Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2024 21:08
Static task
static1
Behavioral task
behavioral1
Sample
885b287965b2fbf8395f7e4cd229414e_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
885b287965b2fbf8395f7e4cd229414e_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
885b287965b2fbf8395f7e4cd229414e_JaffaCakes118.exe
-
Size
207KB
-
MD5
885b287965b2fbf8395f7e4cd229414e
-
SHA1
22a9e855a9e0a1f6fc5b69e27bfe0fa39331d9ea
-
SHA256
1099b24ee851a29ebbe31e65843ea7454e53b865389952534809095a8ec3d6e8
-
SHA512
cadf79f1bc476ee6b8e11e2f691cc07175c8f1441712ebfbb0fcaf9df66abad1888b709e9f7aab3263e47e6d0c814e317e4fa646952bfef9d606bd4bcd7a8557
-
SSDEEP
6144:gz+92mhAMJ/cPl3iw7Tozlx/LVXHSPF0MfE:gK2mhAMJ/cPlNU7VXx
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation 885b287965b2fbf8395f7e4cd229414e_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4128 wsmallstub.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4128 wsmallstub.exe 4128 wsmallstub.exe 3208 msedge.exe 3208 msedge.exe 1412 msedge.exe 1412 msedge.exe 4932 identity_helper.exe 4932 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe 1412 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4128 wsmallstub.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4864 wrote to memory of 4128 4864 885b287965b2fbf8395f7e4cd229414e_JaffaCakes118.exe 83 PID 4864 wrote to memory of 4128 4864 885b287965b2fbf8395f7e4cd229414e_JaffaCakes118.exe 83 PID 4864 wrote to memory of 4128 4864 885b287965b2fbf8395f7e4cd229414e_JaffaCakes118.exe 83 PID 4128 wrote to memory of 1412 4128 wsmallstub.exe 94 PID 4128 wrote to memory of 1412 4128 wsmallstub.exe 94 PID 1412 wrote to memory of 5024 1412 msedge.exe 95 PID 1412 wrote to memory of 5024 1412 msedge.exe 95 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 2624 1412 msedge.exe 96 PID 1412 wrote to memory of 3208 1412 msedge.exe 97 PID 1412 wrote to memory of 3208 1412 msedge.exe 97 PID 1412 wrote to memory of 2304 1412 msedge.exe 98 PID 1412 wrote to memory of 2304 1412 msedge.exe 98 PID 1412 wrote to memory of 2304 1412 msedge.exe 98 PID 1412 wrote to memory of 2304 1412 msedge.exe 98 PID 1412 wrote to memory of 2304 1412 msedge.exe 98 PID 1412 wrote to memory of 2304 1412 msedge.exe 98 PID 1412 wrote to memory of 2304 1412 msedge.exe 98 PID 1412 wrote to memory of 2304 1412 msedge.exe 98 PID 1412 wrote to memory of 2304 1412 msedge.exe 98 PID 1412 wrote to memory of 2304 1412 msedge.exe 98 PID 1412 wrote to memory of 2304 1412 msedge.exe 98 PID 1412 wrote to memory of 2304 1412 msedge.exe 98 PID 1412 wrote to memory of 2304 1412 msedge.exe 98 PID 1412 wrote to memory of 2304 1412 msedge.exe 98 PID 1412 wrote to memory of 2304 1412 msedge.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\885b287965b2fbf8395f7e4cd229414e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\885b287965b2fbf8395f7e4cd229414e_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\wsmallstub.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\wsmallstub.exe" "C:\Users\Admin\AppData\Local\Temp\885b287965b2fbf8395f7e4cd229414e_JaffaCakes118.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ct543834.ourtoolbar.com/ie/?isorganic=true&requesterid=dmstub3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffcb62446f8,0x7ffcb6244708,0x7ffcb62447184⤵PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10634211110906313189,2384472729691766063,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:24⤵PID:2624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,10634211110906313189,2384472729691766063,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:3208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,10634211110906313189,2384472729691766063,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:84⤵PID:2304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10634211110906313189,2384472729691766063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