d7e9347cff0a57ab6c738085d72a0f9136cab62319b8c717963559041979d9a7

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b8a81b61fe1a1ece80f40852d03a6ca_JaffaCakes118.exe
Size

11KB
MD5

1b8a81b61fe1a1ece80f40852d03a6ca
SHA1

744e9682a04e8c00d3730cd542ac5e7ad77c11f8
SHA256

d7e9347cff0a57ab6c738085d72a0f9136cab62319b8c717963559041979d9a7
SHA512

36105817650ace5c0d84c2373d545f4b39b91c258798993d50ba8f3d2bd83b0b7e8939cb10f6f750740e035f7041390d7349e89ea71928afb1db0338fbac8399
SSDEEP

192:eWIuXzIbJXS/3VGIqEhMiqOHSEMKkGWrrCFBVu7Br9ZCspE+TMIr3/bjOg+vtwJF:JIuyCvk/EhM/OyEJtWrSBVLeME/bjkg

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4724-0-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/4724-1-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
1300	msedge.exe
1300	msedge.exe
3416	identity_helper.exe
3416	identity_helper.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe
4692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4724	1b8a81b61fe1a1ece80f40852d03a6ca_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 1300	4724	1b8a81b61fe1a1ece80f40852d03a6ca_JaffaCakes118.exe	82
PID 4724 wrote to memory of 1300	4724	1b8a81b61fe1a1ece80f40852d03a6ca_JaffaCakes118.exe	82
PID 1300 wrote to memory of 1108	1300	msedge.exe	83
PID 1300 wrote to memory of 1108	1300	msedge.exe	83
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5044	1300	msedge.exe	84
PID 1300 wrote to memory of 5080	1300	msedge.exe	85
PID 1300 wrote to memory of 5080	1300	msedge.exe	85
PID 1300 wrote to memory of 2548	1300	msedge.exe	86
PID 1300 wrote to memory of 2548	1300	msedge.exe	86
PID 1300 wrote to memory of 2548	1300	msedge.exe	86
PID 1300 wrote to memory of 2548	1300	msedge.exe	86
PID 1300 wrote to memory of 2548	1300	msedge.exe	86
PID 1300 wrote to memory of 2548	1300	msedge.exe	86
PID 1300 wrote to memory of 2548	1300	msedge.exe	86
PID 1300 wrote to memory of 2548	1300	msedge.exe	86
PID 1300 wrote to memory of 2548	1300	msedge.exe	86
PID 1300 wrote to memory of 2548	1300	msedge.exe	86
PID 1300 wrote to memory of 2548	1300	msedge.exe	86
PID 1300 wrote to memory of 2548	1300	msedge.exe	86
PID 1300 wrote to memory of 2548	1300	msedge.exe	86
PID 1300 wrote to memory of 2548	1300	msedge.exe	86
PID 1300 wrote to memory of 2548	1300	msedge.exe	86
PID 1300 wrote to memory of 2548	1300	msedge.exe	86
PID 1300 wrote to memory of 2548	1300	msedge.exe	86
PID 1300 wrote to memory of 2548	1300	msedge.exe	86

C:\Users\Admin\AppData\Local\Temp\1b8a81b61fe1a1ece80f40852d03a6ca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1b8a81b61fe1a1ece80f40852d03a6ca_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ads.regiedepub.com/cgi-bin/advert/getads?tohto=titi&did=1077&soso=sisih
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x40,0xb4,0xe0,0x108,0x7ffd510a46f8,0x7ffd510a4708,0x7ffd510a4718
    3⤵
    PID:1108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,4815818342767779266,714164905587105316,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,4815818342767779266,714164905587105316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,4815818342767779266,714164905587105316,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
    3⤵
    PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4815818342767779266,714164905587105316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4815818342767779266,714164905587105316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
    3⤵
    PID:2892
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,4815818342767779266,714164905587105316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
    3⤵
    PID:1812
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,4815818342767779266,714164905587105316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4815818342767779266,714164905587105316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4815818342767779266,714164905587105316,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
    3⤵
    PID:4332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4815818342767779266,714164905587105316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,4815818342767779266,714164905587105316,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
    3⤵
    PID:2656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,4815818342767779266,714164905587105316,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1324 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9081c34e133c32d02f593df88f047a

SHA1
a0da007c14fd0591091924edc44bee90456700c6

SHA256
c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e

SHA512
12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3a09f853479af373691d131247040276

SHA1
1b6f098e04da87e9cf2d3284943ec2144f36ac04

SHA256
a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f

SHA512
341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
9f7407350bfad0a47fe3489a658ad2ad

SHA1
c3a9dd13a351c39c439e5f9020dcc15511c6a235

SHA256
a648fd692e072b159b89b5b119f4150a8fb69bb77ab6a0a109de8ec51174f879

SHA512
02bc51ebd635cf335ffe0ebb525fded72ed7848140a3bad3e27dd3ce6718941f26badd354e062c8f3de842d90e5611a96ba87de9e44f18417e22341b07aa8b16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
18ae8b9436f9c8d7787654c986675673

SHA1
d26d83b1c45729334ef30e526f6a2a9fdbd41da4

SHA256
261cd80c102d97f13e2d3968bed3ae8d6c19add81bfdea99404ed1b73b8fdd57

SHA512
0f0602f2b16055d90174c30d9c2ccc1ddb9630ff4cc3806e147261c712dd72e5b9a6bc7cb79701c3a739445de599c6cb4fa880060f2d6bd4641929824b39200e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9d223235e3fb2b5122ab6c2a11ba7bb2

SHA1
740ab108fed1aab9e59eae3be39736cd35383544

SHA256
0ed8e657387c75671926760812e942a312e46e6b35d3b26f3d8d0b22daf11f0f

SHA512
438f559c7b519bf6ccbafba050ecc91fe975824b02114eca60bd4352986ee9be7c5cefb2589c46593b3ca9ccd1a94cea7e5d4ffb79c250d81bef183aa3803178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3c2b833047597e9ab0b5bb08a6dc422c

SHA1
9f590de4ff1b6a91d96173f80c8cab0fcc4e5fa5

SHA256
518ba189fbf368d8686a414d0fb888b46720db87aa7fe8fa1c806534473ab3ee

SHA512
44b0ef3d414b87eaa6c037b98b497ada3d99334ce9919ff3a692c9bab937aff8680a6eac2f3d40f733f29d869dfad82fe0c7b8bae7fa01f8b585867662cb6d01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7b7eba70f4ebd915a30aa3fdd28a0022

SHA1
e8c69eb0f1c7579a85bee1f49e512232f847ec73

SHA256
570844b609be6514435a0edb1d1e5de3f26a8d558234e1e976d552e957fe096e

SHA512
2fa2d98dd4b63cfb53f9423fa196131e2472880a178fd3db11e9c4e441235934c627a9b9a74e7b7fae62c3daf03ff17e7dd23f9fa439a07c267ab929d1e3033d

Download Submit
memory/4724-0-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/4724-1-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download