73da7ffa3619e3e8afbc2334219f1bd4be18b4128d835e2dfa9db8e3a9e239f5

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e56d42c27affc6c662d1d43b9b4ef1d_JaffaCakes118.js
Size

26KB
MD5

5e56d42c27affc6c662d1d43b9b4ef1d
SHA1

6ebf6ec3ec7df9003172d2f7d184e57bbeee4a83
SHA256

73da7ffa3619e3e8afbc2334219f1bd4be18b4128d835e2dfa9db8e3a9e239f5
SHA512

9cc9688e1ed5c6497360de986e9a5d9f4f6620d3318705b9d661f56761a5591da321ea569804915ef5844ddf01a1ed8cfd91e63f6d336b98c96ae9a5ecff3bc1
SSDEEP

768:1yAIcMTnXGPXGLP3yr0wpGOPar8WY6Abj+OkoSgCADADYfLBZrhDoPRw73sgI03L:9KTnXGfmP3ybpaEIxw8J0fYkJ

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

Processes:

wscript.exe

flow pid process

4 1340 wscript.exe
9 1340 wscript.exe
15 1340 wscript.exe
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	pid	process
4	1340	wscript.exe
9	1340	wscript.exe
15	1340	wscript.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\5e56d42c27affc6c662d1d43b9b4ef1d_JaffaCakes118.js
1⤵
- Blocklisted process makes network request
PID:1340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads