d760fda9798042aadeee312268c1a9017847db33f0b07f8430207e6ebf0be639

Analysis

max time kernel
134s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 08:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
Size

24.9MB
MD5

0ec380c5318dc9fa581a5212d9f8a0df
SHA1

896114b307709429350f924625084b402a882e7a
SHA256

d760fda9798042aadeee312268c1a9017847db33f0b07f8430207e6ebf0be639
SHA512

5b5b9028804a4387f11ae9dbc38ce0e8b5d0339935a2e8ef89f0a30054e137191aec7f47734de4a0426e7394373bb0387060510f23d8bc440790f0f98d88057a
SSDEEP

786432:yC1VvErULMufBZ4MKYQpAAOwv2mP6w1ezNw/:yC1tEgjfBmMKY9FXM6WeA

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 22 IoCs

pid	Process
3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 3512	700	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe	86
PID 700 wrote to memory of 3512	700	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe	86
PID 3512 wrote to memory of 4784	3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe	88
PID 3512 wrote to memory of 4784	3512	0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe	88

C:\Users\Admin\AppData\Local\Temp\0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:700
- C:\Users\Admin\AppData\Local\Temp\0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\0ec380c5318dc9fa581a5212d9f8a0df_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4784

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x338 0x33c
1⤵
PID:5064

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI7002\MSVCP140.dll

Filesize
613KB

MD5
c1b066f9e3e2f3a6785161a8c7e0346a

SHA1
8b3b943e79c40bc81fdac1e038a276d034bbe812

SHA256
99e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd

SHA512
36f9e6c86afbd80375295238b67e4f472eb86fcb84a590d8dba928d4e7a502d4f903971827fdc331353e5b3d06616664450759432fdc8d304a56e7dacb84b728

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7002\PIL\_imaging.cp39-win_amd64.pyd

Filesize
3.1MB

MD5
debf6081d5d4ea62c1a18cdde89a99a3

SHA1
acef2c0248ecb004dfb47fdb6942653bd8041865

SHA256
439e81562020d337965bb6f5d71ac7efbf43cac6fef67b092c17d52a798bf2f0

SHA512
52c99b0245a77e8ea829eb0942a164cfd03230f721e476a184d9fcb5df227ee22dd6cadc22e3d9b70c47b09dda38ea4be4f42be50955d86a530f9ffdeab9c5a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7002\VCRUNTIME140.dll

Filesize
94KB

MD5
11d9ac94e8cb17bd23dea89f8e757f18

SHA1
d4fb80a512486821ad320c4fd67abcae63005158

SHA256
e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e

SHA512
aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7002\_bz2.pyd

Filesize
84KB

MD5
124678d21d4b747ec6f1e77357393dd6

SHA1
dbfb53c40d68eba436934b01ebe4f8ee925e1f8e

SHA256
9483c4853ca1da3c5b2310dbdd3b835a44df6066620278aa96b2e665c4b4e86b

SHA512
2882779b88ed48af1e27c2bc212ddc7e4187d26a28a90655cef98dd44bc07cc93da5bce2442af26d7825639590b1e2b78bf619d50736d67164726a342be348fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7002\_cffi_backend.cp39-win_amd64.pyd

Filesize
179KB

MD5
51740b093592af2fbeb5d675af5edc73

SHA1
5918e99a8c64c5abb915e7a998136ab514b828f3

SHA256
83ed202214d28d14125fdb760b7c6439f79c59c02bb3a39e7812f8d622c97ada

SHA512
877028a87653e4f46434f874018b400439456c9255da7d5e8919579a0bd2dcdc11974710089a671b9d7aa651ddf670ccaacab7612ce23876b44f13c73e4866f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7002\_ctypes.pyd

Filesize
123KB

MD5
7ab242d7c026dad5e5837b4579bd4eda

SHA1
b3ff01b8b3da2b3a9c37bfffafc4fb9ee957cc0f

SHA256
1548506345d220d68e9089b9a68b42a9d796141eb6236e600283951cb206eaa1

SHA512
1dd09cf14c87f60b42e5e56d0104154513902c9bfa23eef76a92f4a96c2356b2812dd6eee5e9a74d5ed078ade5f8f6d1f1b01961d7efadfebb543d71c2d31a30

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7002\_hashlib.pyd

Filesize
64KB

MD5
ae32a39887d7516223c1e7ffdc3b6911

SHA1
94b9055c584df9afb291b3917ff3d972b3cd2492

SHA256
7936413bc24307f01b90cac2d2cc19f38264d396c1ab8eda180abba2f77162eb

SHA512
1f17af61c917fe373f0a40f06ce2b42041447f9e314b2f003b9bd62df87c121467d14ce3f8e778d3447c4869bf381c58600c1e11656ebda6139e6196262ae17e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7002\_lzma.pyd

Filesize
159KB

MD5
a77c9a75ed7d9f455e896b8fb09b494c

SHA1
c85d30bf602d8671f6f446cdaba98de99793e481

SHA256
4797aaf192eb56b32ca4febd1fad5be9e01a24e42bf6af2d04fcdf74c8d36fa5

SHA512
4d6d93aa0347c49d3f683ee7bc91a3c570c60126c534060654891fad0391321e09b292c9386fb99f6ea2c2eca032889841fce3cab8957bb489760daac6f79e71

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7002\_queue.pyd

Filesize
28KB

MD5
e64538868d97697d62862b52df32d81b

SHA1
2279c5430032ad75338bab3aa28eb554ecd4cd45

SHA256
b0bd6330c525b4c64d036d29a3733582928e089d99909500e8564ae139459c5f

SHA512
8544f5df6d621a5ff2ca26da65b49f57e19c60b4177a678a00a5feb130bf0902f780b707845b5a4dd9f12ddb673b462f77190e71cbe358db385941f0f38e4996

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7002\_socket.pyd

Filesize
78KB

MD5
4b2f1faab9e55a65afa05f407c92cab4

SHA1
1e5091b09fc0305cf29ec2e715088e7f46ccbbd4

SHA256
241db349093604ab25405402ba8c4212016657c7e6a10edd3110abeb1cc2e1ba

SHA512
68070db39cd14841bcd49db1acf19806b0aa4b4ac4c56518b3a3baddaac1cd533f0b3ef70a378f53d65c0d6c0f745a6102b63303ea7978c79f688c787efe9cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7002\_sounddevice_data\portaudio-binaries\libportaudio64bit.dll

Filesize
341KB

MD5
c6fa91e19fcff596e4cbc61c7471ac47

SHA1
a835d0c7989a346bf479274e2752a5e06bc493b1

SHA256
2ef9d21b27b69c4b29007b1136bae9a56ea83118b27ed62018d7cc757f8fc0dd

SHA512
d28b8f158a70e77ecd65ef0b62c654e3a435511485ffe6d5960cfa5783af957b0771c15fcfd9dc48655ff6efc3430f8440c89da7d4fc925bae0b863611bb9b6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7002\_ssl.pyd

Filesize
151KB

MD5
6f52439450ad38bf940eef2b662e4234

SHA1
3dea643fac7e10cae16c6976982a626dd59ff64a

SHA256
31c95af04a76d3badbdd3970d9b4c6b9a72278e69d0d850a4710f1d9a01618d7

SHA512
fdd97e04f4a7b1814c2f904029dfb5cdfcd8a125fce884dcd6fdb09fb8a691963192192f22cf4e9d79dd2598cf097a8764aeec7a79e70a9795250c8ef0024474

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7002\base_library.zip

Filesize
764KB

MD5
c2c39a352a50e216e45a07748fb7f8c5

SHA1
402e720be0212198cdfe659f3061795cac169d7f

SHA256
ab34fb921a79e9b635d5dd17f3c1b24456d07e4165defdb3c1d047eff0efdb48

SHA512
fb44205528dab11a33fea4c60783d56ecd04f5c02076e9900dc99af5089b56a65b5a8668e92b910479ceb7c822731887810e6e4292787fe7181ddb2060b197c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7002\libcrypto-1_1.dll

