6a60695f780b05caebb3748d009b2e0f336f7740981551bed21cfd5256ebb7b6

Analysis

max time kernel
137s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 00:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37a299e8bb3ff15788b4ecbe08c3c887_JaffaCakes118.exe
Size

696KB
MD5

37a299e8bb3ff15788b4ecbe08c3c887
SHA1

5ead3209cf9c8685a782ad178cca5c7093b9f97a
SHA256

6a60695f780b05caebb3748d009b2e0f336f7740981551bed21cfd5256ebb7b6
SHA512

2d86d682cdd19f73cadd97587a31949d011ef04a734c12382577b56faa1c317cc2eb23336ed6b5ab7c508e39f0b496547ffe1f7a2106ea75c405fa43198ee215
SSDEEP

12288:xHDBnqHkl0TP9I/WoBGKJM0yBAXlL4e7fpKJ+bnLZeZnpE0:llnakl0TPcZMt2L4e7fZjLZeZn60

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	37a299e8bb3ff15788b4ecbe08c3c887_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
636	msedge.exe
636	msedge.exe
548	msedge.exe
548	msedge.exe
3052	identity_helper.exe
3052	identity_helper.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe
548	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 548	3660	37a299e8bb3ff15788b4ecbe08c3c887_JaffaCakes118.exe	86
PID 3660 wrote to memory of 548	3660	37a299e8bb3ff15788b4ecbe08c3c887_JaffaCakes118.exe	86
PID 548 wrote to memory of 1764	548	msedge.exe	87
PID 548 wrote to memory of 1764	548	msedge.exe	87
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 4840	548	msedge.exe	88
PID 548 wrote to memory of 636	548	msedge.exe	89
PID 548 wrote to memory of 636	548	msedge.exe	89
PID 548 wrote to memory of 2356	548	msedge.exe	90
PID 548 wrote to memory of 2356	548	msedge.exe	90
PID 548 wrote to memory of 2356	548	msedge.exe	90
PID 548 wrote to memory of 2356	548	msedge.exe	90
PID 548 wrote to memory of 2356	548	msedge.exe	90
PID 548 wrote to memory of 2356	548	msedge.exe	90
PID 548 wrote to memory of 2356	548	msedge.exe	90
PID 548 wrote to memory of 2356	548	msedge.exe	90
PID 548 wrote to memory of 2356	548	msedge.exe	90
PID 548 wrote to memory of 2356	548	msedge.exe	90
PID 548 wrote to memory of 2356	548	msedge.exe	90
PID 548 wrote to memory of 2356	548	msedge.exe	90
PID 548 wrote to memory of 2356	548	msedge.exe	90
PID 548 wrote to memory of 2356	548	msedge.exe	90
PID 548 wrote to memory of 2356	548	msedge.exe	90
PID 548 wrote to memory of 2356	548	msedge.exe	90
PID 548 wrote to memory of 2356	548	msedge.exe	90
PID 548 wrote to memory of 2356	548	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\37a299e8bb3ff15788b4ecbe08c3c887_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\37a299e8bb3ff15788b4ecbe08c3c887_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.nch.com.au/burn/versions.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcad9f46f8,0x7ffcad9f4708,0x7ffcad9f4718
    3⤵
    PID:1764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,17888496884088633640,12596223889057019741,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,17888496884088633640,12596223889057019741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,17888496884088633640,12596223889057019741,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
    3⤵
    PID:2356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17888496884088633640,12596223889057019741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
    3⤵
    PID:368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17888496884088633640,12596223889057019741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
    3⤵
    PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,17888496884088633640,12596223889057019741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
    3⤵
    PID:736
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,17888496884088633640,12596223889057019741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17888496884088633640,12596223889057019741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
    3⤵
    PID:4604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17888496884088633640,12596223889057019741,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
    3⤵
    PID:3244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17888496884088633640,12596223889057019741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:2084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,17888496884088633640,12596223889057019741,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
    3⤵
    PID:3580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,17888496884088633640,12596223889057019741,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4924 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
9223bdc81ef6dfe23a21e79d64063d0c

SHA1
a0dbd7eb06264a3e4427e6cbc181615a87385388

SHA256
c6bca5f4903010a1ebe54c8101908c6790f3a7f8b0d98aa9f075908fe9229e47

SHA512
74af06850fc9c1ce60f9c6999bf207ae20a81a8210ff4b4399d93b59186201134a4d7cf253760ef5841e96239883597db49e62d621e63de4cb733e2dfbf531cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ed9fb6ee2dca37352175691e0119eccc

SHA1
9d3d1ac3f77dcae39dcebe94c0241c1c74bb5706

SHA256
adbbae836bdbe189803735b4bd4e4ecb3f6db15e811563e51e2cf9275d1b1d3e

SHA512
e366a12556f7a1c27c433fb17ab0219c80ef7cd48d715104dcd017ee0c239052c955a5ac05a161d01ab4424b6c942e1e71db4eb7ce29238d65070464aadd28a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1251f9ca18696f4605091834031379ab

SHA1
89431e75f5d4846f7e3a370aee3a3f84c84336b1

SHA256
d97bd5b1370a8bed75a0e1e40ed6da62d547e553b98e8f6772bc058872999ee0

SHA512
1b231b00bba15f81f8d1ec7a6fe2457a968e4acbda32ce54f8a1c4796ce8e657ab01b491bd6c325af45d19df1dc4f0013df34f5a0b1efdf9bf17b0bac27af397

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7feb61a0f720cbca9ec1df33009a52d8

SHA1
8b690fbfa0b712fc537d30e6e05aca25e8fe68b6

SHA256
0eed8de8a867b4c1750f2af9fc25623d93f7d6cb78e3ca120c4f15b07a0f46e0

SHA512
baa00d4beb79f271f4205c84c1b83a6a264827d1e9392a89333e4c5aa7e67be1ae2d5d3452730c60845c931a3434b49b3dfc27eec8e35dd76d25a1d47899b9fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e638f7f5-14f4-4e0e-8dd2-2e2b7e4cc2a3.tmp

Filesize
10KB

MD5
91902e293292ccb831e3abdf774a4ff7

SHA1
112b805fa9f7c36712a3de4e7051b3740b9765a8

SHA256
040a76af80f1c2fa6c10962f3568b7ffb7e27dc22a5194b0b53f4ee3302bb8bf

SHA512
f9b50cdd897fe031322c3bdc449694c9685851ae4ca827dddb9d6546a24bd0a5c378138b1d478712d8f3d13924ddea94416f09e5fda3d1524564e648a0cc6784

Download Submit