Overview

overview

7

Static

static

3

f1e877e1f7...18.exe

windows7-x64

7

f1e877e1f7...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15/04/2024, 20:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    f1e877e1f7aebcc4c8a2cd94b8a81f89_JaffaCakes118.exe

  • Size

    5.9MB

  • MD5

    f1e877e1f7aebcc4c8a2cd94b8a81f89

  • SHA1

    e9e719c9c16bbc20dbee60a69088e233a421327a

  • SHA256

    221a5b95dd3236b9d815b57720fb8f70e5e2d8054638ce7073a2ecc273111d8d

  • SHA512

    a5d190adb55e00e131dd921e2919b07313409637a06581a537ee5699ec6e7c71243b8079495b50144a1a2e84a2fc7a3bee5dec3909349bd7a06f6138ca3d8d1c

  • SSDEEP

    98304:wE78kTwWzk8J2tX2trsikqhVDZNbgcNwjmk52Mt6Rq5Wpnz2r2ZF9uJkMJtFucx6:R713Y8J2tMDzBiikjt+pz2r2RPwtFucU

Score
7/10
spywarestealer

Malware Config

Signatures

  • Loads dropped DLL 30 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f1e877e1f7aebcc4c8a2cd94b8a81f89_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f1e877e1f7aebcc4c8a2cd94b8a81f89_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Users\Admin\AppData\Local\Temp\f1e877e1f7aebcc4c8a2cd94b8a81f89_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\f1e877e1f7aebcc4c8a2cd94b8a81f89_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:2440

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\VCRUNTIME140.dll
          Filesize

          85KB

          MD5

          89a24c66e7a522f1e0016b1d0b4316dc

          SHA1

          5340dd64cfe26e3d5f68f7ed344c4fd96fbd0d42

          SHA256

          3096cafb6a21b6d28cf4fe2dd85814f599412c0fe1ef090dd08d1c03affe9ab6

          SHA512

          e88e0459744a950829cd508a93e2ef0061293ab32facd9d8951686cbe271b34460efd159fd8ec4aa96ff8a629741006458b166e5cff21f35d049ad059bc56a1a

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\_bz2.pyd
          Filesize

          86KB

          MD5

          4db72d9f4200a50f2cd0badbe533b2e2

          SHA1

          2b7c7d62616b4f0fd0f21e28a07776f6607b757d

          SHA256

          4555efd8bcfcf2c6ab54056f46353db1df2ebafd4239d93dd7919112d13af495

          SHA512

          b43460a7b19892067b16b8bd7154693a8a97809e8350e639c3fce48c6c647fffaf1edca6ae9d06bb24de4a288c841a7e80df7ae2613bc3819b925358d3671e41

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\_hashlib.pyd
          Filesize

          31KB

          MD5

          b4cb7f858527356846040181dffbea18

          SHA1

          4cb330128ab5e105f4ab195ef29a74f7e00de3af

          SHA256

          843063a9fba313762e0734068440d102a556581ea9570f02cf194b107202bdd1

          SHA512

          d70701a42c3766455e9bdc57f45ba26dcda05c851bab87049e5bb4aad2dbdc5708649658d274424906c1626166df4f73caf6807e803fbddea6eb946ee9317730

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\_lzma.pyd
          Filesize

          164KB

          MD5

          30cb2b55e2d16591824080b3bb1919ef

          SHA1

          508c41469bc2ff9d414e9b21b626b1f7d1a70d22

          SHA256

          258a4af3b514f0dae9b615018acb328995d07784ba35f8daa16715f7226babe7

          SHA512

          f5b8c9b87c87e6ceb71cc35c7e86ecf93187540468df5c6d78827fb8e15626ace3e9adc6d19dffed62e377768a5da58d253dbbbd702f4cb4f64e187f7d06fbea

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\_socket.pyd
          Filesize