Filesize
3.3MB

MD5
63c4f445b6998e63a1414f5765c18217

SHA1
8c1ac1b4290b122e62f706f7434517077974f40e

SHA256
664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2

SHA512
aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7002\libffi-7.dll

Filesize
32KB

MD5
eef7981412be8ea459064d3090f4b3aa

SHA1
c60da4830ce27afc234b3c3014c583f7f0a5a925

SHA256
f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

SHA512
dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7002\libssl-1_1.dll

Filesize
678KB

MD5
bd857f444ebbf147a8fcd1215efe79fc

SHA1
1550e0d241c27f41c63f197b1bd669591a20c15b

SHA256
b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf

SHA512
2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7002\pyexpat.pyd

Filesize
199KB

MD5
801d35409fec61ce6852e3540889c9c7

SHA1
a3c7e44433ebfef5359d12b9ac2f64782ccff3e9

SHA256
ab0814b19fd6b10d2729a907cf449f8a858a42b3f1288fb1c93b62950059295d

SHA512
d1f81469d1407b42c7aa207013c79d393ed8f598c9cf1f9d2bf3419ff82c2cd4817a5360d0af963bfd45d28f8adcedeb54701d56b06f4c0f96daa92dfec755d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7002\python39.dll

Filesize
4.3MB

MD5
7e9d14aa762a46bb5ebac14fbaeaa238

SHA1
a5d90a7df9b90bdd8a84d7dc5066e4ea64ceb3d9

SHA256
e456ef44b261f895a01efb52d26c7a0c7d7d465b647a7b5592708ebf693f12a3

SHA512
280f16348df1c0953bbc6f37ff277485351171d0545ebe469bacd106d907917f87584154aec0f193f37322bc93ac5433cd9a5b5c7f47367176e5a8b19bbd5023

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7002\pythoncom39.dll

Filesize
543KB

MD5
26ebff360b70ca5de0a81fccbae0b02c

SHA1
2415d8c46eb188648225f55a26bd19a9fb225749

SHA256
4077005b6ae8272d82892d183cbc972780e3aa80f848c447626761a6c244d3a3

SHA512
09645c61421f245df7a2f62683bc90b5e3d51607b5dd9b1e7af9d54d93bccad132d6ff8aa4ba7d083da443f2b6220302178f9a120fecce661876cbab6d90a3df

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7002\pywintypes39.dll

Filesize
139KB

MD5
d658ffb571a541e9e21a6b859a67e112

SHA1
d9e7f54eb92ce32ff4d02fedd5c9b738dabbfbdb

SHA256
0cc26e2acaa1933647f885b47ac6da6625be7a4cd93fae220fb172906ff22091

SHA512
0040b19841d2d19ab5506cefc3186813cc92f57144b7b3f0bfec45638eebc053ddb8a40f2843cafe5d0ae5c6dc7f5db646a6441d34e02d749eb9563edbe5c7b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7002\select.pyd

Filesize
28KB

MD5
f8f5a047b98309d425fd06b3b41b16e4

SHA1
2a44819409199b47f11d5d022e6bb1d5d1e77aea

SHA256
5361da714a61f99136737630d50fa4e975d76f5de75e181af73c5a23a2b49012

SHA512
f0a96790fcdabf02b452f5c6b27604f5a10586b4bf759994e6d636cc55335026631fa302e209a53f5e454bea03b958b6d662e0be91fa64ce187a7dc5d35a9aa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7002\unicodedata.pyd

Filesize
1.1MB

MD5
87f3e3cf017614f58c89c087f63a9c95

SHA1
0edc1309e514f8a147d62f7e9561172f3b195cd7

SHA256
ba6606dcdf1db16a1f0ef94c87adf580bb816105d60cf08bc570b17312a849da

SHA512
73f00f44239b2744c37664dbf2b7df9c178a11aa320b9437055901746036003367067f417414382977bf8379df8738c862b69d8d36c6e6aa0b0650833052c85f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7002\wheel-0.37.0.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI7002\win32api.pyd

Filesize
131KB

MD5
8ccfec535f312418015bcd067fe32208

SHA1
79aa4bc6d681972afadfa4b2bae230ce06570a56

SHA256
9157829433f0bd8a12b1a1cf2fb90301e20ecf43802eb0ac85525ebcc53d0e30

SHA512
698b3a57338ffa47e2afecf9e8f8f709061e5cb56d82d8e10e48c6d4c8d26d2e0a21f2dcedc599a1b605ee2026dc2af7bd79d9f8b035c5c6fd9bd9fc817673b8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads