Analysis
-
max time kernel
31s -
max time network
39s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25-08-2024 22:40
Static task
static1
Behavioral task
behavioral1
Sample
c1bcb09a17d4700f5b6763ab2953a4ce_JaffaCakes118.html
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c1bcb09a17d4700f5b6763ab2953a4ce_JaffaCakes118.html
Resource
win10v2004-20240802-en
Errors
General
-
Target
c1bcb09a17d4700f5b6763ab2953a4ce_JaffaCakes118.html
-
Size
59KB
-
MD5
c1bcb09a17d4700f5b6763ab2953a4ce
-
SHA1
76b290f4c7bfe10bc49a3e9cd16dc7265febedbe
-
SHA256
483dfb7e275ee569ca2f76af7c9e2a6eaab9dd99a556238be8d025c278d3bafe
-
SHA512
d38567535a68a6a0912b717991ccc4d064868709e4caec63cc8e99d27f60becd60d87ddb599a19ee0c93e01a16aa449093e3026c62f321c1241eeea551e8a1f6
-
SSDEEP
1536:OV8I1RVg298pIMmaPkvyou5iFBD3yQdtV:OV9nVg2GB6FBD3yu
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
msedge.exemsedge.exepid process 2492 msedge.exe 2492 msedge.exe 2064 msedge.exe 2064 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
Processes:
msedge.exepid process 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe 2064 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2064 wrote to memory of 5072 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 5072 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2452 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2492 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 2492 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 1060 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 1060 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 1060 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 1060 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 1060 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 1060 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 1060 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 1060 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 1060 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 1060 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 1060 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 1060 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 1060 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 1060 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 1060 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 1060 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 1060 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 1060 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 1060 2064 msedge.exe msedge.exe PID 2064 wrote to memory of 1060 2064 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c1bcb09a17d4700f5b6763ab2953a4ce_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffacade46f8,0x7ffacade4708,0x7ffacade47182⤵PID:5072
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,7195676445692033665,7904069809298591300,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵PID:2452
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,7195676445692033665,7904069809298591300,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2492 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,7195676445692033665,7904069809298591300,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:82⤵PID:1060
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7195676445692033665,7904069809298591300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:4148
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7195676445692033665,7904069809298591300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:4332
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7195676445692033665,7904069809298591300,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:12⤵PID:1992
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:848
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ff63763eedb406987ced076e36ec9acf
SHA116365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA2568f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
SHA512ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
-
Filesize
152B
MD52783c40400a8912a79cfd383da731086
SHA1001a131fe399c30973089e18358818090ca81789
SHA256331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
SHA512b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD595c7549d2d32ebcaf44f8e20bf8a4546
SHA1a1906481bcca1404c04594fc03ef539a70b3c46a
SHA256d4d1764411c300f3f38577021d2165d5849113992eff485a0476fd65ae94d072
SHA512c42751b77add70722438af54c283b1e53f86d82deea89bcff779616252bf12fd249cd884a2c2fcfdb11c8f8d0f888891cf63adf794a529e4ee63371669994b79
-
Filesize
5KB
MD531163faf814a71a8a1b358793b716ff2
SHA120276f2fcd9396722f3cf60e0787d5d9437c21bb
SHA256ea434fef461b0cbc793a8a8a9f48956a6c6667d1041bc39bf3730b8d0a5a554b
SHA51200a94fce54c92d984c968723a05bacdb25e81b8a6a97e532f1aa2250aee79f91f8d09dd5aecf99bcf815ccbdb15dc782e5e605e4f37cac9f4edb6a6e267b9879
-
Filesize
6KB
MD5b60e96761ec7dbfd90b9ec2bfe962ee4
SHA160a98771cec2901f05fb9fa6e0a2653387238f4e
SHA2566911de214e8b3ac55eb37507c4f513385674d37dbfa675418d787013e3ddb4e9
SHA512e41812097fb39c8e2936eb5371d2cd480c13380bf6bf5378f2e38cb8ca25dd2aa332b85d086773b3c649b506295ba299ad8d328e64b4e60787798e685a674957
-
Filesize
10KB
MD5ccd7bcd7bf270cbe9d5d5a12fd11a4d0
SHA1412ef20d8664987b8a3c02a7448bf1efc2451fbd
SHA256fd1181853d519d6218f92ddd9407a3722bb89d63ad7dbdedefdf15e7262cae9a
SHA5122c378c83d52c0e18b0589670556f529749034f7ae9dda3adf17315da65af405521c0cc4b9aa728160bf5e2fb8dfa32c1ad00ba6381e5923a106bb0aebd5069ad
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e