6ff896aad729154910bf638774d499748272c2a1e1805e073f665d7233edbc18

Analysis

max time kernel
131s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/05/2024, 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d0cdc4de04d8e29026926d40266eb6a_JaffaCakes118.js
Size

8KB
MD5

3d0cdc4de04d8e29026926d40266eb6a
SHA1

d515c2f437e9e437f75f62e7368b9830408bf079
SHA256

6ff896aad729154910bf638774d499748272c2a1e1805e073f665d7233edbc18
SHA512

881ae25f0bc1381555bf3a40f7ed51ff0fa33dbd5d839dff53aeca98cdb3cdc9ef3475b088fa3a8aaab49ef10ded6f25e324ed71b0e92b141482cf9df5a82080
SSDEEP

96:k5FtgRYdkNCih5MOUruWhbHyR4Ndb7tfcU6mQz4JrI5C2UV1Pjk9c1hJIszSoMUs:I8VNCrOUrukyKqmSYesWoIThnrRcmxb

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
14	1784	wscript.exe
24	1784	wscript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	14	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	24	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\3d0cdc4de04d8e29026926d40266eb6a_JaffaCakes118.js
1⤵
- Blocklisted process makes network request
PID:1784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4152,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:8
1⤵
PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...