Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 01:54
Static task
static1
Behavioral task
behavioral1
Sample
32dda56e4a89b255773d0f584a01e152_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
32dda56e4a89b255773d0f584a01e152_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
32dda56e4a89b255773d0f584a01e152_JaffaCakes118.html
-
Size
122KB
-
MD5
32dda56e4a89b255773d0f584a01e152
-
SHA1
3ff337c11a2d1262096466b9c648d93f95dd5151
-
SHA256
607fce1a8e485762046b0d16325656ed91568950cd97c6b5af748a83715dc43a
-
SHA512
ce4a42ad16d492bdf53f08e146d78529d1a6c4dae734ff33c201ad0c4764c01457f85eeebc1e00e3276efb87be5269410643a7cb105bf3eb15b92acf0c1142b2
-
SSDEEP
1536:h3kkEqiMV2mtP1QD99PYL2AmA5vY9qiHkY:enqiMV2mED99gSW5vMEY
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4992 msedge.exe 4992 msedge.exe 3296 msedge.exe 3296 msedge.exe 1284 msedge.exe 1284 msedge.exe 1284 msedge.exe 1284 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe 3296 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3296 wrote to memory of 4280 3296 msedge.exe 81 PID 3296 wrote to memory of 4280 3296 msedge.exe 81 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 1764 3296 msedge.exe 83 PID 3296 wrote to memory of 4992 3296 msedge.exe 84 PID 3296 wrote to memory of 4992 3296 msedge.exe 84 PID 3296 wrote to memory of 1300 3296 msedge.exe 85 PID 3296 wrote to memory of 1300 3296 msedge.exe 85 PID 3296 wrote to memory of 1300 3296 msedge.exe 85 PID 3296 wrote to memory of 1300 3296 msedge.exe 85 PID 3296 wrote to memory of 1300 3296 msedge.exe 85 PID 3296 wrote to memory of 1300 3296 msedge.exe 85 PID 3296 wrote to memory of 1300 3296 msedge.exe 85 PID 3296 wrote to memory of 1300 3296 msedge.exe 85 PID 3296 wrote to memory of 1300 3296 msedge.exe 85 PID 3296 wrote to memory of 1300 3296 msedge.exe 85 PID 3296 wrote to memory of 1300 3296 msedge.exe 85 PID 3296 wrote to memory of 1300 3296 msedge.exe 85 PID 3296 wrote to memory of 1300 3296 msedge.exe 85 PID 3296 wrote to memory of 1300 3296 msedge.exe 85 PID 3296 wrote to memory of 1300 3296 msedge.exe 85 PID 3296 wrote to memory of 1300 3296 msedge.exe 85 PID 3296 wrote to memory of 1300 3296 msedge.exe 85 PID 3296 wrote to memory of 1300 3296 msedge.exe 85 PID 3296 wrote to memory of 1300 3296 msedge.exe 85 PID 3296 wrote to memory of 1300 3296 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\32dda56e4a89b255773d0f584a01e152_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e45146f8,0x7ff9e4514708,0x7ff9e45147182⤵PID:4280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,1298274926325340076,7196293003189333778,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:22⤵PID:1764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,1298274926325340076,7196293003189333778,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,1298274926325340076,7196293003189333778,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:82⤵PID:1300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,1298274926325340076,7196293003189333778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:12⤵PID:4812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,1298274926325340076,7196293003189333778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:2764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,1298274926325340076,7196293003189333778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:12⤵PID:4708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,1298274926325340076,7196293003189333778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:12⤵PID:2140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,1298274926325340076,7196293003189333778,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:12⤵PID:844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,1298274926325340076,7196293003189333778,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1284
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2060
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5584971c8ba88c824fd51a05dddb45a98
SHA1b7c9489b4427652a9cdd754d1c1b6ac4034be421
SHA256e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307
SHA5125dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726
-
Filesize
152B
MD5b28ef7d9f6d74f055cc49876767c886c
SHA1d6b3267f36c340979f8fc3e012fdd02c468740bf
SHA256fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37
SHA512491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75
-
Filesize
6KB
MD5f1edf0783884d4343c05c332d830254b
SHA1f5e36932178d15dd85ea7e572985dfcf01e80cc6
SHA2560512a049f5a7205013c8e0bef705fb11b464726c7e67ad0c6893e0659cdcbf3e
SHA5126971872734b678730a6c9766b085b51571253ee760b5311aca7a1462999211666665db94f14e8de343a98169de74063249685ee969d86c965ef502dec55c73a5
-
Filesize
6KB
MD5af7a8967af4187ecb3aa265c812be76f
SHA13d68a4af0ed049b2049a083b1220affc7e451e26
SHA2566bf60224a8e34faca91ceeb5468a33ddfcd68325d78cdf33e9b6d36b87180c96
SHA5127273c079826729354faa225cd56f97226b21edb61cfd4fc440fda6202865d819840c77dce99ad461acee3cf7a077c6c4c4ad50dd458550948babb3c06ad5458c
-
Filesize
11KB
MD56090b700029e4fcd175f04713c1e6d35
SHA19e12616ec0d928744c960775319ff75c644f235c
SHA256579b6d636db8bf1dd1e8285722a281497082c8c081f34639842ea08aee05ad35
SHA5124b150c76219bda4a991ae63632d888c2f412a4b255cd7f67e15e73c86a5eb9769b3968d6d0284f0a766e94c559a0e708d4065b434fcbca1996e459fe0865a4f9