Overview
overview
7Static
static
3JaffaCakes...e6.exe
windows10-2004-x64
7JaffaCakes...e6.exe
windows11-21h2-x64
7$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows11-21h2-x64
3$PROGRAMFI...un.exe
windows10-2004-x64
6$PROGRAMFI...un.exe
windows11-21h2-x64
6$PROGRAMFI...un.exe
windows10-2004-x64
6$PROGRAMFI...un.exe
windows11-21h2-x64
6$PROGRAMFI..._1.exe
windows10-2004-x64
3$PROGRAMFI..._1.exe
windows11-21h2-x64
3$PROGRAMFI..._1.exe
windows10-2004-x64
3$PROGRAMFI..._1.exe
windows11-21h2-x64
3$PROGRAMFI...as.dll
windows10-2004-x64
6$PROGRAMFI...as.dll
windows11-21h2-x64
6$PROGRAMFI...as.dll
windows10-2004-x64
6$PROGRAMFI...as.dll
windows11-21h2-x64
6$PROGRAMFI...ad.dll
windows10-2004-x64
3$PROGRAMFI...ad.dll
windows11-21h2-x64
3$PROGRAMFI...ad.dll
windows10-2004-x64
3$PROGRAMFI...ad.dll
windows11-21h2-x64
3$PROGRAMFI...tb.dll
windows10-2004-x64
3$PROGRAMFI...tb.dll
windows11-21h2-x64
3$PROGRAMFI...tb.dll
windows10-2004-x64
3$PROGRAMFI...tb.dll
windows11-21h2-x64
3$TEMP/~nsi...ad.dll
windows10-2004-x64
3$TEMP/~nsi...ad.dll
windows11-21h2-x64
3$WINDIR/Sy...vc.exe
windows10-2004-x64
3$WINDIR/Sy...vc.exe
windows11-21h2-x64
3Analysis
-
max time kernel
104s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20250619-en -
resource tags
arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2025, 18:04
Behavioral task
behavioral1
Sample
JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe
Resource
win10v2004-20250610-en
Behavioral task
behavioral2
Sample
JaffaCakes118_1c767504f104ee50e4b36d570ad425e6.exe
Resource
win11-20250619-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11-20250619-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win11-20250610-en
Behavioral task
behavioral7
Sample
$PROGRAMFILES/WebEdit/webedit_run.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral8
Sample
$PROGRAMFILES/WebEdit/webedit_run.exe
Resource
win11-20250619-en
Behavioral task
behavioral9
Sample
$PROGRAMFILES/WebEdit/webedit_run.exe
Resource
win10v2004-20250619-en
Behavioral task
behavioral10
Sample
$PROGRAMFILES/WebEdit/webedit_run.exe
Resource
win11-20250619-en
Behavioral task
behavioral11
Sample
$PROGRAMFILES/WebEdit/webedit_svc_10_1.exe
Resource
win10v2004-20250619-en
Behavioral task
behavioral12
Sample
$PROGRAMFILES/WebEdit/webedit_svc_10_1.exe
Resource
win11-20250502-en
Behavioral task
behavioral13
Sample
$PROGRAMFILES/WebEdit/webedit_svc_10_1.exe
Resource
win10v2004-20250502-en
Behavioral task
behavioral14
Sample
$PROGRAMFILES/WebEdit/webedit_svc_10_1.exe
Resource
win11-20250619-en
Behavioral task
behavioral15
Sample
$PROGRAMFILES/WebEdit/webeditas.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral16
Sample
$PROGRAMFILES/WebEdit/webeditas.dll
Resource
win11-20250610-en
Behavioral task
behavioral17
Sample
$PROGRAMFILES/WebEdit/webeditas.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral18
Sample
$PROGRAMFILES/WebEdit/webeditas.dll
Resource
win11-20250610-en
Behavioral task
behavioral19
Sample
$PROGRAMFILES/WebEdit/webeditasnad.dll
Resource
win10v2004-20250619-en
Behavioral task
behavioral20
Sample
$PROGRAMFILES/WebEdit/webeditasnad.dll
Resource
win11-20250610-en
Behavioral task
behavioral21
Sample
$PROGRAMFILES/WebEdit/webeditasnad.dll
Resource
win10v2004-20250619-en
Behavioral task
behavioral22
Sample
$PROGRAMFILES/WebEdit/webeditasnad.dll
Resource
win11-20250619-en
Behavioral task
behavioral23
Sample
$PROGRAMFILES/WebEdit/webeditastb.dll
Resource
win10v2004-20250502-en
Behavioral task
behavioral24
Sample
$PROGRAMFILES/WebEdit/webeditastb.dll
Resource
win11-20250619-en
Behavioral task
behavioral25
Sample
$PROGRAMFILES/WebEdit/webeditastb.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral26
Sample
$PROGRAMFILES/WebEdit/webeditastb.dll
Resource
win11-20250619-en
Behavioral task
behavioral27
Sample
$TEMP/~nsis/$_4_/webeditasnad.dll
Resource
win10v2004-20250610-en
Behavioral task
behavioral28
Sample
$TEMP/~nsis/$_4_/webeditasnad.dll
Resource
win11-20250619-en
Behavioral task
behavioral29
Sample
$WINDIR/System32/wediasvc.exe
Resource
win10v2004-20250619-en
Behavioral task
behavioral30
Sample
$WINDIR/System32/wediasvc.exe
Resource
win11-20250610-en
General
-
Target
$PROGRAMFILES/WebEdit/webedit_run.exe
-
Size
116KB
-
MD5
3ecd8cf00f91b91c963976b9bc63cf76
-
SHA1
ab6c0c285f2ed0d58e3528b995bef710af2cd6ca
-
SHA256
8f685def2789528b90dcc4d6f011f471df237f5729db1b771f8c04a579824dcb
-
SHA512
d731e26fa30cc9b6e96746baca19d916db4e589dfc5f10435cd6f10051623e2e39f1e37ea8de193e4ab9e749e83079f9f7927653668a4e28f0bf64dc5a1c0d57
-
SSDEEP
1536:Z4OjnnLDiKQqCmd49J2uSF0/cyqsMYdLY3wnD3Y0nmsB:Z4OTLDLovB/cyqsMYoy3Y0nR
Malware Config
Signatures
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA webedit_run.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language webedit_run.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1928 webedit_run.exe 1928 webedit_run.exe 1928 webedit_run.exe 1928 webedit_run.exe