:14⤵PID:5008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10634211110906313189,2384472729691766063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:14⤵PID:3404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10634211110906313189,2384472729691766063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:14⤵PID:3484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10634211110906313189,2384472729691766063,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:14⤵PID:2528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10634211110906313189,2384472729691766063,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:84⤵PID:3624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10634211110906313189,2384472729691766063,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:4932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10634211110906313189,2384472729691766063,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:14⤵PID:1924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10634211110906313189,2384472729691766063,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:14⤵PID:1888
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5104
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f53207a5ca2ef5c7e976cbb3cb26d870
SHA149a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA25619ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
SHA512be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize120B
MD5fc48abba64976257dbe15c471c36971e
SHA1e51f0322671bcb295bd802fbef49d14ff930229f
SHA256e1279bb22e4716148fea93d7f3626381ef6e019757d30a8b376379560f4330b0
SHA5121e83c386898da1c56a67304ddad8bf8e712e9600cc6e1632ad46db14e32655ba3a90a14cfffbc6b0596519f47a450e39fe99507c7d16120747fb6c00e0baf640
-
Filesize
637B
MD5fcf4957883d7e61db63748d5fb784074
SHA117febfde23cea14f46a56d9ad259bf38d972d26e
SHA2565ba3ca0b5b305741c25394b247cb8f93727e34f3d215df1b093d4c83f2088777
SHA512da3ec7a7e3d36e710bb11a7c739f472bb6c7f8578d1d98d5723aae8ed9f48d9aae983a19646b3a82450388e773bca380bb5199780c26fc6bbd78ad15e35764e4
-
Filesize
5KB
MD5033f4b415cf374ad168246de765a376b
SHA18dba9c38e25d74ed5a209c33c31d7acc6b866b26
SHA2563e8bcb780ec1ae85c6e51716fee8e86069cf11c0631b55828196d42e37d5d76c
SHA512fc329ab40d2f297b79d9c0bdae5fe614452145be8faa62acedbee70bb12c2646262e9f4ce94d0b249f2efb43b0513e9199ad7bf7ed46398e150d297c8cd7f91b
-
Filesize
6KB
MD5f18099ec312774420992a0c2b9e230c3
SHA1531ab51fba10a68dc9f7aeab0f0a03cf6c50f70a
SHA25669402ed5e15cc42c44ca41e3ad56e37c2edde1b63653293bef16c824ffe4f26c
SHA512071d0953222352b3326cdb889897d3a96abec018c984ff10352fd2e50175a078bd6a06c43b3bda0de5e6d8237549ba8b8db63604704645f8689532a2177b5616
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5fbf43f3151d76945b30ab64f4ae31473
SHA117039be7ce46682449aa1f60daea6989413e8d40
SHA25649640b0c48c2bdc70f4cf9bc79a2d684960a2b8c4adb65da7beb6b774c215968
SHA512aa2a70b03fe80d683ea5d7d937758dbf9a88fe6504cd1f0338f1fd0336a2bb132d85644cca1ecfb30c79ff35b2e201abac0e98de05e079beabed68022d003455
-
Filesize
1KB
MD5f31ab27282cf444ef1f263320be6b705
SHA1bde4d76ffc88d14e1128b4928ddd4639a7744b84
SHA2561a3ec42f393635307ae2e369ef50a8eb0fbbe02cd2f82c4c6d3486d294ddcceb
SHA512f6b803b087444de0cc6fa832c4be491c738c0d643895d844a861357e2b29257fe7ba91f2e4e61ee715a5b533b0449c14428f79ec651f3cfa3823eaaaa99ca367
-
Filesize
3KB
MD52391acf3d665a314dc57a953ff47f8ae
SHA1f131b756f93ab510a9965ad73a3b8975a4cad33a
SHA256a05e851b17fa09c057db0267f08129198b25161081386126adda1aa856f2d421
SHA5126032397a4620ff4e766a7255f08adb1dbdb6898d95a936f7156a70165156e119a05b48a37d05698d43046ea9507204cc8e8190a43ccf46e73d6f961c69e94946
-
Filesize
238KB
MD5bebe87e70601cbc95c4a6bad2a2e986d
SHA1f9620534bf97ff4ecaadd3afc3808d3abecdac65
SHA256f1fe856f82e455e19d17f09e0b8529993aa540d4231c07065f0c28ecf0f25dd4
SHA512dae6eabf8314529be871d56c4c573cc114309d77a5223f48227d0c13964cd6606efbe413e8b1fdd7624be89fc31be8caa7d299ed2e659f9c4e1982f21e1cffd2