf59c36ac3dfc274d0ef34c1be09a19672c09ff
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MQYRE6E5\search[6].htm
        • Size 115KB
        • SHA256 a9ad9a69000e76fcf2f31a9696f5b580fd2efee5cc8cf00e7c96fd31887e397e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MQYRE6E5\search[8].htm
        • Size 126KB
        • SHA256 c36222ecc181472996edb8359414f1b39e7fa778c7a5c6886db4e9fa68520255
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TDM03SOT.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NTK5APBE\TDM03SOT.htm
        • Size 175KB
        • SHA256 d5e49495c5785aa0bbc6a1f47d7ccef612177d8501aed31ea1957b1c9b8d4743
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[2].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NTK5APBE\default[2].htm
        • Size 305B
        • SHA256 8553409a8a3813197c474a95d9ae35630e2a67f8e6f9f33b3f39ef4c78a8bfac
        • MD5 SHA1 SHA512
        Submit Download

        searchC95WTUQZ.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NTK5APBE\searchC95WTUQZ.htm
        • Size 132KB
        • SHA256 e6af336aeb255130db4d937d2f3c18d292926e156acef10a1adcb4df6b908bc3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchRBBN0GQU.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NTK5APBE\searchRBBN0GQU.htm
        • Size 149KB
        • SHA256 4892f5797d353913e6c12b681f0ff1644477483fb3198d0209579ae902cf7356
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NTK5APBE\search[3].htm
        • Size 147KB
        • SHA256 b569421d197540a23ec4e84acf7cf4df469792c3ff0c63cb0ff353a773361619
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[4].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NTK5APBE\search[4].htm
        • Size 136KB
        • SHA256 ac237d9ed876dbbd917f5e2e00bce60c370354350b857d6b31038029c0501f3d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[5].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\NTK5APBE\search[5].htm
        • Size 115KB
        • SHA256 6005126680cf5ed4aaefe7cc5841e775084af5ce3529a827a072e849197536bd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        default[10].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\default[10].htm
        • Size 309B
        • SHA256 e397cc793fd29a7e5c2d4bc5110b0be997769caf679b25805ed6c70238a0b81c
        • MD5 SHA1 SHA512
        Submit Download

        default[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\default[3].htm
        • Size 309B
        • SHA256 bdb7ac94dc916af2d7784a5c147167ce13e49d12baa9b8f3cccaf33e29419a7c
        • MD5 SHA1 SHA512
        Submit Download

        default[6].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\default[6].htm
        • Size 312B
        • SHA256 5d065a88f9a1fb565c2d70e87148d469dd9dcbbefea4ccc8c181745eda748ab7
        • MD5 SHA1 SHA512
        Submit Download

        results[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\results[3].htm
        • Size 1KB
        • SHA256 aec2ac9539d1b0cac493bbf90948eca455c6803342cc83d0a107055c1d131fd5
        • MD5 SHA1 SHA512
        Submit Download

        search022ERT85.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\search022ERT85.htm
        • Size 144KB
        • SHA256 19f5cb008a54af4c9b71324e7fbd73627510f6979cadce4b5f8c7258ec4a25d8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchAHVIQY3W.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\searchAHVIQY3W.htm
        • Size 153KB
        • SHA256 0c7f3fe02eb248b7bafd8dfecbe0e6ccd2d59d5a4e5761bbd70bfa30b370248e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchGBEIDNBD.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\searchGBEIDNBD.htm
        • Size 120KB
        • SHA256 d93b06516ccb7bdd2adcfa0e827e4a5567e126b9be62a8ffac5e3439ef767549
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[10].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\search[10].htm
        • Size 130KB
        • SHA256 294f7afcf14eff1cb54205d2007038b576a022f52ded8b7f93db6a26ddcc6343
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[8].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R9TFLRJ7\search[8].htm
        • Size 144KB
        • SHA256 d37c0a7e5c29255086d115dbbe73485689ca1fa66eee756b6e12f0d9604ed1d6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        results[1].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S20L3CYC\results[1].htm
        • Size 1KB
        • SHA256 0731a24ba3c569a734d2e8a74f9786c4b09c42af70457b185c56f147792168ea
        • MD5 SHA1 SHA512
        Submit Download

        results[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S20L3CYC\results[3].htm
        • Size 1KB
        • SHA256 3c0cf785ae4898fab36c8e6e6d1ff44a1b980db0216539cc895157efe273da2d
        • MD5 SHA1 SHA512
        Submit Download

        search1MFA1EF2.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S20L3CYC\search1MFA1EF2.htm
        • Size 121KB
        • SHA256 8783de793c14e5e8bf135689d6300b31996cfbab4c2fd10968451e70b1710efb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchIV0117OH.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S20L3CYC\searchIV0117OH.htm
        • Size 153KB
        • SHA256 92885aee305b42b077c2af8f3d67efcaaa1735f79220de9445703e3071b3ecc9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchJ3HEALX5.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S20L3CYC\searchJ3HEALX5.htm
        • Size 159KB
        • SHA256 3a4cbdf8e3222a2c4dbc32c4fc10f73a975308ab4d3c82ac07dbe166ad6681c3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchKEBGI5S4.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S20L3CYC\searchKEBGI5S4.htm
        • Size 128KB
        • SHA256 65daa63242c09a2d4bf76e154243afc5bde1e696d2fef9ecc3f0b0d5fdb371f6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        searchSK5ONLAS.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S20L3CYC\searchSK5ONLAS.htm
        • Size 138KB
        • SHA256 f42c6ff04f54895155a7a0b7c4e06c1ecde6e6b4c81812c09541194d77feee1e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        search[3].htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S20L3CYC\search[3].htm
        • Size 25B
        • SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
        • MD5 SHA1 SHA512
        Submit Download

        tmp82DA.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\tmp82DA.tmp
        • Size 28KB
        • SHA256 b28d840826f919ceb493c707b0bdf40634fb6c20eec7967893d78d6d3fd54ccf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 da3e9f45e91780949e7e7a2de100ccffb5e3329fe77d8e7fe8bd5fae52f93f1f
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 ed06f29999cfaba929c97187db54251413f67a501866b600f6624a9920a0159c
        • MD5 SHA1 SHA512
        Submit Download

        zincite.log
        • Path C:\Users\Admin\AppData\Local\Temp\zincite.log
        • Size 1KB
        • SHA256 d031bfcdaee6124180f672f976e622bd05ebfac728435b22c8601c284bc17c43
        • MD5 SHA1 SHA512
        Submit Download

        services.exe
        • Path C:\Windows\services.exe
        • Size 8KB
        • SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/1776-1085-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/1776-559-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/1776-381-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/1776-208-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/1776-13-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/1776-241-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/1776-231-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/1776-915-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/1776-0-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/1776-772-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/1776-25-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/1776-30-0x0000000000500000-0x0000000000510000-memory.dmp
        Download

        memory/1996-31-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1996-26-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1996-773-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1996-242-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1996-916-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1996-24-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1996-19-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1996-14-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1996-560-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1996-1086-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1996-209-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1996-232-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1996-382-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1996-5-0x0000000000400000-0x0000000000408000-memory.dmp
        Download

        memory/1996-237-0x0000000000400000-0x0000000000408000-memory.dmp
        Download