Overview
overview
7Static
static
3JaffaCakes...e6.exe
windows10-2004-x64
7JaffaCakes...e6.exe
windows11-21h2-x64
7$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows11-21h2-x64
3$PROGRAMFI...un.exe
windows10-2004-x64
6$PROGRAMFI...un.exe
windows11-21h2-x64
6$PROGRAMFI...un.exe
windows10-2004-x64
6$PROGRAMFI...un.exe
windows11-21h2-x64
6$PROGRAMFI..._1.exe
windows10-2004-x64
3$PROGRAMFI..._1.exe
windows11-21h2-x64
3$PROGRAMFI..._1.exe
windows10-2004-x64
3$PROGRAMFI..._1.exe
windows11-21h2-x64
3$PROGRAMFI...as.dll
windows10-2004-x64
6$PROGRAMFI...as.dll
windows11-21h2-x64
6$PROGRAMFI...as.dll
windows10-2004-x64
6$PROGRAMFI...as.dll
windows11-21h2-x64
6$PROGRAMFI...ad.dll
windows10-2004-x64
3$PROGRAMFI...ad.dll
windows11-21h2-x64
3$PROGRAMFI...ad.dll
windows10-2004-x64
3$PROGRAMFI...ad.dll
windows11-21h2-x64
3$PROGRAMFI...tb.dll
windows10-2004-x64
3$PROGRAMFI...tb.dll
windows11-21h2-x64
3$PROGRAMFI...tb.dll
windows10-2004-x64
3$PROGRAMFI...tb.dll
windows11-21h2-x64
3$TEMP/~nsi...ad.dll
windows10-2004-x64
3$TEMP/~nsi...ad.dll
windows11-21h2-x64
3$WINDIR/Sy...vc.exe
windows10-2004-x64
3$WINDIR/Sy...vc.exe
windows11-21h2-x64
3Analysis
-
max time kernel
121s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20250610-en -
resource tags
arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2025, 18:04
Behavioral task
behavioral1
Sample
JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe
Resource
win10v2004-20250610-en
Behavioral task
behavioral2
Sample
JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe
Resource
win11-20250619-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20250619-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win11-20250610-en
Behavioral task
behavioral7
Sample
$PROGRAMFILES/WebEdit/webedit_run.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral8
Sample
$PROGRAMFILES/WebEdit/webedit_run.exe
Resource
win11-20250619-en
Behavioral task
behavioral9
Sample
$PROGRAMFILES/WebEdit/webedit_run.exe
Resource
win10v2004-20250619-en
Behavioral task
behavioral10
Sample
$PROGRAMFILES/WebEdit/webedit_run.exe
Resource
win11-20250619-en
Behavioral task
behavioral11
Sample
$PROGRAMFILES/WebEdit/webedit_svc_10_1.exe
Resource
win10v2004-20250619-en
Behavioral task
behavioral12
Sample
$PROGRAMFILES/WebEdit/webedit_svc_10_1.exe
Resource
win11-20250502-en
Behavioral task
behavioral13
Sample
$PROGRAMFILES/WebEdit/webedit_svc_10_1.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral14
Sample
$PROGRAMFILES/WebEdit/webedit_svc_10_1.exe
Resource
win11-20250619-en
Behavioral task
behavioral15
Sample
$PROGRAMFILES/WebEdit/webeditas.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral16
Sample
$PROGRAMFILES/WebEdit/webeditas.dll
Resource
win11-20250610-en
Behavioral task
behavioral17
Sample
$PROGRAMFILES/WebEdit/webeditas.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral18
Sample
$PROGRAMFILES/WebEdit/webeditas.dll
Resource
win11-20250610-en
Behavioral task
behavioral19
Sample
$PROGRAMFILES/WebEdit/webeditasnad.dll
Resource
win10v2004-20250619-en
Behavioral task
behavioral20
Sample
$PROGRAMFILES/WebEdit/webeditasnad.dll
Resource
win11-20250610-en
Behavioral task
behavioral21
Sample
$PROGRAMFILES/WebEdit/webeditasnad.dll
Resource
win10v2004-20250619-en
Behavioral task
behavioral22
Sample
$PROGRAMFILES/WebEdit/webeditasnad.dll
Resource
win11-20250619-en
Behavioral task
behavioral23
Sample
$PROGRAMFILES/WebEdit/webeditastb.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral24
Sample
$PROGRAMFILES/WebEdit/webeditastb.dll
Resource
win11-20250619-en
Behavioral task
behavioral25
Sample
$PROGRAMFILES/WebEdit/webeditastb.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral26
Sample
$PROGRAMFILES/WebEdit/webeditastb.dll
Resource
win11-20250619-en
Behavioral task
behavioral27
Sample
