Analysis Overview
SHA256
204952415326609269ef56ab10511c20b4d6f1653c11d4a5b3dbd39f8e1d6770
Threat Level: Shows suspicious behavior
The file e57a39f9f446359bb6cfbd6fb34155d8_JaffaCakes118 was found to be: Shows suspicious behavior.
Malicious Activity Summary
Loads dropped DLL
Reads user/profile data of web browsers
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Unsigned PE
Detects Pyinstaller
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-04-07 17:32
Signatures
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-07 17:32
Reported
2024-04-07 17:35
Platform
win10v2004-20240226-en
Max time kernel
94s
Max time network
96s
Command Line
Signatures
Loads dropped DLL
Reads user/profile data of web browsers
Legitimate hosting services abused for malware hosting/C2
| Description | Indicator | Process | Target |
| N/A | pastebin.com | N/A | N/A |
| N/A | pastebin.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
| N/A | discord.com | N/A | N/A |
Looks up external IP address via web service
| Description | Indicator | Process | Target |
| N/A | api.ipify.org | N/A | N/A |
| N/A | api.ipify.org | N/A | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4168 wrote to memory of 384 | N/A | C:\Users\Admin\AppData\Local\Temp\e57a39f9f446359bb6cfbd6fb34155d8_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\e57a39f9f446359bb6cfbd6fb34155d8_JaffaCakes118.exe |
| PID 4168 wrote to memory of 384 | N/A | C:\Users\Admin\AppData\Local\Temp\e57a39f9f446359bb6cfbd6fb34155d8_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\e57a39f9f446359bb6cfbd6fb34155d8_JaffaCakes118.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\e57a39f9f446359bb6cfbd6fb34155d8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e57a39f9f446359bb6cfbd6fb34155d8_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\e57a39f9f446359bb6cfbd6fb34155d8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e57a39f9f446359bb6cfbd6fb34155d8_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | api.ipify.org | udp |
| US | 172.67.74.152:443 | api.ipify.org | tcp |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 152.74.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.197.17.2.in-addr.arpa | udp |
| US | 104.20.68.143:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | discord.com | udp |
| US | 162.159.136.232:443 | discord.com | tcp |
| US | 8.8.8.8:53 | 143.68.20.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.136.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 4.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 159.113.53.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.121.231.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 26.165.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 99.56.20.217.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 19.229.111.52.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI41682\python39.dll
| MD5 | 1d5e4c20a20740f38f061bdf48aaca4f |
| SHA1 | de1b64ab5219aa6fef95cd2b0ccead1c925fd0d0 |
| SHA256 | f8172151d11bcf934f2a7518cd0d834e3f079bd980391e9da147ce4cff72c366 |
| SHA512 | 9df64c97e4e993e815fdaf7e8ecbc3ce32aa8d979f8f4f7a732b2efa636cfeb9a145fe2c2dcdf2e5e9247ee376625e1fdc62f9657e8007bb504336ac8d05a397 |