          69KB

          MD5

          e6367c28ebafffcf3818cd932077c6bf

          SHA1

          0846f32da3ea76b41be7bb64aa7cc93ef0d62a24

          SHA256

          0a9331bfa936a5db7772630f5ef920a8082bc7479472804588d5251019940ec4

          SHA512

          44fc8776ea77805cc4fb7ed838b636775c07d15a1a8e919e01071f6aa621000b8ba260a2fe7b82f2c2dd1e9a618e28a17cba58b3904efc159f0d3c9b70d9bd8c

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\_ssl.pyd
          Filesize

          111KB

          MD5

          0f0e0a092f43768fdcdef1cfe1f37921

          SHA1

          2277cb31fccd97cea5fcc1047d78a4a6b3dbbcc3

          SHA256

          2193f5efab7f69a96d6342100a91bc6195389c77862060270e6a751e3ae19031

          SHA512

          b732f72d7dadc255d04706028384a3333bcbd89d4feee896c2f636b7e26a1a7eab797700bc0db313e282916dc6648ca92115e92038cb34a907d33aa786c27bd2

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\api-ms-win-core-file-l1-2-0.dll
          Filesize

          8KB

          MD5

          6803628b71ff81ed3a6ba1e5036ce93a

          SHA1

          c042b0cabf9c95f1f6dc8fd7094ddf2a113a90c0

          SHA256

          8dc40cad7c57c998863d8112067c29cd41dcaa7ba58b13646a28e6fd3f787bc7

          SHA512

          4503a4c8b474f2f5458304238ba02d8f3da429137bf823ec952c24df32596dfd8f65931299808cea9f5ee1399452dd41952fe4143789ab3097bfdeca1fb75aa0

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\api-ms-win-core-file-l2-1-0.dll
          Filesize

          8KB

          MD5

          3e35ce8389e3e54cefcbc19d238097a1

          SHA1

          8d902c91bc03c517bc4ef0397dd27e7ff3e1ca62

          SHA256

          abcf8a288858e602078e51e6e837b78c360637976debee6dba1425220f642acb

          SHA512

          ddf1757c750465975f746ab4f35bacf7254432cb866fdfbf7cff3ff16d47462e9bfd5f3b3c4587a1dfcc24e1bdffc55ba05e9ab8be4483de125dd278119486ef

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\api-ms-win-core-localization-l1-2-0.dll
          Filesize

          11KB

          MD5

          d00a8c302b88c6f1d156bdae8756dc73

          SHA1

          b62df862999abd897b70ecce19e9e122552bfd4a

          SHA256

          63887362bf0ab880112f75b897db9525e73ddbd101fa0d79063e012264aa5518

          SHA512

          1e03fd4b90a7682581d83c59aca6790280677fb7953acf0b627dbecc03ee4ce01ce666519eb8718eb0ebb963d9ab61464c0a450dee401fed2c36c24ff6ea2cd8

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\api-ms-win-core-processthreads-l1-1-1.dll
          Filesize

          9KB

          MD5

          0ca31d9ef5b69f0068ad6455faa2dfa7

          SHA1

          b1b9065f57aaf79a0aafc22106a573c555fc4b6d

          SHA256

          7814e719d493c31960dde586924d9db7e428cf53a789f357e8341ba8e536691a

          SHA512

          866155eb136b2eec3f9d51b88d00c91a2d5580bd44bb04166fdd52560cc4ea4f20ae4cdb1dd0d28227dadbda181de56dc842d02bb4002d927d39b2f5f1c56328

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\api-ms-win-core-timezone-l1-1-0.dll
          Filesize

          9KB

          MD5

          042bf967e64e2245b57759c6d9d817d1

          SHA1

          aed3018f94a0e6bfabbdd944956b13c4d96d0884

          SHA256

          6c48995abc03fe6acf50287f2edffd62ebcf3239c9fe71656267b650b0dda1fc

          SHA512

          da4aebe4685f304faf8705594b1f63c82b32aa0c5f1bce3a3bcddeec0fd0a317286a3a97e67f05ce43464627d51e10b390e1f8146298e2a0feca73211e5c8c1d