$TEMP/~nsis/$_4_/webeditasnad.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral28
Sample
$TEMP/~nsis/$_4_/webeditasnad.dll
Resource
win11-20250619-en
Behavioral task
behavioral29
Sample
$WINDIR/System32/wediasvc.exe
Resource
win10v2004-20250619-en
Behavioral task
behavioral30
Sample
$WINDIR/System32/wediasvc.exe
Resource
win11-20250610-en
General
-
Target
JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe
-
Size
557KB
-
MD5
1c767504f104ee50e4b36d570ad425e6
-
SHA1
17573257e094e11addea4fbefd141da2c4ee9134
-
SHA256
76c838fd441934a2adc953d69d5e8415b0384e3cd3b2576fdeb0aa4d07148786
-
SHA512
eef8c13489b793ec92162f6905ad7ae77cec62ff3640dac9f4e415cc9074f42c07e321410926016114408cf7fbb55ec7f9226d4b33703e44291925f0b97d4f8f
-
SSDEEP
12288:O8pABEUrVmoPJbmwCvWau374XAHM88Y8/mFuIhYY:DAsiJbNBau374QOmb
Malware Config
Signatures
-
Executes dropped EXE 8 IoCs
pid Process 4500 wediasvc.exe 4528 wediasvc.exe 4628 wediasvc.exe 3012 webedit_svc_10_1.ex_ 4912 webedit_svc_10_1.ex_ 2336 webedit_svc_10_1.exe 2168 webedit_svc_10_1.exe 744 webedit_svc_10_1.exe -
Loads dropped DLL 11 IoCs
pid Process 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 2 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C9133CA1-662F-4237-80E3-B623C4D6E461} JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C9133CA1-662F-4237-80E3-B623C4D6E461}\ = "WebEdit_APIClass Helper" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\wediasvc.exe JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File created C:\Program Files (x86)\WebEdit\webedit_run.ex_ JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe File created C:\Program Files (x86)\WebEdit\webedit_svc_10_1.ex_ JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe File created C:\Program Files (x86)\WebEdit\webeditastb.dl_ JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe File created C:\Program Files (x86)\WebEdit\webeditas.dll JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe File created C:\Program Files (x86)\WebEdit\webedit_run.exe JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe File opened for modification C:\Program Files (x86)\WebEdit\Log\webedit_up_20250704.txt webedit_svc_10_1.exe File created C:\Program Files (x86)\WebEdit\uninst.exe JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe File created C:\Program Files (x86)\WebEdit\webeditas.dl_ JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe File created C:\Program Files (x86)\WebEdit\webeditasnad.dl_ JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe File opened for modification C:\Program Files (x86)\WebEdit\Log\webedit_up_20250704.txt webedit_svc_10_1.ex_ File created C:\Program Files (x86)\WebEdit\webeditasnad.dll JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe File created C:\Program Files (x86)\WebEdit\webeditastb.dll JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe File created C:\Program Files (x86)\WebEdit\webedit_svc_10_1.exe JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe File created C:\Program Files (x86)\WebEdit\webed_uins.dat JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language webedit_svc_10_1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wediasvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wediasvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language webedit_svc_10_1.ex_ Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language webedit_svc_10_1.ex_ Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language webedit_svc_10_1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wediasvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language webedit_svc_10_1.