C:\Users\Admin\AppData\Local\Temp\_MEI41682\VCRUNTIME140.dll
| MD5 | 18049f6811fc0f94547189a9e104f5d2 |
| SHA1 | dc127fa1ff0aab71abd76b89fc4b849ad3cf43a6 |
| SHA256 | c865c3366a98431ec3a5959cb5ac3966081a43b82dfcd8bfefafe0146b1508db |
| SHA512 | 38fa01debdb8c5369b3be45b1384434acb09a6afe75a50a31b3f0babb7bc0550261a5376dd7e5beac74234ec1722967a33fc55335b1809c0b64db42f7e56cdf7 |
C:\Users\Admin\AppData\Local\Temp\_MEI41682\base_library.zip
| MD5 | 89a5fd9e497fb50b9954a31311de56d7 |
| SHA1 | e2917226ea24a38651c920a68f56d078296310fb |
| SHA256 | a3694f2a9fbd6f5efe91b62e7c580f1600bcd5c5c24f739b5ef7f045ed89b9fb |
| SHA512 | 7105b126110fc2ef517ad8e506d6171f920501bce6b62b5dd6a82630e1775f18ff619c522f2e095c0259d7c4ed1dc5bd2432c77dc39ed7d6c8fef9d2b4764a43 |
C:\Users\Admin\AppData\Local\Temp\_MEI41682\_ctypes.pyd
| MD5 | 7322f8245b5c8551d67c337c0dc247c9 |
| SHA1 | 5f4cb918133daa86631211ae7fa65f26c23fcc98 |
| SHA256 | 4fcf4c9c98b75a07a7779c52e1f7dff715ae8a2f8a34574e9dac66243fb86763 |
| SHA512 | 52748b59ce5d488d2a4438548963eb0f2808447c563916e2917d08e5f4aab275e4769c02b63012b3d2606fdb5a8baa9eb5942ba5c5e11b7678f5f4187b82b0c2 |
C:\Users\Admin\AppData\Local\Temp\_MEI41682\libffi-7.dll
| MD5 | eef7981412be8ea459064d3090f4b3aa |
| SHA1 | c60da4830ce27afc234b3c3014c583f7f0a5a925 |
| SHA256 | f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081 |
| SHA512 | dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016 |
C:\Users\Admin\AppData\Local\Temp\_MEI41682\_socket.pyd
| MD5 | 478abd499eefeba3e50cfc4ff50ec49d |
| SHA1 | fe1aae16b411a9c349b0ac1e490236d4d55b95b2 |
| SHA256 | fdb14859efee35e105f21a64f7afdf50c399ffa0fa8b7fcc76dae4b345d946cb |
| SHA512 | 475b8d533599991b4b8bfd27464b379d78e51c41f497e81698b4e7e871f82b5f6b2bfec70ec2c0a1a8842611c8c2591133eaef3f7fc4bc7625e18fc4189c914e |
C:\Users\Admin\AppData\Local\Temp\_MEI41682\select.pyd
| MD5 | fed3dae56f7c9ea35d2e896fede29581 |
| SHA1 | ae5b2ef114138c4d8a6479d6441967c170c5aa23 |
| SHA256 | d56542143775d02c70ad713ac36f295d473329ef3ad7a2999811d12151512931 |
| SHA512 | 3128c57724b0609cfcaca430568d79b0e6abd13e5bba25295493191532dba24af062d4e0340d0ed68a885c24fbbf36b7a3d650add2f47f7c2364eab6a0b5faff |
C:\Users\Admin\AppData\Local\Temp\_MEI41682\_hashlib.pyd
| MD5 | 88e2bf0a590791891fb5125ffcf5a318 |
| SHA1 | 39f96abbabf3fdd46844ba5190d2043fb8388696 |
| SHA256 | e7aecb61a54dcc77b6d9cafe9a51fd1f8d78b2194cc3baf6304bbd1edfd0aee6 |
| SHA512 | 7d91d2fa95bb0ffe92730679b9a82e13a3a6b9906b2c7f69bc9065f636a20be65e1d6e7a557bfd6e4b80edd0f00db92eb7fea06345c2c9b98176c65d18c4bdbf |
C:\Users\Admin\AppData\Local\Temp\_MEI41682\libcrypto-1_1.dll
| MD5 | 89511df61678befa2f62f5025c8c8448 |
| SHA1 | df3961f833b4964f70fcf1c002d9fd7309f53ef8 |
| SHA256 | 296426e7ce11bc3d1cfa9f2aeb42f60c974da4af3b3efbeb0ba40e92e5299fdf |
| SHA512 | 9af069ea13551a4672fdd4635d3242e017837b76ab2815788148dd4c44b4cf3a650d43ac79cd2122e1e51e01fb5164e71ff81a829395bdb8e50bb50a33f0a668 |
C:\Users\Admin\AppData\Local\Temp\_MEI41682\_ssl.pyd
| MD5 | cf7886b3ac590d2ea1a6efe4ee47dc20 |
| SHA1 | 8157a0c614360162588f698a2b0a4efe321ea427 |
| SHA256 | 3d183c1b3a24d634387cce3835f58b8e1322bf96ab03f9fe9f02658fb17d1f8c |
| SHA512 | b171f7d683621fdab5989bfed20c3f6479037035f334ea9a19feb1184f46976095a7666170a06f1258c6ddf2c1f8bdb4e31cbfd33d3b8fa4b330f097d1c09d81 |
