b0fed4389252d32c6f05f90cc0579109cb57244c3bab5981c5b215e916f5a39d

Analysis

max time kernel
79s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2024 09:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2576dfb1d2f7b75f35e05945a932168b_JaffaCakes118.exe
Size

6.7MB
MD5

2576dfb1d2f7b75f35e05945a932168b
SHA1

8e49076776745f48d256bf73ca2a5ed9a864a0c1
SHA256

b0fed4389252d32c6f05f90cc0579109cb57244c3bab5981c5b215e916f5a39d
SHA512

038386aa23d64d765ebdad9c6c6be74b9ec1b8673d51c3b4c63afb9e6f59c92d91d60585e2a319b99d254c66a6cbbf51826fbbbf7a4943c0849c419f4fea4ad1
SSDEEP

196608:mWx75GoVSmQM1Xxco53ut+bxFzn+ZvGPdZ4bJ:mq5bSmn1hco53uy7suf4

Score

7^/10

persistence pyinstaller

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4132	PIXELW~1.EXE
2700	PIXELW~1.EXE

Loads dropped DLL 11 IoCs

pid	Process
2700	PIXELW~1.EXE
2700	PIXELW~1.EXE
2700	PIXELW~1.EXE
2700	PIXELW~1.EXE
2700	PIXELW~1.EXE
2700	PIXELW~1.EXE
2700	PIXELW~1.EXE
2700	PIXELW~1.EXE
2700	PIXELW~1.EXE
2700	PIXELW~1.EXE
2700	PIXELW~1.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2576dfb1d2f7b75f35e05945a932168b_JaffaCakes118.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x00080000000233b1-5.dat	pyinstaller

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 4132	3412	2576dfb1d2f7b75f35e05945a932168b_JaffaCakes118.exe	81
PID 3412 wrote to memory of 4132	3412	2576dfb1d2f7b75f35e05945a932168b_JaffaCakes118.exe	81
PID 4132 wrote to memory of 2700	4132	PIXELW~1.EXE	82
PID 4132 wrote to memory of 2700	4132	PIXELW~1.EXE	82
PID 2700 wrote to memory of 4032	2700	PIXELW~1.EXE	83
PID 2700 wrote to memory of 4032	2700	PIXELW~1.EXE	83

C:\Users\Admin\AppData\Local\Temp\2576dfb1d2f7b75f35e05945a932168b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2576dfb1d2f7b75f35e05945a932168b_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PIXELW~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PIXELW~1.EXE
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PIXELW~1.EXE
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PIXELW~1.EXE
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Windows\SYSTEM32\reg.exe
      reg export HKEY_CURRENT_USER\Software\Kukouri\ C:\WindowsData\WindowsData.reg
      4⤵
      PID:4032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\PIXELW~1.EXE

Filesize
6.6MB

MD5
313df5aceb230b4c965e64e02062ef91

SHA1
77dc1a0e5728484bb895d48e44118d6ee31ba215

SHA256
39eafcab69e742820ae2c9cefa1d940c359f8dd47ec22a1529137244fa190cce

SHA512
39491527097a3def03fb7cf2856c95ef31fe9b956b8dfe9e956eebfbde77245d48e7d8cae3d8f53b7f10a24687a915d61d87737d35bde31a9dff453e00eb7d1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41322\VCRUNTIME140.dll

Filesize
94KB

MD5
11d9ac94e8cb17bd23dea89f8e757f18

SHA1
d4fb80a512486821ad320c4fd67abcae63005158

SHA256
e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e

SHA512
aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41322\_ctypes.pyd

Filesize
123KB

MD5
7ab242d7c026dad5e5837b4579bd4eda

SHA1
b3ff01b8b3da2b3a9c37bfffafc4fb9ee957cc0f

SHA256
1548506345d220d68e9089b9a68b42a9d796141eb6236e600283951cb206eaa1

SHA512
1dd09cf14c87f60b42e5e56d0104154513902c9bfa23eef76a92f4a96c2356b2812dd6eee5e9a74d5ed078ade5f8f6d1f1b01961d7efadfebb543d71c2d31a30

