Overview

overview

7

Static

static

3

e5ea4cb753...18.exe

windows7-x64

7

e5ea4cb753...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    92s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/04/2024, 21:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    e5ea4cb7532fa06daac4255ac3405d83_JaffaCakes118.exe
  • Size 18.1MB
  • Sample240407-1jppfafd93
  • SHA256 7031caaabd21c90566987d7d008c4dfc7c778d07170fa9d519f991590e1a5578
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Loads dropped DLL 48 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e5ea4cb7532fa06daac4255ac3405d83_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\e5ea4cb7532fa06daac4255ac3405d83_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1396
    • C:\Users\Admin\AppData\Local\Temp\e5ea4cb7532fa06daac4255ac3405d83_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\e5ea4cb7532fa06daac4255ac3405d83_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:3112

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _raw_cbc.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_cbc.pyd
        • Size 12KB
        • SHA256 2a5ab7f23554f497693ca81a5e5f21647b10fd8b9e00b8377d8385dc15a9c4df
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_cfb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_cfb.pyd
        • Size 13KB
        • SHA256 b5438682a4c6bf57dcaad2835a9a293f712284fbe1af4ba6059011396cdbd180
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_ctr.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_ctr.pyd
        • Size 14KB
        • SHA256 2f9dfa9de351bfe553dde60ae891e9b54a2e08546d723c7165234fd41c3ceed4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_ecb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_ecb.pyd
        • Size 10KB
        • SHA256 821a86630238beaf4e303196ce26a250ef873f7a98b92644566b3c7d683d400e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _raw_ofb.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\Crypto\Cipher\_raw_ofb.pyd
        • Size 12KB
        • SHA256 236650fc42b347b9caa5e3a84a13da9e40586d97762f87730c9016dcb81abf06
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _BLAKE2s.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\Crypto\Hash\_BLAKE2s.pyd
        • Size 13KB
        • SHA256 825039711c334e169432a482f8b71ae735d7a1bd56552e501f6f3eca87cf272e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _MD5.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\Crypto\Hash\_MD5.pyd
        • Size 15KB
        • SHA256 efb961372f6ce102a9836b63038ae1385b408ef8dcf2de7238b2403a6e987b27
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _SHA1.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\Crypto\Hash\_SHA1.pyd
        • Size 17KB
        • SHA256 6cc9cfa3c9739b545808e814a661b5b54e9127b057ce503024e515648b7a4a33
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _SHA256.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\Crypto\Hash\_SHA256.pyd
        • Size 21KB
        • SHA256 1b36afc5b2f6f46d1a2457d56f276f5b5ffed066955acec911b9b7973d1e92b3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _strxor.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\Crypto\Util\_strxor.pyd
        • Size 10KB
        • SHA256 6429928799a5eea9e090224a2d7083b469892d725a28ea9dcc2a95f94286b0da
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\VCRUNTIME140.dll
        • Size 93KB
        • SHA256 6a0850419432735a98e56857d5cfce97e9d58a947a9863ca6afadd1c7bcab27c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\_bz2.pyd
        • Size 85KB
        • SHA256 ce4ef8ed1e72c1d3a6082d500a17a009eb6e8ed15022bf3b68a22291858feced
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _cffi_backend.cp38-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\_cffi_backend.cp38-win_amd64.pyd
        • Size 178KB
        • SHA256 37c4df72442c7e6e0a8f14173ba8a874f2051a136db5d9717c8c2a46ad58c965
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\_ctypes.pyd
        • Size 124KB
        • SHA256 820e840759eed12e19f3c485fd819b065b49d9dc704ae3599a63077416d63324
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\_lzma.pyd
        • Size 159KB
        • SHA256 9209ccc60115727b192bf7771551040ca6fdd50f9bf8c3d2eacbfd424e8245e4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _pytransform.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\_pytransform.dll
        • Size 1.1MB
        • SHA256 03c212d3fea1388e6a7448eee7f7ff2e8b695072b7c18daf9e701584356ef773
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\_socket.pyd
        • Size 78KB
        • SHA256 87832a3b89e2ada8f704a8f066013660d591d9ce01ce901cc57a3b973f0858ba
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\_sqlite3.pyd
        • Size 87KB
        • SHA256 9ae23d679a929d47b252ce14c9b2763a2913bbf17b0f52a8fd4b47aba0def0a2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\_ssl.pyd
        • Size 152KB
        • SHA256 0a721fc230eca278a69a2006e13dfa00e698274281378d4df35227e1f68ea3e0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\base_library.zip
        • Size 760KB
        • SHA256 52bd4ea66e4ece6bf404c3617d0c9723966adb9206c507fda8a2850d3c194ad0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\libcrypto-1_1.dll
        • Size 3.2MB
        • SHA256 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libffi-7.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\libffi-7.dll
        • Size 32KB
        • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\libssl-1_1.dll
        • Size 674KB
        • SHA256 fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\pyexpat.pyd
        • Size 187KB
        • SHA256 5caf51f12406bdb980db1361fab79c51be8cac0a2a0071a083adf4d84f423e95
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\python3.DLL
        • Size 58KB
        • SHA256 074b06ae1d0a0b5c26f0ce097c91e2f24a5d38b279849115495fc40c6c10117e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        python38.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\python38.dll
        • Size 4.0MB
        • SHA256 2f3e368f5bcc1dda5e951682008a509751e6395f7328fd0f02c4e1a11f67c128
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pythoncom38.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\pythoncom38.dll
        • Size 560KB
        • SHA256 b46daa6b63e2dde217ed2ec1da6dbd9256df1549d8ad306efcd3b4c4b0843a5b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        pywintypes38.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\pywintypes38.dll
        • Size 141KB
        • SHA256 28680409fd1ff08f87936f920b6bfa6ddc6ac8cd13fd3079e5600909cef5d0f6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\select.pyd
        • Size 27KB
        • SHA256 fcc2e09a2355a5546922874fb4cac92ee00a33c0ed6adbc440d128d1e9f4ec28
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        INSTALLER
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\setuptools-56.0.0.dist-info\INSTALLER
        • Size 4B
        • SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
        • MD5 SHA1 SHA512
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\sqlite3.dll
        • Size 1.4MB
        • SHA256 53aa551e62267b887017a95fe14a610c2bb3b53c4be62ddc4dc3548df3720a68
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\win32api.pyd
        • Size 132KB
        • SHA256 e10d19b35b220abf718bee0de4bf59ffa27d1b068c837934b3d5ba36329b8257
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        win32crypt.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI13962\win32crypt.pyd
        • Size 127KB
        • SHA256 0437bf5d5028f00f03564ee6686bf88c0e92924aa027df9f6a2c75d6dd09ac19
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/3112-1097-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1101-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1103-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1105-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1107-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1109-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1111-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1113-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1115-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1117-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1119-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1121-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1123-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1125-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1127-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1129-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1131-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1133-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1135-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1099-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1095-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1093-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1091-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1089-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1085-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1087-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1083-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1081-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1079-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1077-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1075-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1073-0x0000013915D20000-0x0000013915D21000-memory.dmp
        Download

        memory/3112-1072-0x0000013915D10000-0x0000013915D11000-memory.dmp
        Download