Overview

overview

7

Static

static

3

feba0bdc56...18.exe

windows7-x64

7

feba0bdc56...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29/09/2024, 14:32

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    feba0bdc56db6b7d93e7a1ac92f4ed0f_JaffaCakes118.exe

  • Size

    14.7MB

  • MD5

    feba0bdc56db6b7d93e7a1ac92f4ed0f

  • SHA1

    b427fa35b0df0c925f9451181d66f55b2dcfd865

  • SHA256

    ff33b26aa68f5d3e3779267ceea15b004d4877ac073c6e7c92b5096ffa5322df

  • SHA512

    25ffca803247c7fdd9cef7c6e51498a78ea8bf7c0cbbfb03b0aff0c4bc8eee177273722ef730a9d3bf18bcd3aa5591e6b615bbb55521142fd3701649dd88030f

  • SSDEEP

    393216:IlCQNbXCpS9c5hlERblh2pM5RFJzFcguYwvLfULzs+e6K+:IFgeEhk5QpMhlwvLfU0+5

Score
7/10
spywarestealer

Malware Config

Signatures

  • Loads dropped DLL 41 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\feba0bdc56db6b7d93e7a1ac92f4ed0f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\feba0bdc56db6b7d93e7a1ac92f4ed0f_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2732
    • C:\Users\Admin\AppData\Local\Temp\feba0bdc56db6b7d93e7a1ac92f4ed0f_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\feba0bdc56db6b7d93e7a1ac92f4ed0f_JaffaCakes118.exe"
      2⤵
      • Loads dropped DLL
      PID:1796

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\Crypto\Cipher\_Salsa20.pyd
    Filesize

    13KB

    MD5

    86109d2d1fccdb91968b7c1a63823731

    SHA1

    89dec67fbb4e467604f20c53c3ae3949471aef58

    SHA256

    28efd36be6bbbc56a7219bed7cc132ce67baf629100cc03a08a804360f483db9

    SHA512

    5d331f7f3ca413e77c33fa57e1f07ef43d064545ff1d143b9086211b42bbe165564c62b07d7a44615e75221613f3d3127ef5d7c7ec06315f0c397c0b059d2a37

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\Crypto\Cipher\_raw_cbc.pyd
    Filesize

    12KB

    MD5

    ff9b1e03922361e0a8be65e5e1421aac

    SHA1

    d4d674fb4e0214903e341e98613328d51aff9054

    SHA256

    2a5ab7f23554f497693ca81a5e5f21647b10fd8b9e00b8377d8385dc15a9c4df

    SHA512

    8cbbbbdc9a3d9e866dc88a655a75317f58cb4a49cb262975ff8c4ae5d47c344b86f69f6d2fc369dd7aa8ad7fcaa40d1937320e7e4f5923a03a39459b7bb247c0

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\Crypto\Cipher\_raw_cfb.pyd
    Filesize

    13KB

    MD5

    06358818f111a1c8e1b76d60a650c997

    SHA1

    5bbaf40aeb932766346631df25d887264aad7ac2

    SHA256

    b5438682a4c6bf57dcaad2835a9a293f712284fbe1af4ba6059011396cdbd180

    SHA512

    f954b4e56e3ace2c8e0961149cb5bd433f35530bc1c5e38ec5d2223ec3591df0998903b3928668c5d8c05f16eaa1c2adf41fc999690c42dafa794800fc4b193e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\Crypto\Cipher\_raw_ctr.pyd
    Filesize

    14KB

    MD5

    6adf70fd22d5ca90269466e5fc2aca2b

    SHA1

    1d4cdf2b08154b33738c5244a8886284c71693b9

    SHA256

    2f9dfa9de351bfe553dde60ae891e9b54a2e08546d723c7165234fd41c3ceed4

    SHA512

    efbd7133e5b5ef035f5a09d92b3b12d3ad367d6c35856a842536102d36a1ef53afe62ea3c3a5a4ae641bb28b6caaed18afa3519a637aa36f71f71979d4f61239