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\ButtonText = "À¥¿¡µðÆ® ¼³Á¤ ½ÇÇà" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\HotIcon = "C:\\Program Files (x86)\\WebEdit\\webeditastb.dll,202" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key deleted \REGISTRY\USER\S-1-5-21-155457276-1657131288-1088518942-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration webedit_svc_10_1.exe Set value (str) \REGISTRY\USER\S-1-5-21-155457276-1657131288-1088518942-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\ClsidExtension = "{053202B5-4539-4c5a-B531-42C754ABBD41}" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\USER\S-1-5-21-155457276-1657131288-1088518942-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{C9133CA1-662F-4237-80E3-B623C4D6E461} webedit_svc_10_1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\Icon = "C:\\Program Files (x86)\\WebEdit\\webeditastb.dll,201" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D}\Default Visible = "Yes" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\USER\S-1-5-21-155457276-1657131288-1088518942-1000\Software\Microsoft\Internet Explorer\MAO Settings webedit_svc_10_1.exe Set value (int) \REGISTRY\USER\S-1-5-21-155457276-1657131288-1088518942-1000\SOFTWARE\Microsoft\Internet Explorer\MAO Settings\AddonLoadTimeThreshold = "0" webedit_svc_10_1.exe Set value (int) \REGISTRY\USER\S-1-5-21-155457276-1657131288-1088518942-1000\SOFTWARE\Microsoft\Internet Explorer\MAO Settings\AddonLoadTimeThreshold = "10000" webedit_svc_10_1.exe Set value (int) \REGISTRY\USER\S-1-5-21-155457276-1657131288-1088518942-1000\SOFTWARE\Microsoft\Internet Explorer\MAO Settings\AddonLoadTimeThreshold = "1" webedit_svc_10_1.exe Key created \REGISTRY\USER\S-1-5-21-155457276-1657131288-1088518942-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration webedit_svc_10_1.exe Key created \REGISTRY\USER\S-1-5-21-155457276-1657131288-1088518942-1000\SOFTWARE\Microsoft\Internet Explorer\Main JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extensions\{0A07354E-A092-490f-9597-BA096721A26D} JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ webedit_svc_10_1.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" webedit_svc_10_1.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" webedit_svc_10_1.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" webedit_svc_10_1.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" webedit_svc_10_1.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AF8745A4-A31D-4884-9901-515F5919312D}\TypeLib\Version = "1.0" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF8745A4-A31D-4884-9901-515F5919312D}\ = "IWebEdit_API" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF8745A4-A31D-4884-9901-515F5919312D}\TypeLib JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{053202B5-4539-4c5a-B531-42C754ABBD41}\InprocServer32\ = "C:\\Program Files (x86)\\WebEdit\\webeditastb.dll" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WebEdit_BHO.WebEdit_APIClass.1\ = "WebEdit_APIClass Class" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WebEdit_BHO.WebEdit_APIClass\ = "WebEdit_APIClass Class" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BB85FDDB-C266-4906-93B8-498B939B07E6} JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A66A7BD4-06B1-4377-ADCD-6A8A2631CA45}\1.0\FLAGS JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD6A85C5-36CB-44CF-9D3E-37F09E79D51D}\TypeLib JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C9133CA1-662F-4237-80E3-B623C4D6E461}\TypeLib JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BB85FDDB-C266-4906-93B8-498B939B07E6}\1.0\0\win32 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AD6A85C5-36CB-44CF-9D3E-37F09E79D51D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AD6A85C5-36CB-44CF-9D3E-37F09E79D51D}\TypeLib JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C9133CA1-662F-4237-80E3-B623C4D6E461}\InprocServer32 