Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-05-2024 21:08

General

  • Target

    885b287965b2fbf8395f7e4cd229414e_JaffaCakes118.exe

  • Size

    207KB

  • MD5

    885b287965b2fbf8395f7e4cd229414e

  • SHA1

    22a9e855a9e0a1f6fc5b69e27bfe0fa39331d9ea

  • SHA256

    1099b24ee851a29ebbe31e65843ea7454e53b865389952534809095a8ec3d6e8

  • SHA512

    cadf79f1bc476ee6b8e11e2f691cc07175c8f1441712ebfbb0fcaf9df66abad1888b709e9f7aab3263e47e6d0c814e317e4fa646952bfef9d606bd4bcd7a8557

  • SSDEEP

    6144:gz+92mhAMJ/cPl3iw7Tozlx/LVXHSPF0MfE:gK2mhAMJ/cPlNU7VXx

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\885b287965b2fbf8395f7e4cd229414e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\885b287965b2fbf8395f7e4cd229414e_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4864
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\wsmallstub.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\wsmallstub.exe" "C:\Users\Admin\AppData\Local\Temp\885b287965b2fbf8395f7e4cd229414e_JaffaCakes118.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4128
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ct543834.ourtoolbar.com/ie/?isorganic=true&requesterid=dmstub
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1412
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffcb62446f8,0x7ffcb6244708,0x7ffcb6244718
          4⤵
            PID:5024
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10634211110906313189,2384472729691766063,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
            4⤵
              PID:2624
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,10634211110906313189,2384472729691766063,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:3208
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,10634211110906313189,2384472729691766063,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
              4⤵
                PID:2304
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10634211110906313189,2384472729691766063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
                4⤵
                  PID:5008
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10634211110906313189,2384472729691766063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
                  4⤵
                    PID:3404
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10634211110906313189,2384472729691766063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
                    4⤵
                      PID:3484
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10634211110906313189,2384472729691766063,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
                      4⤵
                        PID:2528
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10634211110906313189,2384472729691766063,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
                        4⤵
                          PID:3624
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10634211110906313189,2384472729691766063,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
                          4⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4932
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10634211110906313189,2384472729691766063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
                          4⤵
                            PID:1924
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10634211110906313189,2384472729691766063,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
                            4⤵
                              PID:1888
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:5104
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:4904

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            f53207a5ca2ef5c7e976cbb3cb26d870

                            SHA1

                            49a8cc44f53da77bb3dfb36fc7676ed54675db43

                            SHA256

                            19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

                            SHA512

                            be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            120B

                            MD5

                            fc48abba64976257dbe15c471c36971e

                            SHA1

                            e51f0322671bcb295bd802fbef49d14ff930229f

                            SHA256

                            e1279bb22e4716148fea93d7f3626381ef6e019757d30a8b376379560f4330b0

                            SHA512

                            1e83c386898da1c56a67304ddad8bf8e712e9600cc6e1632ad46db14e32655ba3a90a14cfffbc6b0596519f47a450e39fe99507c7d16120747fb6c00e0baf640

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                            Filesize

                            637B

                            MD5

                            fcf4957883d7e61db63748d5fb784074

                            SHA1

                            17febfde23cea14f46a56d9ad259bf38d972d26e

                            SHA256

                            5ba3ca0b5b305741c25394b247cb8f93727e34f3d215df1b093d4c83f2088777

                            SHA512

                            da3ec7a7e3d36e710bb11a7c739f472bb6c7f8578d1d98d5723aae8ed9f48d9aae983a19646b3a82450388e773bca380bb5199780c26fc6bbd78ad15e35764e4

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            033f4b415cf374ad168246de765a376b

                            SHA1

                            8dba9c38e25d74ed5a209c33c31d7acc6b866b26

                            SHA256

                            3e8bcb780ec1ae85c6e51716fee8e86069cf11c0631b55828196d42e37d5d76c

                            SHA512

                            fc329ab40d2f297b79d9c0bdae5fe614452145be8faa62acedbee70bb12c2646262e9f4ce94d0b249f2efb43b0513e9199ad7bf7ed46398e150d297c8cd7f91b

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            f18099ec312774420992a0c2b9e230c3

                            SHA1

                            531ab51fba10a68dc9f7aeab0f0a03cf6c50f70a

                            SHA256

                            69402ed5e15cc42c44ca41e3ad56e37c2edde1b63653293bef16c824ffe4f26c

                            SHA512

                            071d0953222352b3326cdb889897d3a96abec018c984ff10352fd2e50175a078bd6a06c43b3bda0de5e6d8237549ba8b8db63604704645f8689532a2177b5616

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            6752a1d65b201c13b62ea44016eb221f

                            SHA1

                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                            SHA256

                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                            SHA512

                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            10KB

                            MD5

                            fbf43f3151d76945b30ab64f4ae31473

                            SHA1

                            17039be7ce46682449aa1f60daea6989413e8d40

                            SHA256

                            49640b0c48c2bdc70f4cf9bc79a2d684960a2b8c4adb65da7beb6b774c215968

                            SHA512

                            aa2a70b03fe80d683ea5d7d937758dbf9a88fe6504cd1f0338f1fd0336a2bb132d85644cca1ecfb30c79ff35b2e201abac0e98de05e079beabed68022d003455

                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\icon.ico

                            Filesize

                            1KB

                            MD5

                            f31ab27282cf444ef1f263320be6b705

                            SHA1

                            bde4d76ffc88d14e1128b4928ddd4639a7744b84

                            SHA256

                            1a3ec42f393635307ae2e369ef50a8eb0fbbe02cd2f82c4c6d3486d294ddcceb

                            SHA512

                            f6b803b087444de0cc6fa832c4be491c738c0d643895d844a861357e2b29257fe7ba91f2e4e61ee715a5b533b0449c14428f79ec651f3cfa3823eaaaa99ca367

                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\stub_settings.xml

                            Filesize

                            3KB

                            MD5

                            2391acf3d665a314dc57a953ff47f8ae

                            SHA1

                            f131b756f93ab510a9965ad73a3b8975a4cad33a

                            SHA256

                            a05e851b17fa09c057db0267f08129198b25161081386126adda1aa856f2d421

                            SHA512

                            6032397a4620ff4e766a7255f08adb1dbdb6898d95a936f7156a70165156e119a05b48a37d05698d43046ea9507204cc8e8190a43ccf46e73d6f961c69e94946

                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\wsmallstub.exe

                            Filesize

                            238KB

                            MD5

                            bebe87e70601cbc95c4a6bad2a2e986d

                            SHA1

                            f9620534bf97ff4ecaadd3afc3808d3abecdac65

                            SHA256

                            f1fe856f82e455e19d17f09e0b8529993aa540d4231c07065f0c28ecf0f25dd4

                            SHA512

                            dae6eabf8314529be871d56c4c573cc114309d77a5223f48227d0c13964cd6606efbe413e8b1fdd7624be89fc31be8caa7d299ed2e659f9c4e1982f21e1cffd2