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\Crypto\Cipher\_raw_ecb.pyd
    Filesize

    10KB

    MD5

    64f6350fc1145db6337a9e3dfb83222f

    SHA1

    fea799c3f2a655d5104a46b788d98ea272557ae5

    SHA256

    821a86630238beaf4e303196ce26a250ef873f7a98b92644566b3c7d683d400e

    SHA512

    58f90099630b98a632db38d7cc4a2f44c70bb012f55b3b5a69dffc3a76f6a2b30ab81d678b95e807c135b96633a0d8ed83428924a1c9d1dfdb7f2a3962a44d31

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\Crypto\Cipher\_raw_ofb.pyd
    Filesize

    12KB

    MD5

    670c2baf75e559b89435283298f75bef

    SHA1

    be1e5a0711c6c0bb1e2aef4ed18a15ed5759b027

    SHA256

    236650fc42b347b9caa5e3a84a13da9e40586d97762f87730c9016dcb81abf06

    SHA512

    52554fe5308f7b758b66b48262aae1c180191358e15fdd85b7d5ef47a35677e079c3ef6a54e63d1520038bbfc79bad5b2534b1c2808217ffb53c55b7e8862fdb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\Crypto\Hash\_BLAKE2s.pyd
    Filesize

    13KB

    MD5

    9098b9c8340047c6434825e18826cc18

    SHA1

    85dde191f6549aca0813d8a723d39b83c61002db

    SHA256

    825039711c334e169432a482f8b71ae735d7a1bd56552e501f6f3eca87cf272e

    SHA512

    defc6852291b568793a48124184342272f4bc424f88de82a35335d5596dfacc93a52afc33c43337e4ceb800c5bd998493a7ba7f52c02a6027a4434d7e608fcae

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\Crypto\Hash\_MD5.pyd
    Filesize

    15KB

    MD5

    2f4c07b5fc3c6245b0e1269c0d1a5a97

    SHA1

    26ea9baabadf63e5a44f3b606139f249bd120b99

    SHA256

    efb961372f6ce102a9836b63038ae1385b408ef8dcf2de7238b2403a6e987b27

    SHA512

    21e1ccbf238fd59c1ce80543a8f21858ae6e15ad1e8536a0144ec06791cd2488822ae87d84e331e9135142c76506e68fad7dbb4b26428ff3ac0d43f49e8fcc92

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\Crypto\Hash\_SHA256.pyd
    Filesize

    21KB

    MD5

    363b8e9f9a119ee0a52d8e75083f3f5d

    SHA1

    e0f4316f5afd2abc31047b50fdd7910d148a7611

    SHA256

    1b36afc5b2f6f46d1a2457d56f276f5b5ffed066955acec911b9b7973d1e92b3

    SHA512

    3862436b88dae084993772d6ebdd3c7a892a562045ce448bc6419c7c21c797c806ef6030157c8daf2e85a36b13ed0ce4475eb00e61ee0cbec4db2677e780f177

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\Crypto\Protocol\_scrypt.pyd
    Filesize

    12KB

    MD5

    dcd7e1c1f1e68405d66cef954cbaee38

    SHA1

    bbe8c8bde0e1956f4d88d737d50b2215073cdcb1

    SHA256

    0ec713f4f3e963f618873ff538c7dcc532e0faba5025c5a8e20ac089fdfcf1d4

    SHA512

    10d2048ff68515862b95e658bb33e42ed0fd2ab70db66f2738487d21739172d4f24ffb8f239fdfc6f479ce582a85c3b8f8adfb5024dad5769713a4b3d22d3115

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\Crypto\Util\_strxor.pyd
    Filesize

    10KB

    MD5

    db1f79a96a1390028df325dd183ff9f1

    SHA1

    8373b6c44fdbece2c1ee5327a2bb5e5b0a719ed4

    SHA256

    6429928799a5eea9e090224a2d7083b469892d725a28ea9dcc2a95f94286b0da

    SHA512

    dad71f250340e529883e3347e90e66a445641f019351e745940c6700145c6c923a9d5575efaf42436823bd8f1db44e9b00c99eb1cc41dc49425ea9db9847590e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\VCRUNTIME140.dll
    Filesize

    99KB

    MD5

    18571d6663b7d9ac95f2821c203e471f

    SHA1

    3c186018df04e875d6b9f83521028a21f145e3be

    SHA256

    0b040a314c19ff88f38fd9c89dca2d493113a6109adb8525733c3f6627da888f

    SHA512

    c8cbca1072b8cb04f9d82135c91ff6d7a539cb7a488671cecb6b5e2f11a4807f47ad9af5a87ebee44984ab71d7c44fc87850f9d04fd2c5019ec1b6a1b483ca21

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\_cffi_backend.cp38-win_amd64.pyd
    Filesize

    178KB

    MD5

    11fc3e9c86ae64d4738a2038c299e1db

    SHA1

    ca2641591de622fd0316ec273d19801866551551

    SHA256

    efa55ebb0b990b91e5d998e1d45f7c7a8a12aaed5f0971c6d6bdb81b76e7f620

    SHA512

    3de1088f5c580e3ae4df925e50cbb57168a6eb71a65f9fba00ebd25dfdeaae9cfdd94083e531538c108d4e4ecb6e579b422f29402c7d069efe9a47dc449682cc

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\_ctypes.pyd
    Filesize

    123KB

    MD5

    8adb1345c717e575e6614e163eb62328

    SHA1

    f1ee3fff6e06dc4f22a5eb38c09c54580880e0a3

    SHA256

    65edc348db42347570578b979151b787ceebfc98e0372c28116cc229494a78a8

    SHA512

    0f11673854327fd2fcd12838f54c080edc4d40e4bcb50c413fe3f823056d189636dc661ea79207163f966719bf0815e1ffa75e2fb676df4e56ed6321f1ff6cae

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\_socket.pyd
    Filesize

    77KB

    MD5

    1d53841bb21acdcc8742828c3aded891

    SHA1

    cdf15d4815820571684c1f720d0cba24129e79c8

    SHA256

    ab13258c6da2c26c4dca7239ff4360ca9166ea8f53bb8cc08d2c7476cab7d61b

    SHA512

    0266bcbcd7ca5f6c9df8dbeea00e1275932dacc38e5dd83a47bfbb87f7ca6778458a6671d8b84a63ae9216a65975da656ba487ac28d41140122f46d0174fa9f9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\_sqlite3.pyd
    Filesize

    85KB

    MD5

    a3a0cb078aa4fc5d5a081be54745a4c9

    SHA1

    42b1873c4633f9a0288ce4ee44c50234c0f03e22

    SHA256

    e0ed20d5ae660a18bf60e907ba7f21013e04305aa67aa3b8b5a1cee9bd4dcd27

    SHA512

    ac6628bf3908c053362b8c840a7934d704413ae673702052b06d23d71995702d1c562e36a6bde3ad0170eb71a77f43d702ad71f74bc21a3d770f05b95be16f4e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\_ssl.pyd
    Filesize

    150KB

    MD5

    84dea8d0acce4a707b094a3627b62eab

    SHA1

    d45dda99466ab08cc922e828729d0840ae2ddc18

    SHA256

    dcf6b3ff84b55c3859d0f176c4ce6904c0d7d4643a657b817c6322933dbf82f6

    SHA512

    fdaa7eb10f8bf7b42a5c9691f600eff48190041a8b28a5dab977170db717fff58dd0f64b02ca30d274552ff30ee02a6577f1465792cf6760366c2588bf373108

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\base_library.zip
    Filesize

    768KB

    MD5

    3007605f9eb425947d2efd3fee4cf338

    SHA1

    227a0abc446822a3ae5f3643f99fd8676a4da04c

    SHA256

    236b2759817564da08c87d54dece6ee0df09efc48fdc864f4a48ea352ec1305c

    SHA512

    d0a4fb91442b15a96ca21a011818084c0c80519a2bbb929baa3c12779a6427ef75d7abc005121d1a1cffb20a3014da755943c65e6fdd8ac0b9956d4d187fccf8

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\libcrypto-1_1.dll
    Filesize

    3.2MB

    MD5

    cc4cbf715966cdcad95a1e6c95592b3d

    SHA1

    d5873fea9c084bcc753d1c93b2d0716257bea7c3

    SHA256

    594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1

    SHA512

    3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\libffi-7.dll
    Filesize

    32KB

    MD5

    eef7981412be8ea459064d3090f4b3aa

    SHA1

    c60da4830ce27afc234b3c3014c583f7f0a5a925

    SHA256

    f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

    SHA512

    dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\pyexpat.pyd
    Filesize

    184KB

    MD5

    11a886189eb726d5786926cc09f9e116

    SHA1

    d94295368a1285681fb03bac0553eb1495d43805

    SHA256

    dc38bdbe10cfaa99799e0c87aa8444fc062d445b87686d6593ffca46cc938031

    SHA512

    405c56487a91ad1209029ca6ea125642076251f0a8c069eef0e30ce484381db7bf24d2f5cd74b83d1c8c1358f92f35fa6ed7b75601ace611cf36bb2331588684

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\python3.DLL
    Filesize

    57KB

    MD5

    9779c701be8e17867d1d92d470607948

    SHA1

    6aae834541ccc73d1c87c9f1a12df4ac0cf9001f

    SHA256

    59e6421802d30326c1704f15acc2b2888097241e291aba4860d1e1fc3d26d4bf

    SHA512

    4e34bcdd2093347d2b4e5c0f8c25f5d36d54097283faf5b2be1c75d717f716d459a45336647d3360457f25417952e62f8f21f5a720204fe5b894d5513e43e782

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\python38.dll
    Filesize

    4.0MB

    MD5

    1f2688b97f9827f1de7dfedb4ad2348c

    SHA1

    a9650970d38e30835336426f704579e87fcfc892

    SHA256

    169eeb1bdf99ed93ca26453d5ca49339e5ae092662cd94cde09fbb10046f83fc

    SHA512

    27e56b2d73226e36b0c473d8eb646813997cbdf955397d0b61fcae37ed1f2c3715e589f9a07d909a967009ed2c664d14007ccf37d83a7df7ce2a0fefca615503

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\pythoncom38.dll
    Filesize

    559KB

    MD5

    5aaf39c3dc5d37ee70d0f8faa0de695e

    SHA1

    69b7cc9c612af39ee1dabdfb6e84c81a22d08c10

    SHA256

    b53b1372b4f48a5bee76b6354823a6f8e9a9b7b8b3cc25119258451d032261f7

    SHA512

    236decda868dcfa617d538a2876a06d0e40ce6889f1284d92d9d1e3c3d16f31aadac269d6ab9266fda6afcc8b691cb462bd747bb8f21f98e44eecf11014fc9a5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\pywintypes38.dll
    Filesize

    139KB

    MD5

    4e2d48b0e2bc0d1b0a61be486b865fdd

    SHA1

    95fb013f66c28578dbe9db06e93e6085828a7324

    SHA256

    bff7b09303260eaf01ba73687d979ce6d1d50458426686bea7b01dea5db446d4

    SHA512

    d5aa94805bf97b51ba986c60e1401608bc547f1fed0e07f25f6b3ca2bf86167002830aa18c74cb68cf6f51aa60912036678a276971af56754753a1f01ac8d13f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\sqlite3.dll
    Filesize

    1.4MB

    MD5

    a2dbd94878af1bb29f8725a834696a60

    SHA1

    01c40f2949604183fb8c76fd5e7803009a83ce4d

    SHA256

    6af14006a4d732fc0c4bd44317457fca8c37d12ffcaf845790d3f57da75451fb

    SHA512

    6aad1e43e272b178127334c48925f69422ca9a4e6e4636e4c5a522a3b3690e0a715c1a3c400ec6962b6eeaac0ff2612208595d72747de3e286745eca90ee9953