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WebEdit_BHO.WebEdit_APIClass\CurVer JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.application\sid = "QzkxMzNDQTEtNjYyRi00MjM3LTgwRTMtQjYyM0M0RDZFNDYx" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C9133CA1-662F-4237-80E3-B623C4D6E461}\ = "WebEdit Web3.0" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C9133CA1-662F-4237-80E3-B623C4D6E461}\ProgID\ = "WebEdit_BHO.WebEdit_APIClass.1" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF8745A4-A31D-4884-9901-515F5919312D}\ProxyStubClsid32 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\webedit_tb.webedit_tbObject.1 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\webedit_tb.webedit_tbObject.1\CLSID JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BB85FDDB-C266-4906-93B8-498B939B07E6}\1.0\ = "WebEdit_APIClass 1.0 Type Library" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF8745A4-A31D-4884-9901-515F5919312D}\TypeLib\Version = "1.0" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\webedit_tb.webedit_tbObject\CLSID\ = "{053202B5-4539-4c5a-B531-42C754ABBD41}" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\webedit_tb.webedit_tbObject\CurVer\ = "webedit_tb.webedit_tbObject.1" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{053202B5-4539-4c5a-B531-42C754ABBD41}\ProgID JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A66A7BD4-06B1-4377-ADCD-6A8A2631CA45}\1.0\ = "webedit_tb 1.0 Type Library" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AD6A85C5-36CB-44CF-9D3E-37F09E79D51D}\ProxyStubClsid32 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD6A85C5-36CB-44CF-9D3E-37F09E79D51D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WebEdit_BHO.WebEdit_APIClass\CLSID JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF8745A4-A31D-4884-9901-515F5919312D} JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\webedit_tb.webedit_tbObject.1\CLSID\ = "{053202B5-4539-4c5a-B531-42C754ABBD41}" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C9133CA1-662F-4237-80E3-B623C4D6E461}\TypeLib\ = "{BB85FDDB-C266-4906-93B8-498B939B07E6}" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BB85FDDB-C266-4906-93B8-498B939B07E6}\1.0\HELPDIR JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AF8745A4-A31D-4884-9901-515F5919312D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\webedit_tb.webedit_tbObject\CLSID JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AD6A85C5-36CB-44CF-9D3E-37F09E79D51D}\ = "Iwebedit_tbObject" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WebEdit_BHO.WebEdit_APIClass.1\CLSID\ = "{C9133CA1-662F-4237-80E3-B623C4D6E461}" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C9133CA1-662F-4237-80E3-B623C4D6E461}\VersionIndependentProgID JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{053202B5-4539-4c5a-B531-42C754ABBD41}\TypeLib JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A66A7BD4-06B1-4377-ADCD-6A8A2631CA45}\1.0\HELPDIR JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD6A85C5-36CB-44CF-9D3E-37F09E79D51D} JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C9133CA1-662F-4237-80E3-B623C4D6E461}\ProgID JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BB85FDDB-C266-4906-93B8-498B939B07E6}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\WebEdit\\" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AF8745A4-A31D-4884-9901-515F5919312D}\ProxyStubClsid32 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\webedit_tb.webedit_tbObject.1\ = "webedit_tbObject Class" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{053202B5-4539-4c5a-B531-42C754ABBD41}\VersionIndependentProgID\ = "webedit_tb.webedit_tbObject" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD6A85C5-36CB-44CF-9D3E-37F09E79D51D}\ProxyStubClsid32 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD6A85C5-36CB-44CF-9D3E-37F09E79D51D}\TypeLib\ = "{A66A7BD4-06B1-4377-ADCD-6A8A2631CA45}" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WebEdit_BHO.WebEdit_APIClass.1 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C9133CA1-662F-4237-80E3-B623C4D6E461}\InprocServer32\ = "C:\\Program Files (x86)\\WebEdit\\webeditas.dll" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BB85FDDB-C266-4906-93B8-498B939B07E6}\1.0\0\win32\ = "C:\\Program Files (x86)\\WebEdit\\webeditas.dll" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AF8745A4-A31D-4884-9901-515F5919312D}\TypeLib JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A66A7BD4-06B1-4377-ADCD-6A8A2631CA45}\1.0\FLAGS\ = "0" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A66A7BD4-06B1-4377-ADCD-6A8A2631CA45}\1.0\0\win32\ = "C:\\Program Files (x86)\\WebEdit\\webeditastb.dll" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WebEdit_BHO.WebEdit_APIClass\CurVer\ = "WebEdit_BHO.WebEdit_APIClass.1" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C9133CA1-662F-4237-80E3-B623C4D6E461}\VersionIndependentProgID\ = "WebEdit_BHO.WebEdit_APIClass" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AF8745A4-A31D-4884-9901-515F5919312D} JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AD6A85C5-36CB-44CF-9D3E-37F09E79D51D}\TypeLib\ = "{A66A7BD4-06B1-4377-ADCD-6A8A2631CA45}" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C9133CA1-662F-4237-80E3-B623C4D6E461} JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\webedit_tb.webedit_tbObject\CurVer JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A66A7BD4-06B1-4377-ADCD-6A8A2631CA45}\1.0 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A66A7BD4-06B1-4377-ADCD-6A8A2631CA45}\1.0\0 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD6A85C5-36CB-44CF-9D3E-37F09E79D51D}\TypeLib\Version = "1.0" JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2660 wrote to memory of 4500 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 90 PID 2660 wrote to memory of 4500 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 90 PID 2660 wrote to memory of 4500 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 90 PID 2660 wrote to memory of 4528 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 91 PID 2660 wrote to memory of 4528 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 91 PID 2660 wrote to memory of 4528 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 91 PID 2660 wrote to memory of 3012 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 97 PID 2660 wrote to memory of 3012 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 97 PID 2660 wrote to memory of 3012 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 97 PID 2660 wrote to memory of 4912 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 101 PID 2660 wrote to memory of 4912 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 101 PID 2660 wrote to memory of 4912 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 101 PID 2660 wrote to memory of 2336 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 102 PID 2660 wrote to memory of 2336 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 102 PID 2660 wrote to memory of 2336 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 102 PID 2660 wrote to memory of 2168 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 103 PID 2660 wrote to memory of 2168 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 103 PID 2660 wrote to memory of 2168 2660 JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe 103 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext webedit_svc_10_1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\DisableAddonLoadTimePerformanceNotifications = "1" webedit_svc_10_1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\wediasvc.exe"C:\Windows\System32\wediasvc.exe" /i2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4500