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\api-ms-win-crt-conio-l1-1-0.dll
          Filesize

          9KB

          MD5

          56ea62455ae54539ee7dba3933b324d1

          SHA1

          f5a4f8af4ee90572b2a8f617f1dbe6ab1c7c0a62

          SHA256

          41d3f6db68409f076a20faf032f5d404a117a01f9f5db5551c149e52426b7f04

          SHA512

          ab814258eb2f581f1d270e49edcb16dea0a6684f03970744d7f8b910c878f80e47884178abf43b8222abf57b57e6ddc58c9717967cd5b0cabdc996b705495ac4

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\api-ms-win-crt-convert-l1-1-0.dll
          Filesize

          12KB

          MD5

          0102cf1eb293bfdf1f4af8a602af365c

          SHA1

          9d773b3069c40978296f6e7062aa1f32ee33c3c7

          SHA256

          49d47f99ffc7cc469ea6adea065fe5dc4fb8347741683e7664673d967299e915

          SHA512

          3ef06e3fa44a7baa2a04045519a35f496ae1700d43a46ac0a37d66fb6bd12bbbf414ee0baf54127ae9b12d000d1f2ebc5d04d00acc4604d61d1c203466700af6

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\api-ms-win-crt-environment-l1-1-0.dll
          Filesize

          9KB

          MD5

          953642aa40d6ccc60542fa33bf0bfc06

          SHA1

          52d8a898abbbafc5f48c6610d11556a5f2feb53c

          SHA256

          62e6100442bc27a3848470722118693843db773cfe6f0de0811704316935e23e

          SHA512

          f544e7b870d24cc8171e0a700d5173eb53f7053db867ee7eaf5a87ada64ff6ac4478e3ec1ad6a112d79b7662e8d8ddec1b731228ad967c0c1d10f9f789a40f03

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\api-ms-win-crt-filesystem-l1-1-0.dll
          Filesize

          10KB

          MD5

          be1b3b1038b5437ec6566b8401fea534

          SHA1

          a48107665d34154cb52e8ddee7ac3406a372bc40

          SHA256

          5bb02db9a50f4435716403437921540b010eb835e98c3febf46942943a5564fc

          SHA512

          4df8c6353ed6bf6c1f7e3e5496a17f29ab4920fd76efd8ed3cf6043d59ccbd1db12f0bfb6801fdf327e2a033da7bbeac60586367feb461a16142b0d40ef1c1cc

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\api-ms-win-crt-heap-l1-1-0.dll
          Filesize

          9KB

          MD5

          17c3a7c444a7565680c21e944c5cb1ad

          SHA1

          f24983b4eeab6735f05996d7818a3ab3d8180b00

          SHA256

          13ba665dfaaeee0bb9226d48ca6ab017edf7d4d93d0f165c3f90757b2483e097

          SHA512

          d0551eb73cdb4703874b1645c36182c6218331d1229f6f2f66c695092adf5c289d2256f8d35909850d43e4a7d3f22b8c0be7cd344ce06e9d1ca1716ccaae8bd0

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\api-ms-win-crt-locale-l1-1-0.dll
          Filesize

          9KB

          MD5

          0ad77b5c53142621d2c93be23aa223d2

          SHA1

          5ed3b06982d53aa9736bead146a2af6376508bcb

          SHA256

          4cc5f546ed08a26d46a1c1d4d020d2663ce0a70fc6d93b16cc6685ad1fc33e32

          SHA512

          4901cfdd5033f21c18ae2f81ea2125cf1a4c686b2da8157024f6ea05d0c3f9a01b212f43eb4bd31addc2bb20a9ab6bf60a25f3599a95a1e8df462de6f147d012

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\api-ms-win-crt-math-l1-1-0.dll
          Filesize

