Overview
overview
7Static
static
3JaffaCakes...98.exe
windows7-x64
7JaffaCakes...98.exe
windows10-2004-x64
7$0/Resourc...d.html
windows7-x64
3$0/Resourc...d.html
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...n.html
windows7-x64
3$PLUGINSDI...n.html
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PROGRAMFI...gs.exe
windows7-x64
3$PROGRAMFI...gs.exe
windows10-2004-x64
3$PROGRAMFI...ot.dll
windows7-x64
3$PROGRAMFI...ot.dll
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/01/2025, 12:04
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_e69c5c6b034d010bb57126bf82813198.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_e69c5c6b034d010bb57126bf82813198.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$0/Resources/BrowserSearch/alot_search_defend.html
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$0/Resources/BrowserSearch/alot_search_defend.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/eula_en.html
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/eula_en.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/installhelper.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/installhelper.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$PROGRAMFILES/alot/bin/ALOTSettings.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$PROGRAMFILES/alot/bin/ALOTSettings.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$PROGRAMFILES/alot/bin/alot.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
$PROGRAMFILES/alot/bin/alot.dll
Resource
win10v2004-20241007-en
General
-
Target
$PLUGINSDIR/eula_en.html
-
Size
11KB
-
MD5
f8aee788c2a09699cd4d607e1db670c8
-
SHA1
6457b766f043d901a6dd204d00626c4bea02d503
-
SHA256
503477569d8a48c47c4febbfd4ae6d3cb036856432c8212dcb0226580e7034c9
-
SHA512
424ef5a4f2653b27b3ca921c35e5e36f28c41ddfe9bcd6b5aba7968d87129826770777fbbfcdc78fce8512c1dce819be0e355282d4a729580591ff296a751162
-
SSDEEP
192:CuJ1IwC9cgY49ui3RkHXh4Uy0nzlb/1J3GaocWtS3oHoPho6Sxj66riCmQ:PJCN9tY4Ui3ROxJ1d/GBtW2xj66OQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4708 msedge.exe 4708 msedge.exe 4320 msedge.exe 4320 msedge.exe 2416 identity_helper.exe 2416 identity_helper.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4320 wrote to memory of 2108 4320 msedge.exe 82 PID 4320 wrote to memory of 2108 4320 msedge.exe 82 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4108 4320 msedge.exe 83 PID 4320 wrote to memory of 4708 4320 msedge.exe 84 PID 4320 wrote to memory of 4708 4320 msedge.exe 84 PID 4320 wrote to memory of 3744 4320 msedge.exe 85 PID 4320 wrote to memory of 3744 4320 msedge.exe 85 PID 4320 wrote to memory of 3744 4320 msedge.exe 85 PID 4320 wrote to memory of 3744 4320 msedge.exe 85 PID 4320 wrote to memory of 3744 4320 msedge.exe 85 PID 4320 wrote to memory of 3744 4320 msedge.exe 85 PID 4320 wrote to memory of 3744 4320 msedge.exe 85 PID 4320 wrote to memory of 3744 4320 msedge.exe 85 PID 4320 wrote to memory of 3744 4320 msedge.exe 85 PID 4320 wrote to memory of 3744 4320 msedge.exe 85 PID 4320 wrote to memory of 3744 4320 msedge.exe 85 PID 4320 wrote to memory of 3744 4320 msedge.exe 85 PID 4320 wrote to memory of 3744 4320 msedge.exe 85 PID 4320 wrote to memory of 3744 4320 msedge.exe 85 PID 4320 wrote to memory of 3744 4320 msedge.exe 85 PID 4320 wrote to memory of 3744 4320 msedge.exe 85 PID 4320 wrote to memory of 3744 4320 msedge.exe 85 PID 4320 wrote to memory of 3744 4320 msedge.exe 85 PID 4320 wrote to memory of 3744 4320 msedge.exe 85 PID 4320 wrote to memory of 3744 4320 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\eula_en.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb382446f8,0x7ffb38244708,0x7ffb382447182⤵PID:2108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,12447320131399961991,17205116669284315285,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:22⤵PID:4108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,12447320131399961991,17205116669284315285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,12447320131399961991,17205116669284315285,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:82⤵PID:3744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12447320131399961991,17205116669284315285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:2776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12447320131399961991,17205116669284315285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:4172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,12447320131399961991,17205116669284315285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:82⤵PID:3988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,12447320131399961991,17205116669284315285,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4972 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12447320131399961991,17205116669284315285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:12⤵PID:468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12447320131399961991,17205116669284315285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:12⤵PID:1164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12447320131399961991,17205116669284315285,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:12⤵PID:4860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,12447320131399961991,17205116669284315285,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:12⤵PID:1564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,12447320131399961991,17205116669284315285,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5440 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4444
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4692
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1252
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5fab8d8d865e33fe195732aa7dcb91c30
SHA12637e832f38acc70af3e511f5eba80fbd7461f2c
SHA2561b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea
SHA51239a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43
-
Filesize
152B
MD536988ca14952e1848e81a959880ea217
SHA1a0482ef725657760502c2d1a5abe0bb37aebaadb
SHA256d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6
SHA512d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173
-
Filesize
5KB
MD54448f053ba558dcb3f60dfeb72d45606
SHA1b2531167ca0b8e2bc5d25188634b9b8ad28344f9
SHA256d1f72c167ff4180b544531490e3a10319a9a12530703060b212e8e8a5c9cf0c2
SHA512f50fa164ed874516c7f2740b6cec91bdbfd99200e19f5a99d2546016cd846127ae605e1e33d07818c68ee7122ac8b7c0e3ed9203405fcd2c596102443852ec9d
-
Filesize
6KB
MD5b6d133de7288c1667a7863436d44e08e
SHA19a29b8f78f213287b9342edaac6cf3f8f8cec054
SHA256d752e674412cbc15b20cecb0405993fdd3198b9909becd6db56635aef6622de5
SHA5126c31aa70055f8632e7e0d5b266fcb96613f446e60e05a6275553b34a3b9b30c2ebbb9d61e6aea6c538ff4cb1707642e8c97ea0490b8208c499beca0af3f61157
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD591d42331303359dc9bf1479ce69963a5
SHA182ebda47e6b35d852dc06d61a309454635db9dff
SHA256eb78a54883ff9218cb4c78e017bd0b431241aa2d6a926d3c22024fb2550095b5
SHA512431b7693f65e59fc4ddfebe0ebe2c3193ec6c183d3d370c5c94d91ed7a7bf399106b72c6c7549078b3100d10ba48de538cb7fdc983ff629c6643f23052a468b0