Analysis
-
max time kernel
146s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 01:24
Static task
static1
Behavioral task
behavioral1
Sample
47a316095dd749f564bd65a1b9e476d6_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
47a316095dd749f564bd65a1b9e476d6_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
47a316095dd749f564bd65a1b9e476d6_JaffaCakes118.exe
-
Size
182KB
-
MD5
47a316095dd749f564bd65a1b9e476d6
-
SHA1
2621a9d605a109c6b0e3e7e6e838bd4ed6822fc6
-
SHA256
1ff92845ce256ac2f5cb303774c8f6c2c3017ff40f6437767a03fc5f33dbf9e2
-
SHA512
c62cc19991e7902039aa75903cf126aaf8cb9338216dbc0507199a63f010cb9ac6990e9ef306aa91dc0e565c4183f373d57cb1b4cdc46b918dfdf1925bd6dda8
-
SSDEEP
3072:SwaUpgvs33rFPGCWi87IG/x+YkU4U53EWTOXYXiHwXvjlkfro3gRum:sUQUxgIpYR55oe+wXRNwRl
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3212 msedge.exe 3212 msedge.exe 1812 msedge.exe 1812 msedge.exe 3484 identity_helper.exe 3484 identity_helper.exe 4348 msedge.exe 4348 msedge.exe 4348 msedge.exe 4348 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe 1812 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1332 wrote to memory of 1812 1332 47a316095dd749f564bd65a1b9e476d6_JaffaCakes118.exe 86 PID 1332 wrote to memory of 1812 1332 47a316095dd749f564bd65a1b9e476d6_JaffaCakes118.exe 86 PID 1812 wrote to memory of 3584 1812 msedge.exe 87 PID 1812 wrote to memory of 3584 1812 msedge.exe 87 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 5056 1812 msedge.exe 88 PID 1812 wrote to memory of 3212 1812 msedge.exe 89 PID 1812 wrote to memory of 3212 1812 msedge.exe 89 PID 1812 wrote to memory of 2884 1812 msedge.exe 90 PID 1812 wrote to memory of 2884 1812 msedge.exe 90 PID 1812 wrote to memory of 2884 1812 msedge.exe 90 PID 1812 wrote to memory of 2884 1812 msedge.exe 90 PID 1812 wrote to memory of 2884 1812 msedge.exe 90 PID 1812 wrote to memory of 2884 1812 msedge.exe 90 PID 1812 wrote to memory of 2884 1812 msedge.exe 90 PID 1812 wrote to memory of 2884 1812 msedge.exe 90 PID 1812 wrote to memory of 2884 1812 msedge.exe 90 PID 1812 wrote to memory of 2884 1812 msedge.exe 90 PID 1812 wrote to memory of 2884 1812 msedge.exe 90 PID 1812 wrote to memory of 2884 1812 msedge.exe 90 PID 1812 wrote to memory of 2884 1812 msedge.exe 90 PID 1812 wrote to memory of 2884 1812 msedge.exe 90 PID 1812 wrote to memory of 2884 1812 msedge.exe 90 PID 1812 wrote to memory of 2884 1812 msedge.exe 90 PID 1812 wrote to memory of 2884 1812 msedge.exe 90 PID 1812 wrote to memory of 2884 1812 msedge.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\47a316095dd749f564bd65a1b9e476d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\47a316095dd749f564bd65a1b9e476d6_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.flogao.com.br/kel9k/2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc601046f8,0x7ffc60104708,0x7ffc601047183⤵PID:3584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,14077504946024717501,8466657284164878519,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:23⤵PID:5056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,14077504946024717501,8466657284164878519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:33⤵
- Suspicious behavior: EnumeratesProcesses
PID:3212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,14077504946024717501,8466657284164878519,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:83⤵PID:2884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14077504946024717501,8466657284164878519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:13⤵PID:3792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14077504946024717501,8466657284164878519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:13⤵PID:2136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14077504946024717501,8466657284164878519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:13⤵PID:1976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14077504946024717501,8466657284164878519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:13⤵PID:4376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,14077504946024717501,8466657284164878519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:83⤵PID:4648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,14077504946024717501,8466657284164878519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 /prefetch:83⤵
- Suspicious behavior: EnumeratesProcesses
PID:3484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14077504946024717501,8466657284164878519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:13⤵PID:3956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14077504946024717501,8466657284164878519,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:13⤵PID:5040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14077504946024717501,8466657284164878519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:13⤵PID:4400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,14077504946024717501,8466657284164878519,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:13⤵PID:3520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,14077504946024717501,8466657284164878519,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2992 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:4348
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2364
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5c00b0d6e0f836dfa596c6df9d3b2f8f2
SHA169ad27d9b4502630728f98917f67307e9dd12a30
SHA256578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1
SHA5120e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da
-
Filesize
152B
MD554f1b76300ce15e44e5cc1a3947f5ca9
SHA1c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7
SHA25643dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24
SHA512ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a
-
Filesize
211KB
MD5151fb811968eaf8efb840908b89dc9d4
SHA17ec811009fd9b0e6d92d12d78b002275f2f1bee1
SHA256043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed
SHA51283aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize216B
MD5f71f42b79b44c0fb9cc7b565b161c078
SHA1c77cb2a30547c757a3e3d3d53ac09b9804f52361
SHA256636f00fd11cfbd30ceb49a93dea9da0dbfdc9a899150952ee060ea447eb66d3f
SHA512beb47d6c468662e6a2e38ef8c28ed9f51b685db0a7c8d51d8bea80964de44f1744c7565010ff1367b771d2cfeaab0a0b278fd8a2fcbb9167c6f4f3685e509d23
-
Filesize
955B
MD5d19f877a4db95a9f3b1e1e410d1bc93b
SHA1a60cccb5af28733b1a700872b70c253fdf2fc8cd
SHA25659c47618cd3f6a4b8965067c496b1094ae1eba5a2342e159b7a3a855e0692aa8
SHA51273c8511a0a455c08ac86ed61234123389557b4ed3a61fb457701353f07f60f953b6a89a8f3c82badd548b770bbbca30e72b9f32deb15065dcbdf6b46c1263c84
-
Filesize
6KB
MD53ccfc1735391f8ab9ccb62886cb26fb8
SHA115ec8f6fcecb152ca369b12a9874fbd3f65ca588
SHA256a605ebd5a422e52266b6b8ba76f8ed6d506a153a42f2fd463e9f13ae8f976c79
SHA512d65bb4d524cbc0708073d3bbe804ffb5063072ce7d6caa030a1b8af9ba87934d67635bb82fa25ed812f18e4e0a5d10dd78d00580a7453f34f2f4fd0a6a69a8a0
-
Filesize
6KB
MD518f1e310ff0e9f119f57332ad3412d66
SHA1c19586dca9979715b094bc279940263a24d6dae7
SHA25676acb10571f1e0d7ddacd46058f1ffccdab76d4838ddb74ff0e4242fdbd5f4d0
SHA512cae472996e55cbcbe3b1e6a267c0fec460ff16c3bef3aa453733eed804b7aca9b28e2ea0702101e80a7616d3feaebb81fefcd9bf6aed06476e565fa91a7bfa89
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD52da2b7b7dfbd4854184244674233e7f6
SHA1f16adae8489bb5a06a7e8589f301caff58973f53
SHA25677948605f856f698158108c78df2389be01e300e7036ef032db415127fb85630
SHA512bfee7147a4d29661d8ba5b51d40643b419415cae4f85309d7a1a61915b07cf571d261183dc14fd94537de5c6ae427a4889cc782b0965ebc3d66a22f6ed99303d