          17KB

          MD5

          336d49f991206e2fed501344580e01f0

          SHA1

          9ce55e7b794b1f40d6224c093dd8481b53f7e123

          SHA256

          182b1591af16bfe473b6f6c65daefd5faebf7de2af20c59564bf62eeebcda6ef

          SHA512

          6c828a0491414f3cf23252aef43afc9af4419d5b4bcdee44c4f7e9f2bd8f2afb628600472a1ae12ce159ae6503cae3ed18aef94c153c3653d45997efc0e1e960

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\api-ms-win-crt-process-l1-1-0.dll
          Filesize

          9KB

          MD5

          6ac2251cb8cb4756c253bcc7b4e7ba8e

          SHA1

          18a00fb12f662a1b39508b08171f1a2fe5bdcb77

          SHA256

          0d5972aab31b3cc4f90638cb0b1dea90e4ddc9b8b50f7c0022db169ffd467a67

          SHA512

          5691845d792a6b45ca19de7a7f08296941728043a76af7175c7f8e0aa92fe8ce8c49719032eb533d54ffcceb5f2bac16529b83fe357a1420ceb8713e4c3811c0

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\api-ms-win-crt-runtime-l1-1-0.dll
          Filesize

          13KB

          MD5

          60c1c728c6920895fbefdbc75d87c6c1

          SHA1

          acf74ac408e08874467e7df307a34a44d30dd3d9

          SHA256

          4440e00d220418b4a11d595996f62ed132eeff6cf5a59c5cfe51b06ff80d1a65

          SHA512

          070a49119634f2e29410da102326d447f7fee90ab7e187f599e8c5244debde9ed2b102a901cab03e6ab9af190279c9be8abc7cb10394861a12d82e0a7f9e8118

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\api-ms-win-crt-stdio-l1-1-0.dll
          Filesize

          14KB

          MD5

          6e3268a4d57f7f4c09d7391d7cab2438

          SHA1

          22378b710b3d3774fd6ce123d905c14e7ffb374c

          SHA256

          3f57a17e96a0ab75b1508319c14e7639de4214082ef5e7f4a95391bb9d5be564

          SHA512

          cf399e0621480f0dffaf655b4058935625a2acb173a4d4cd66a46654353c1b292286bdd447460368d4e0c9cf05b1a9897c2ca38d17b8ff43d95396a94fe2c4e6

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\api-ms-win-crt-string-l1-1-0.dll
          Filesize

          14KB

          MD5

          f945e6d31503b6b292b52b04b146e8a8

          SHA1

          fba33653120ae523708b509183dc4972a59a8b61

          SHA256

          9c3e4fe9b157f47cc9266e9c7034164e88f1d8ddab3873747615738de5393c43

          SHA512

          2ab882968e0ecd6bc268fdd95c4d9ce1097dbdab4d65a6ced31918076c8f664411b51ee86bd1ec40d00f640341f56cc8c5c2921747953735eff386312876fa54

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\api-ms-win-crt-time-l1-1-0.dll
          Filesize

          11KB

          MD5

          747305acb0468aea993eb8a0b46058ab

          SHA1

          3ebdcded74e078673385ce3002cee3c498065ecc

          SHA256

          4be80ebd627a67b4a6cc225f43ffa1b84932fd2fd427000fda3daa68a0d95b37

          SHA512

          8741a6c2f83f4b4f2be0b52150f34292c12ee7368a0b1c057a728de78dcf3021eea48b44f79c5369becb00b98ce1cef493a2a1b777d23e0a35024b8bc14e5675

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\api-ms-win-crt-utility-l1-1-0.dll
          Filesize

          9KB

          MD5

          8003ebb9617b13b35e16587cadb47583

          SHA1

          c20ec9425bd3fb30a41e6069ab077830181e7648

          SHA256

          eceeec26c107a79a22737576af7ce608677fbfbaabd6833fc68eb7d69acf3c7b

          SHA512

          58d81cc1ad6ec77bab1093b8cf572c4e3dc0b3ebf79a67034b490af9d693e5b47ae0dc0977e4d7f717307609e45edbd221dae45ef45f0a24e9b954f0e0fb81fc