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41322\_hashlib.pyd

Filesize
64KB

MD5
ae32a39887d7516223c1e7ffdc3b6911

SHA1
94b9055c584df9afb291b3917ff3d972b3cd2492

SHA256
7936413bc24307f01b90cac2d2cc19f38264d396c1ab8eda180abba2f77162eb

SHA512
1f17af61c917fe373f0a40f06ce2b42041447f9e314b2f003b9bd62df87c121467d14ce3f8e778d3447c4869bf381c58600c1e11656ebda6139e6196262ae17e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41322\_socket.pyd

Filesize
78KB

MD5
4b2f1faab9e55a65afa05f407c92cab4

SHA1
1e5091b09fc0305cf29ec2e715088e7f46ccbbd4

SHA256
241db349093604ab25405402ba8c4212016657c7e6a10edd3110abeb1cc2e1ba

SHA512
68070db39cd14841bcd49db1acf19806b0aa4b4ac4c56518b3a3baddaac1cd533f0b3ef70a378f53d65c0d6c0f745a6102b63303ea7978c79f688c787efe9cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41322\_ssl.pyd

Filesize
151KB

MD5
6f52439450ad38bf940eef2b662e4234

SHA1
3dea643fac7e10cae16c6976982a626dd59ff64a

SHA256
31c95af04a76d3badbdd3970d9b4c6b9a72278e69d0d850a4710f1d9a01618d7

SHA512
fdd97e04f4a7b1814c2f904029dfb5cdfcd8a125fce884dcd6fdb09fb8a691963192192f22cf4e9d79dd2598cf097a8764aeec7a79e70a9795250c8ef0024474

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41322\base_library.zip

Filesize
764KB

MD5
935ecbb6c183daa81c0ac65c013afd67

SHA1
0d870c56a1a9be4ce0f2d07d5d4335e9239562d1

SHA256
7ae17d6eb5d9609dc8fc67088ab915097b4de375e286998166f931da5394d466

SHA512
a9aac82ab72c06cfff1f1e34bf0f13cbf0d7f0dc53027a9e984b551c602d58d785c374b02238e927e7b7d69c987b1e8ab34bfc734c773ef23d35b0bdb25e99cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41322\libcrypto-1_1.dll

Filesize
3.3MB

MD5
63c4f445b6998e63a1414f5765c18217

SHA1
8c1ac1b4290b122e62f706f7434517077974f40e

SHA256
664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2

SHA512
aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41322\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41322\libssl-1_1.dll

Filesize
678KB

MD5
bd857f444ebbf147a8fcd1215efe79fc

SHA1
1550e0d241c27f41c63f197b1bd669591a20c15b

SHA256
b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf

SHA512
2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41322\python39.dll

Filesize
4.3MB

MD5
7e9d14aa762a46bb5ebac14fbaeaa238

SHA1
a5d90a7df9b90bdd8a84d7dc5066e4ea64ceb3d9

SHA256
e456ef44b261f895a01efb52d26c7a0c7d7d465b647a7b5592708ebf693f12a3

SHA512
280f16348df1c0953bbc6f37ff277485351171d0545ebe469bacd106d907917f87584154aec0f193f37322bc93ac5433cd9a5b5c7f47367176e5a8b19bbd5023

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41322\select.pyd

Filesize
28KB

MD5
f8f5a047b98309d425fd06b3b41b16e4

SHA1
2a44819409199b47f11d5d022e6bb1d5d1e77aea

SHA256
5361da714a61f99136737630d50fa4e975d76f5de75e181af73c5a23a2b49012

SHA512
f0a96790fcdabf02b452f5c6b27604f5a10586b4bf759994e6d636cc55335026631fa302e209a53f5e454bea03b958b6d662e0be91fa64ce187a7dc5d35a9aa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI41322\unicodedata.pyd

Filesize
1.1MB

MD5
87f3e3cf017614f58c89c087f63a9c95

SHA1
0edc1309e514f8a147d62f7e9561172f3b195cd7

SHA256
ba6606dcdf1db16a1f0ef94c87adf580bb816105d60cf08bc570b17312a849da

SHA512
73f00f44239b2744c37664dbf2b7df9c178a11aa320b9437055901746036003367067f417414382977bf8379df8738c862b69d8d36c6e6aa0b0650833052c85f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads