Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10/08/2024, 21:42
Static task
static1
Behavioral task
behavioral1
Sample
87c8ce69e0fcb3d206e9ebee2b300550_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
87c8ce69e0fcb3d206e9ebee2b300550_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
87c8ce69e0fcb3d206e9ebee2b300550_JaffaCakes118.html
-
Size
89KB
-
MD5
87c8ce69e0fcb3d206e9ebee2b300550
-
SHA1
0898cae2137b149466205fe3342a7d710e8491af
-
SHA256
ae7fb27b8571e51fe627d6570febb0b6a0d4a750d9a169e075131680a5e1b933
-
SHA512
d05e9c9831ca134c51417d686dc3d9239fc64716b9da6004901e129c5cffe703b491803a52a6ab5c35e169032cf9eb5d2679e4a900bb0a3fbbe305b99e35f80d
-
SSDEEP
1536:pbMjw2fMk1D3O9Pj2fce6kHAPEVL4gu8cZjqqoWp:sNWkLx+
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4012 msedge.exe 4012 msedge.exe 3496 msedge.exe 3496 msedge.exe 2744 msedge.exe 2744 msedge.exe 2744 msedge.exe 2744 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3496 msedge.exe 3496 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3496 wrote to memory of 2924 3496 msedge.exe 88 PID 3496 wrote to memory of 2924 3496 msedge.exe 88 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 5036 3496 msedge.exe 89 PID 3496 wrote to memory of 4012 3496 msedge.exe 90 PID 3496 wrote to memory of 4012 3496 msedge.exe 90 PID 3496 wrote to memory of 3972 3496 msedge.exe 91 PID 3496 wrote to memory of 3972 3496 msedge.exe 91 PID 3496 wrote to memory of 3972 3496 msedge.exe 91 PID 3496 wrote to memory of 3972 3496 msedge.exe 91 PID 3496 wrote to memory of 3972 3496 msedge.exe 91 PID 3496 wrote to memory of 3972 3496 msedge.exe 91 PID 3496 wrote to memory of 3972 3496 msedge.exe 91 PID 3496 wrote to memory of 3972 3496 msedge.exe 91 PID 3496 wrote to memory of 3972 3496 msedge.exe 91 PID 3496 wrote to memory of 3972 3496 msedge.exe 91 PID 3496 wrote to memory of 3972 3496 msedge.exe 91 PID 3496 wrote to memory of 3972 3496 msedge.exe 91 PID 3496 wrote to memory of 3972 3496 msedge.exe 91 PID 3496 wrote to memory of 3972 3496 msedge.exe 91 PID 3496 wrote to memory of 3972 3496 msedge.exe 91 PID 3496 wrote to memory of 3972 3496 msedge.exe 91 PID 3496 wrote to memory of 3972 3496 msedge.exe 91 PID 3496 wrote to memory of 3972 3496 msedge.exe 91 PID 3496 wrote to memory of 3972 3496 msedge.exe 91 PID 3496 wrote to memory of 3972 3496 msedge.exe 91
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\87c8ce69e0fcb3d206e9ebee2b300550_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb271d46f8,0x7ffb271d4708,0x7ffb271d47182⤵PID:2924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14597351485242551146,14912578560567015157,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:5036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,14597351485242551146,14912578560567015157,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,14597351485242551146,14912578560567015157,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:82⤵PID:3972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14597351485242551146,14912578560567015157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,14597351485242551146,14912578560567015157,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:12⤵PID:2052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,14597351485242551146,14912578560567015157,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2304 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2744
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1492
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1192
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ab8ce148cb7d44f709fb1c460d03e1b0
SHA144d15744015155f3e74580c93317e12d2cc0f859
SHA256014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff
SHA512f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4
-
Filesize
152B
MD538f59a47b777f2fc52088e96ffb2baaf
SHA1267224482588b41a96d813f6d9e9d924867062db
SHA25613569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b
SHA5124657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b
-
Filesize
6KB
MD584eac9d94653bf2dbd084820b341e3dc
SHA171819b5174390884dcd77e4fd1eddd700827de26
SHA256b1b2061bd1f8c8b3530bfec2d2fe79e9656adebb09a65968609f4632319b577c
SHA5122d82e40823818a892f27e7eefadffc474fac0141dbd46952fc4b87cdbdeb48fc9fc6a7d8dff7ea75ccebb3eefc9a9621f04099ce30d5efd53c3fa43c91f03419
-
Filesize
6KB
MD58857dd29b0a101fdd690cbbe057b25e7
SHA15600dcdcb3ee8de595514d36cddea31d687512fd
SHA256a6f89d5764c584cd61b62fd199c399aad736a497166bb86256a032371d8656b8
SHA512dc390b151db287a00072df37801ac04e0a8197a6153ca353d3cb7b5c83412c55d0c29e799536d716725c64f03bb5e7b5676c8079bf8ea39730c07fc70ec74b97
-
Filesize
10KB
MD55f251692df223a53893dfd795609675c
SHA1c95056176b10c165e011812fd4a9c0cb83288812
SHA2569d8fe60f2c892c26299f65848ab356a51a3e41e15ae56cfe9a89e71c5f66f8a8
SHA51290915203bf4bd6ee5099cd021fd4843af403410f841b8722ef7c41c4125827681b8105e3f1ae2b6e105006c6b921a360a86a2524b6ed60d48c49b700157b77c1