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\win32api.pyd
    Filesize

    131KB

    MD5

    87a1f5111634f5531efccfdd931b4d42

    SHA1

    0401252123d36f932870cdeabe5d75db9d432ffa

    SHA256

    9a562e6431427c52d213c17af815c82ee704ab9fced76837647cc1838126d96f

    SHA512

    a15080f2cca0dae4925d0ac246966c433ea8847502c880ec784102de3bc1daf949eafe34ac9916bb7b072a7d86ab7da7f55ffb31d9cb4673067a42049ae7bf4f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\_MEI27322\win32crypt.pyd
    Filesize

    123KB

    MD5

    988affa3955a692bdead8a6591882f63

    SHA1

    350d97648927f8a45d2468272533d23008769a4b

    SHA256

    ee5be7b88b016d41804d25a22463beb16a82d2b86476ceb19c010111c3a7db4c

    SHA512

    d28ca16080538ce968869942b9c9f20a25e78e8bc85f671f8d79c920b133682066c2b2d208a4b0d29e67655af4a805debd1146fcb6899df61d402fcd8b2a0ee9

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI27322\Crypto\Hash\_SHA1.pyd
    Filesize

    17KB

    MD5

    d2ef20fe88c483dc2588c03876058afd

    SHA1

    86a7a9e71df94fec73dd90a9a4cf5b7901ce622d

    SHA256

    6cc9cfa3c9739b545808e814a661b5b54e9127b057ce503024e515648b7a4a33

    SHA512

    d1ea9f01ea1a16b23b6219492b3d2a27b017ea8d5511549c82fe3a58da988b890e52d144630c55fd845b8d079c4b6d3fd2172020cecc5f6dd6a05b1495d18c71

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI27322\_bz2.pyd
    Filesize

    84KB

    MD5

    fc0d862a854993e0e51c00dee3eec777

    SHA1

    20203332c6f7bd51f6a5acbbc9f677c930d0669d

    SHA256

    e5de23dbac7ece02566e79b3d1923a8eeae628925c7fb4b98a443cad94a06863

    SHA512

    b3c2ade15cc196e687e83dd8d21ce88b83c8137a83cfc20bc8f2c8f3ab72643ef7ca08e1dc23de0695f508ba0080871956303ac30f92ab865f3e4249d4d65c2f

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI27322\_lzma.pyd
    Filesize

    158KB

    MD5

    60e215bb78fb9a40352980f4de818814

    SHA1

    ff750858c3352081514e2ae0d200f3b8c3d40096

    SHA256

    c4d00582dee45841747b07b91a3e46e55af79e6518ec9f0ce59b989c0acd2806

    SHA512

    398a441de98963873417da6352413d080620faf2ae4b99425d7c9eaf96d5f2fdf1358e21f16870bdff514452115266a58ee3c6783611f037957bfa4bcec34230

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI27322\libssl-1_1.dll
    Filesize

    673KB

    MD5

    bc778f33480148efa5d62b2ec85aaa7d

    SHA1

    b1ec87cbd8bc4398c6ebb26549961c8aab53d855

    SHA256

    9d4cf1c03629f92662fc8d7e3f1094a7fc93cb41634994464b853df8036af843

    SHA512

    80c1dd9d0179e6cc5f33eb62d05576a350af78b5170bfdf2ecda16f1d8c3c2d0e991a5534a113361ae62079fb165fff2344efd1b43031f1a7bfda696552ee173

    Download Submit

  • \Users\Admin\AppData\Local\Temp\_MEI27322\select.pyd
    Filesize

    26KB

    MD5

    a2ab334e18222738dcb05bf820725938

    SHA1

    2f75455a471f95ac814b8e4560a023034480b7b5

    SHA256

    7ba95624370216795ea4a087c326422cfcbccc42b5ada21f4d85c532c71afad7

    SHA512

    72e891d1c7e5ea44a569283b5c8bd8c310f2ee3d3cc9c25c6a7d7d77a62cb301c822c833b0792c3163cf0b0d6272da2f667e6bc74b07ed7946082433f77d9679

    Download Submit