e2fb246070404a9e7f9a42bc88f3429ee9f7bc4470c4ac939db46be21e165287

Analysis

max time kernel
131s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 23:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37141d21044b40a776c51cdc13b86899_JaffaCakes118.js
Size

73KB
MD5

37141d21044b40a776c51cdc13b86899
SHA1

8f987d9c56e12e6641754115cb0d65d6c34e69c6
SHA256

e2fb246070404a9e7f9a42bc88f3429ee9f7bc4470c4ac939db46be21e165287
SHA512

2cb85962acafa8d0ce385917b425f5ede4ab503d1224073aae783e57b5eab3589bd423b47e1c6d7f689c5cce0bf791de84d897fb95ecf64ffd59f30758b4fdcc
SSDEEP

1536:d8cQPMz4GlHNvQYviFSD17fdN85bxYYhVfGAGnNUHORWR:6cQPM8GdNv6ERYLN7SNEKWR

Score

8^/10

execution persistence

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	4084	wscript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\37141d21044b40a776c51cdc13b86899_JaffaCakes118.js	wscript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\37141d21044b40a776c51cdc13b86899_JaffaCakes118.js	wscript.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\37141d21044b40a776c51cdc13b86899_JaffaCakes118 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\37141d21044b40a776c51cdc13b86899_JaffaCakes118.js\""	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\37141d21044b40a776c51cdc13b86899_JaffaCakes118 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\37141d21044b40a776c51cdc13b86899_JaffaCakes118.js\""	wscript.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\37141d21044b40a776c51cdc13b86899_JaffaCakes118.js
1⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:4084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\37141d21044b40a776c51cdc13b86899_JaffaCakes118.js

Filesize
73KB

MD5
37141d21044b40a776c51cdc13b86899

SHA1
8f987d9c56e12e6641754115cb0d65d6c34e69c6

SHA256
e2fb246070404a9e7f9a42bc88f3429ee9f7bc4470c4ac939db46be21e165287

SHA512
2cb85962acafa8d0ce385917b425f5ede4ab503d1224073aae783e57b5eab3589bd423b47e1c6d7f689c5cce0bf791de84d897fb95ecf64ffd59f30758b4fdcc

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads