Malware Analysis Report

2025-05-05 21:13

Sample ID 240626-xgdydazhrl
Target 1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118
SHA256 f521eee35382eadea679292fb9ce11bb20563017f16af425bd80475250ddaf7c
Tags
pyinstaller
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

f521eee35382eadea679292fb9ce11bb20563017f16af425bd80475250ddaf7c

Threat Level: Shows suspicious behavior

The file 1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

pyinstaller

Loads dropped DLL

Detects Pyinstaller

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-26 18:49

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-26 18:49

Reported

2024-06-26 18:51

Platform

win7-20240611-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe"

Network

N/A

Files

C:\Users\Admin\AppData\Local\Temp\_MEI15482\python39.dll

MD5 c4b75218b11808db4a04255574b2eb33
SHA1 f4a3497fb6972037fb271cfdc5b404a4b28ccf07
SHA256 53f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2
SHA512 0b7ddbe6476cc230c7bdd96b5756dfb85ab769294461d1132f0411502521a2197c0f27c687df88a2cd1ab53332eaa30f17fa65f93dac3f5e56ed2b537232e69c

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-26 18:49

Reported

2024-06-26 18:51

Platform

win10v2004-20240508-en

Max time kernel

136s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1309c5d2c314d3a0edb6e5b32e6e5c20_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 _mongodb._tcp.cluster0.fspkz.mongodb.net udp
US 8.8.8.8:53 _mongodb._tcp.cluster0.fspkz.mongodb.net udp
US 8.8.8.8:53 _mongodb._tcp.cluster0.fspkz.mongodb.net udp
US 8.8.8.8:53 _mongodb._tcp.cluster0.fspkz.mongodb.net udp
US 8.8.8.8:53 _mongodb._tcp.cluster0.fspkz.mongodb.net udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI6442\python39.dll

MD5 c4b75218b11808db4a04255574b2eb33
SHA1 f4a3497fb6972037fb271cfdc5b404a4b28ccf07
SHA256 53f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2
SHA512 0b7ddbe6476cc230c7bdd96b5756dfb85ab769294461d1132f0411502521a2197c0f27c687df88a2cd1ab53332eaa30f17fa65f93dac3f5e56ed2b537232e69c

C:\Users\Admin\AppData\Local\Temp\_MEI6442\VCRUNTIME140.dll

MD5 7942be5474a095f673582997ae3054f1
SHA1 e982f6ebc74d31153ba9738741a7eec03a9fa5e8
SHA256 8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c
SHA512 49fbc9d441362b65a8d78b73d4fdcf988f22d38a35a36a233fcd54e99e95e29b804be7eabe2b174188c7860ebb34f701e13ed216f954886a285bed7127619039

C:\Users\Admin\AppData\Local\Temp\_MEI6442\_ctypes.pyd

MD5 b74f6285a790ffd7e9ec26e3ab4ca8df
SHA1 7e023c1e4f12e8e577e46da756657fd2db80b5e8
SHA256 c1e3e9548243ca523f1941990477723f57a1052965fccc8f10c2cfae414a6b8a
SHA512 3a700638959cbd88e8a36291af954c7ccf00f6101287fc8bd3221ee31bd91b7bd1830c7847d8c2f4f07c94bc233be32a466b915283d3d2c66abed2c70570c299

C:\Users\Admin\AppData\Local\Temp\_MEI6442\base_library.zip

MD5 f8eda484fbec92a1da30fe2ad05c21d1
SHA1 2ee8ef15c8418a0584bbb8f84b3c9fbb1aef2b0c
SHA256 144c88df1138b6afd14025e81f4e5097187e6dadf9a61cebf2af635066b2638e
SHA512 c5a26c9bab14807d05587eb634ad82f0c24b9edafb88b4cd70c65190a975f06d1ec484a4d475850a0e4860a9ea38a81bbb3fe7b2af6adf880ff89a0654a18666

C:\Users\Admin\AppData\Local\Temp\_MEI6442\libffi-7.dll

MD5 eef7981412be8ea459064d3090f4b3aa
SHA1 c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512 dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

C:\Users\Admin\AppData\Local\Temp\_MEI6442\_socket.pyd

MD5 0df2287791c20a764e6641029a882f09
SHA1 8a0aeb4b4d8410d837469339244997c745c9640c
SHA256 09ab789238120df329956278f68a683210692c9bcccb8cd548c771e7f9711869
SHA512 60c24e38ba5d87f9456157e3f4501f4ffabce263105ff07aa611b2f35c3269ade458dbf857633c73c65660e0c37aee884b1c844b51a05ced6aed0c5d500006de

C:\Users\Admin\AppData\Local\Temp\_MEI6442\select.pyd

MD5 a2a4cf664570944ccc691acf47076eeb
SHA1 918a953817fff228dbd0bdf784ed6510314f4dd9
SHA256 b26b6631d433af5d63b8e7cda221b578e7236c8b34b3cffcf7630f2e83fc8434
SHA512 d022da9e2606c5c3875c21ba8e1132ad8b830411d6ec9c4ddf8ebd33798c44a7e9fe64793b8efb72f3e220bb5ce1512769a0398ecc109f53f394ea47da7a8767

C:\Users\Admin\AppData\Local\Temp\_MEI6442\_uuid.pyd

MD5 1c76a51dd15102e04b95ce6f53c28ec3
SHA1 57897767fcdad111171ccaf9e6cf581fd968fab5
SHA256 cb195b5aae6a7969174e8c7c6f9e2b40683190f6b4e410233022df1b6dade731
SHA512 f39668a7683f22c8baede141c3e0624c90a2fd8ade92ac4aa2950090dfdf02e611af998caad3de783f215877b8951f8b22afaef3b2b0bcce7e294eb70d176e55

C:\Users\Admin\AppData\Local\Temp\_MEI6442\bson\_cbson.cp39-win_amd64.pyd

MD5 0208d6b687e9b5e2e8450040e46ad2c5
SHA1 42cefa5f7211d287a892b14cf66638567b6a0eac
SHA256 e02a9a237b595c63eefc514ad8e6ba340b8e15c1166c5a2a60dfa28ec3ef3b13
SHA512 63defcce904cbea140550986333f70851666d7f3b5b6e62514ab88cb1dbcfc86b1de53c0de2c21f706e2477adbfadeb5f209b2d90a12450735bbc5aadec1ae5b

C:\Users\Admin\AppData\Local\Temp\_MEI6442\_decimal.pyd

MD5 56302e90bc4fb799e094987f4556fc0f
SHA1 3ddb8b77676545905aadef5ba73583c4b904824b
SHA256 17f43bf9552fcf8194f4b32909beffa4238b76866f7dd50f4b70de799362f66c
SHA512 af962aeef8052f5a90855ce0fd6c99862a8a72f649331896737d57d67ccd400f92aec12f5ab958fb08ff101b606a82fe0cd307287616297a37e4532fa5fe657b

C:\Users\Admin\AppData\Local\Temp\_MEI6442\_hashlib.pyd

MD5 60f420a9a606e2c95168d25d2c1ac12e
SHA1 1e77cf7de26ed75208d31751fe61da5eddbbaf12
SHA256 8aa7abe0a92a89adf821e4eb783ad254a19858e62d99f80eb5872d81e8b3541c
SHA512 aaf768176cf034004a6d13370b11f0e4bbf86b9b76de7fa06d0939e98915607d504e076ad8adb1a0ebfb6fd021c51764a772f8af6af7f6d15b0d376448aba1a7

C:\Users\Admin\AppData\Local\Temp\_MEI6442\libcrypto-1_1.dll

MD5 cc4cbf715966cdcad95a1e6c95592b3d
SHA1 d5873fea9c084bcc753d1c93b2d0716257bea7c3
SHA256 594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1
SHA512 3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

C:\Users\Admin\AppData\Local\Temp\_MEI6442\unicodedata.pyd

MD5 5753efb74fcb02a31a662d9d47a04754
SHA1 e7bf5ea3a235b6b661bf6d838e0067db0db0c5f4
SHA256 9be2b4c7db2c3a05ec3cbd08970e622fcaeb4091a55878df12995f2aeb727e72
SHA512 86372016c3b43bfb85e0d818ab02a471796cfad6d370f88f54957dfc18a874a20428a7a142fcd5a2ecd4a61f047321976af736185896372ac8fd8ca4131f3514

C:\Users\Admin\AppData\Local\Temp\_MEI6442\libssl-1_1.dll

MD5 bc778f33480148efa5d62b2ec85aaa7d
SHA1 b1ec87cbd8bc4398c6ebb26549961c8aab53d855
SHA256 9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843
SHA512 80c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173

C:\Users\Admin\AppData\Local\Temp\_MEI6442\pymongo\_cmessage.cp39-win_amd64.pyd

MD5 7aa0e8fac7fe6d91fc988abc47d012b2
SHA1 1f820cf0191b152ee4fab333401ad99417ad3a28
SHA256 dd1db47d5e4c1869ea8bfeaf6dba79cff02570e05010d41de007700d7dc58ba3
SHA512 37beb9c5fee53d036a96a0a013e5fc4215ba6986f204fa05aaa5ebd6f3095125c3bacc5f4d085f873a955d7dbff722c3ded42599fbeaea0cee3873407db7e679

C:\Users\Admin\AppData\Local\Temp\_MEI6442\_ssl.pyd

MD5 66172f2e3a46d2a0f04204d8f83c2b1e
SHA1 e74fee81b719effc003564edb6b50973f7df9364
SHA256 2b16154826a417c41cda72190b0cbcf0c05c6e6fe44bf06e680a407138402c01
SHA512 123b5858659b8a0ac1c0d43c24fbb9114721d86a2e06be3521ad0ed44b2e116546b7b6332fd2291d692d031ec598e865f476291d3f8f44131aacc8e7cf19f283

C:\Users\Admin\AppData\Local\Temp\_MEI6442\_queue.pyd

MD5 34537f5b9da004c623a61911e19cbee5
SHA1 9d78f6cd2960c594ec98e837d992c08751c61d51
SHA256 a7cdedaa58c7ba9aba98193fce599598d2cd35ed9c80d1ad7fc9e6182c9a25d5
SHA512 70bf8e8e3216050e8519b683097e958f1fcba60333eb1f18e3736bbcc195d0fad6657b24e4c3902d24b84a462c35a560eb4c7b8a15f7123249c0770143b67467