-
-
C:\Windows\SysWOW64\wediasvc.exe"C:\Windows\System32\wediasvc.exe" /start2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4528
-
-
C:\Program Files (x86)\WebEdit\webedit_svc_10_1.ex_"C:\Program Files (x86)\WebEdit\webedit_svc_10_1.ex_" /stop2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3012
-
-
C:\Program Files (x86)\WebEdit\webedit_svc_10_1.ex_"C:\Program Files (x86)\WebEdit\webedit_svc_10_1.ex_" /u2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4912
-
-
C:\Program Files (x86)\WebEdit\webedit_svc_10_1.exe"C:\Program Files (x86)\WebEdit\webedit_svc_10_1.exe" /i2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2336
-
-
C:\Program Files (x86)\WebEdit\webedit_svc_10_1.exe"C:\Program Files (x86)\WebEdit\webedit_svc_10_1.exe" /start2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2168
-
-
C:\Windows\SysWOW64\wediasvc.exeC:\Windows\SysWOW64\wediasvc.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4628
-
C:\Program Files (x86)\WebEdit\webedit_svc_10_1.exe"C:\Program Files (x86)\WebEdit\webedit_svc_10_1.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- System policy modification
PID:744
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
225B
MD57c900881083a5c4939178e2a8d3bde0d
SHA133cf6b98a93363d37826fe306d7de612e007eb0b
SHA25691c15821b7b82ca02a0b04f9dd9dab53d7a0129171f2d7bd70377e5ac8b1b99c
SHA5125ebe6eaa174cd1261b4378ee74d1e35cd0779d4a6cb5bf13de8430fe4c8b37032cd685701986378c5976ad9fb7c1dfa743404dda46c6220b5ab851bbd2b0c69c
-
Filesize
116KB
MD53ecd8cf00f91b91c963976b9bc63cf76
SHA1ab6c0c285f2ed0d58e3528b995bef710af2cd6ca
SHA2568f685def2789528b90dcc4d6f011f471df237f5729db1b771f8c04a579824dcb
SHA512d731e26fa30cc9b6e96746baca19d916db4e589dfc5f10435cd6f10051623e2e39f1e37ea8de193e4ab9e749e83079f9f7927653668a4e28f0bf64dc5a1c0d57
-
Filesize
116KB
MD5d28bfd9699316ce06bfacbcfe2e3a070
SHA1eab8e6d4cfa3206e8f6ff4d952b40f892cf61857
SHA256b8ee282cb4f46b9e488c9453e068717b6a1fa563cfc311dedfa46de6eee8114b
SHA5125a6157e3894a05bc8b9d2499edea82722ec0efc91dcb4f936a81d30c315f719bb1d05f1ea7759b3df4583fede523fa4d38669acbed3506846f5fb8f9e5b15a35
-
Filesize
124KB
MD5dbdea5c4344bdf803f9c729b50d34784
SHA1ee5d296eb6253e7111ed730130d367ee27b484a3
SHA25657bf22f2b9090f76a290d25fc9f50b348fc164967f780609137f5eb8e32e81d2
SHA512a97f4818b28278ec952876ec9aa78d98920d56c44b6d9be5d0f5802fccd6f65f64bf99606f65b9123d1d69a37ba96d3282fad71e38fbb9a499e78e90c5999c36
-
Filesize
128KB
MD501b2ebdce1620b25c427dd6baf53cfcf
SHA1c2338455badf1334504a18e8d9656b3e8081568f
SHA256f37eb1a447265cf1ceb3a0ca4a222d882ecef7dc47823a402089964ec59a5a03
SHA512c969200594e8333e634805b74bf1ba0e3e87f27967891bf1c71e4703a377f7aed94a24e28806aab3c7dbf771a1bd7e122b160e13da766f76253e3e527e60f9ee
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
4KB
MD58f4ac52cb2f7143f29f114add12452ad
SHA129dc25f5d69bf129d608b83821c8ec8ab8c8edb3
SHA256b214d73aea95191f7363ad93cdc12b6fbd50a3a54b0aa891b3d45bc4b7b2aa04
SHA5122f9e2c7450557c2b88a12d3a3b4ab999c9f2a4df0d39dcd795b307b89855387bc96fc6d4fb51de8f33de0780e08a3b15fdad43daeaf7373cca71b01d7afdaf0c
-
Filesize
660KB
MD54be0eaa3af20fb4df00ee2d3b2aa23be
SHA1a9ebc381554d5f8ea259222490c39de185722045
SHA256d7c4ebe96ba07d9497522d6cc0458fd2fdb9d818f77218ede1522a2bc2e06613
SHA51253bbfede46fb15c50e72af8c59cc9af4f3cd1910a28a802fb0cba0f8d4cbddf6520e08cef35d15734712da46951987fe69964b9a3b95424fc7158cd981eab5c4
-
Filesize
76KB
MD53b028967fc6640218a6aae5849e78750
SHA1304de482ece28e6cf9a2766af335646942e67995
SHA25642c98ad3c8c30a3553444d35e03f1911b1d0e3719ad642a26733d47ab6f031d5
SHA51287084aa97cc74dd883d401bcf43b2a260edfe19cb5950b2e0b04bb6091d277b5fa76abbd50961cffb2f96c2ac929fd3658afeff29f30a16cd06356a9c30bfc9a