C:\Users\Admin\AppData\Local\Temp\_MEI41682\libssl-1_1.dll
| MD5 | 50bcfb04328fec1a22c31c0e39286470 |
| SHA1 | 3a1b78faf34125c7b8d684419fa715c367db3daa |
| SHA256 | fddd0da02dcd41786e9aa04ba17ba391ce39dae6b1f54cfa1e2bb55bc753fce9 |
| SHA512 | 370e6dfd318d905b79baf1808efbf6da58590f00006513bdaaed0c313f6fa6c36f634ea3b05f916cee59f4db25a23dd9e6f64caf3c04a200e78c193027f57685 |
C:\Users\Admin\AppData\Local\Temp\_MEI41682\_bz2.pyd
| MD5 | a991152fd5b8f2a0eb6c34582adf7111 |
| SHA1 | 3589342abea22438e28aa0a0a86e2e96e08421a1 |
| SHA256 | 7301fc2447e7e6d599472d2c52116fbe318a9ff9259b8a85981c419bfd20e3ef |
| SHA512 | f039ac9473201d27882c0c11e5628a10bdbe5b4c9b78ead246fd53f09d25e74c984e9891fccbc27c63edc8846d5e70f765ca7b77847a45416675d2e7c04964fc |
C:\Users\Admin\AppData\Local\Temp\_MEI41682\_lzma.pyd
| MD5 | cdd13b537dad6a910cb9cbb932770dc9 |
| SHA1 | b37706590d5b6f18c042119d616df6ff8ce3ad46 |
| SHA256 | 638cd8c336f90629a6260e67827833143939497d542838846f4fc94b2475bb3e |
| SHA512 | c375fb6914cda3ae7829d016d3084f3b5b9f78f200a62f076ec1646576f87694eec7fa6f1c99cbe30824f2fe6e2d61ecdeb50061383b12143cd2678004703199 |
C:\Users\Admin\AppData\Local\Temp\_MEI41682\unicodedata.pyd
| MD5 | cd12c15c6eef60d9ea058cd4092e5d1b |
| SHA1 | 57a7c0b0468f0be8e824561b45f86e0aa0db28dd |
| SHA256 | e3ab6e5749a64e04ee8547f71748303ba159dd68dfc402cb69356f35e645badd |
| SHA512 | 514e76174f977cc73300bc40ff170007a444e743a39947d5e2f76e60b2a149c16d57b42b6a82a7fea8dd4e9addb3e876d8ab50ea1898ee896c1907667277cf00 |
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-07 17:32
Reported
2024-04-07 17:35
Platform
win7-20240215-en
Max time kernel
117s
Max time network
119s
Command Line
Signatures
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\e57a39f9f446359bb6cfbd6fb34155d8_JaffaCakes118.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1924 wrote to memory of 2540 | N/A | C:\Users\Admin\AppData\Local\Temp\e57a39f9f446359bb6cfbd6fb34155d8_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\e57a39f9f446359bb6cfbd6fb34155d8_JaffaCakes118.exe |
| PID 1924 wrote to memory of 2540 | N/A | C:\Users\Admin\AppData\Local\Temp\e57a39f9f446359bb6cfbd6fb34155d8_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\e57a39f9f446359bb6cfbd6fb34155d8_JaffaCakes118.exe |
| PID 1924 wrote to memory of 2540 | N/A | C:\Users\Admin\AppData\Local\Temp\e57a39f9f446359bb6cfbd6fb34155d8_JaffaCakes118.exe | C:\Users\Admin\AppData\Local\Temp\e57a39f9f446359bb6cfbd6fb34155d8_JaffaCakes118.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\e57a39f9f446359bb6cfbd6fb34155d8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e57a39f9f446359bb6cfbd6fb34155d8_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\e57a39f9f446359bb6cfbd6fb34155d8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e57a39f9f446359bb6cfbd6fb34155d8_JaffaCakes118.exe"
Network
Files
C:\Users\Admin\AppData\Local\Temp\_MEI19242\python39.dll
| MD5 | 1d5e4c20a20740f38f061bdf48aaca4f |
| SHA1 | de1b64ab5219aa6fef95cd2b0ccead1c925fd0d0 |
| SHA256 | f8172151d11bcf934f2a7518cd0d834e3f079bd980391e9da147ce4cff72c366 |
| SHA512 | 9df64c97e4e993e815fdaf7e8ecbc3ce32aa8d979f8f4f7a732b2efa636cfeb9a145fe2c2dcdf2e5e9247ee376625e1fdc62f9657e8007bb504336ac8d05a397 |