Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
01-08-2024 23:27
Static task
static1
Behavioral task
behavioral1
Sample
822692e5cb959054233cc42a4c7a2cee_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
822692e5cb959054233cc42a4c7a2cee_JaffaCakes118.html
Resource
win10v2004-20240730-en
General
-
Target
822692e5cb959054233cc42a4c7a2cee_JaffaCakes118.html
-
Size
2KB
-
MD5
822692e5cb959054233cc42a4c7a2cee
-
SHA1
1016ac21d3d7e35baa647d00c916815f4e0f59a2
-
SHA256
e915d87ffd8dbd867f9ac84fab000083f08291d5279d064d852d0d434c40e957
-
SHA512
8b4c8b129114f960a28f5770dfc000babe55e3ebf2a41213a43135b9f079ad4dd4b078ef07d210a06c57d39913d4435a39d2f79eed4a8934b5232d8994ba6258
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3412 msedge.exe 3412 msedge.exe 2004 msedge.exe 2004 msedge.exe 4044 identity_helper.exe 4044 identity_helper.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe 1584 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe 2004 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2004 wrote to memory of 1756 2004 msedge.exe 83 PID 2004 wrote to memory of 1756 2004 msedge.exe 83 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 1952 2004 msedge.exe 84 PID 2004 wrote to memory of 3412 2004 msedge.exe 85 PID 2004 wrote to memory of 3412 2004 msedge.exe 85 PID 2004 wrote to memory of 4340 2004 msedge.exe 86 PID 2004 wrote to memory of 4340 2004 msedge.exe 86 PID 2004 wrote to memory of 4340 2004 msedge.exe 86 PID 2004 wrote to memory of 4340 2004 msedge.exe 86 PID 2004 wrote to memory of 4340 2004 msedge.exe 86 PID 2004 wrote to memory of 4340 2004 msedge.exe 86 PID 2004 wrote to memory of 4340 2004 msedge.exe 86 PID 2004 wrote to memory of 4340 2004 msedge.exe 86 PID 2004 wrote to memory of 4340 2004 msedge.exe 86 PID 2004 wrote to memory of 4340 2004 msedge.exe 86 PID 2004 wrote to memory of 4340 2004 msedge.exe 86 PID 2004 wrote to memory of 4340 2004 msedge.exe 86 PID 2004 wrote to memory of 4340 2004 msedge.exe 86 PID 2004 wrote to memory of 4340 2004 msedge.exe 86 PID 2004 wrote to memory of 4340 2004 msedge.exe 86 PID 2004 wrote to memory of 4340 2004 msedge.exe 86 PID 2004 wrote to memory of 4340 2004 msedge.exe 86 PID 2004 wrote to memory of 4340 2004 msedge.exe 86 PID 2004 wrote to memory of 4340 2004 msedge.exe 86 PID 2004 wrote to memory of 4340 2004 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\822692e5cb959054233cc42a4c7a2cee_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8358746f8,0x7ff835874708,0x7ff8358747182⤵PID:1756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,18307707973371158368,10969764819847283236,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,18307707973371158368,10969764819847283236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,18307707973371158368,10969764819847283236,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:82⤵PID:4340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18307707973371158368,10969764819847283236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:4256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18307707973371158368,10969764819847283236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:3888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,18307707973371158368,10969764819847283236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:82⤵PID:4028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,18307707973371158368,10969764819847283236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5132 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18307707973371158368,10969764819847283236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:12⤵PID:4964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18307707973371158368,10969764819847283236,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:12⤵PID:3100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18307707973371158368,10969764819847283236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:12⤵PID:1568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18307707973371158368,10969764819847283236,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:12⤵PID:2256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,18307707973371158368,10969764819847283236,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1304 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1584
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2556
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ea9ef805116c4ab90b5800c7cd94ab71
SHA1eb9c7b8922c8ef79eef1009ab7f530bb57fbbbea
SHA256bff3e3629de76b8b8dd001c3d8fb986e841c392dfe1982081751b92f5bd567b0
SHA5128c907d2616ce16cfe08ddeb632f93402e765c5d9430a46e90ab5ea32d4df0a854c6007b19f9b0168254ab7aadf720fed8c68d1a055704db09c1b36c201a9b3b9
-
Filesize
152B
MD5347755403306a2694773b0c232d3ab2c
SHA194d908aa90533fcaef3f1eb5aa93fee183d5f6ac
SHA256d43f2dd4ac5b6ba779100eb8b84bc92fc8700bedcd339a801c5260b1bb3ce3bf
SHA51298f1fb18bc34dfc224132dfa2a2e6a131b280b25fcb516fac3bb66da2a47c7a7061124881de6fa5f65602663dc0ea71357b171a3346bb1514176943438322253
-
Filesize
6KB
MD593c572156bed0387e8a549ede939d7ac
SHA1a439af19ad8e84a251210128d785646f3210abfd
SHA256241433d72e3b516a0d3f2b7abbe24257463bb4ea2be673d3f80d25c7f1155eda
SHA5124782e46086003f015432a9df6aabca7f0e4f261c35049c95e83e44f09d4c78d4a79b2d6f544e2486228b2f1eed770c8713eb60f99ec0581e2a9035f77787aea8
-
Filesize
6KB
MD5f2a3df96d4973c29a2e5a83eddc1a199
SHA1b1585ae92a88c04b967223efcbdc197548b08511
SHA2565c8d687cb9797c36eb733195df1674aa18c1843dbc779bd17af32aace00a8c1a
SHA512b2991752394e58cadf2717297920d054a561284dfb974df526506c20c7e47ecfa737e29eff2c5c8c1c9f395b43e357a90c7b035b5aa88fdc7ec77c03e9d99d78
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
10KB
MD5be3317e8d9f4805015f3cc4f0e63fd39
SHA1deaeda3e107ec7781cac38bab73327263ca83bb7
SHA256043075754a42e8cc176e9b486e8b9640d474f40910242e8e65182b35deae90ac
SHA512a5d7c3b94d371c35c8c998e70f14b2e477c2c0adefb318742841ae1ef607f3ba84d66a5e6e0a031fc0c8a1107c20567317d89e2c5b12671bb4f9bf9b3e97b912