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\base_library.zip
          Filesize

          760KB

          MD5

          a0f3e66e12989d9d22febad71dc76b1d

          SHA1

          94176e6ad27fa5fd79fb1732592956cc60f297a8

          SHA256

          3398c3f39fcef78039c4e50151c1c237080ad1314fd9ef911246152a097048cc

          SHA512

          2b551dae43b291c5e3ae31d66c805bb970ce96412228a864308fd48d392bc2a109c9457e9b9d2b4ea2ed70bcd5c4e169f1b01f97f0446fe2444c88b10fb76d53

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\libcrypto-1_1.dll
          Filesize

          2.6MB

          MD5

          c8f9d8b0921abfd134a22338fafef95b

          SHA1

          0df2bc02df6e0f7fdcc980701fdce123c97f6650

          SHA256

          3dc6c950f89a9472b07a0a36bb068a9c8c72274047f766d517209f2812eaed32

          SHA512

          c5efd278f1fb5841eae238759375fd329a10633c702279e2f7db9346daf3749c28010015cc5dee32cd391e04eb8d5d15dab8462bc6c15c9d8b8853682c2e7006

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\libssl-1_1.dll
          Filesize

          641KB

          MD5

          53096e65680650878945f573b7c44126

          SHA1

          c21b202fd3e04decb2be924935d5c1aacad1f2c7

          SHA256

          3edac6204ddd6dedd62cdb62044af9de0aaa52519082c70b50235d93c673e963

          SHA512

          5eab31c189bfc30c82e5816f1bc72dad58832285a5d744a99697b808566fcebe1b2948f4f60bd17451273497d09aa5d345ff7ab8211eada56ecdda8850d16451

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\python37.dll
          Filesize

          4.1MB

          MD5

          653a23393ab21668909d72333044ca86

          SHA1

          8ccbd6ac42e51cb6136c24aa17e3f09f55ad1d0e

          SHA256

          50e436c655583dc74c69e048fdd421f68ba6223f93a5952150bc9457229492cc

          SHA512

          3f035b0daf072b8495382569e4cf5f89c7e9181caf520e8c2df9f822e19b13232eccc374c89e778bf68dd851455a0f6c4048e8d9f47f06d31a47bbf26d75cff9

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\select.pyd
          Filesize

          20KB

          MD5

          00d2624d8b01b00ebe36672dd0d93413

          SHA1

          ba22326a9dbe2a3034de50be0edcd8fc0fb151d1

          SHA256

          07609c556ef490f7ae463dabf7a79d38be9e91bcc36c0a7078edca7370860b90

          SHA512

          57e860fc72e403b10220f5663a87ffc7cbfcfad62d558dadde92f1e4277787fc593686ee71ecd87e93be8f7d35daf4982a585055256a9ff1c28d099c8b2e727e

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\ucrtbase.dll
          Filesize

          983KB

          MD5

          16f76e4b80c72f545f5a14eb03569cb8

          SHA1

          cd725370ab7526e98d8ddc1297a21bc0fa3d105a

          SHA256

          29b514aaad1d6dc2e2a7363f3e1c091104840d5028eb5108f7fdff785721e305

          SHA512

          b49960072e42f28ee8493388f3d2320535a6bc49d6f4abc61c869c888cd6fe166818c579713b12eb62bd955c44688b0bd9c49f443122b79721927834c33cc995

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\_MEI22202\unicodedata.pyd
          Filesize

          1.0MB

          MD5

          9c13f83277a9fba55d934d58a87d0e75

          SHA1

          aff1d7ebdfa9217f23c89ee91923c7667c265f60

          SHA256

          f34e7790f01e731ef8dc4414efc7713253ff71b09adcb9405d6d5b9b63309d29

          SHA512

          60892c5dd69e61cf66b6c1ce8715081861f53281ac758441fa5a5423f4956a315e048b0981db9cdcac8c5405f963837b2b18183456c34e5028e6e5e887681fff

          Download Submit