Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 10:09
Static task
static1
Behavioral task
behavioral1
Sample
c081c15e27286657984ffec3f2cb12b5_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
c081c15e27286657984ffec3f2cb12b5_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c081c15e27286657984ffec3f2cb12b5_JaffaCakes118.html
-
Size
142KB
-
MD5
c081c15e27286657984ffec3f2cb12b5
-
SHA1
7fcb78f696729b77bb88471c0ac023ca6e3c8b35
-
SHA256
5821bac8baadb496774ebcf15e78a3cb8e2106b3d651f6b09343f34332a33863
-
SHA512
ba102219816714198870c1da1c3a249ec9903cb5c02f9232e4460c289c863e48d9ec609416c8b1ba3abb06c7f1b50f89950311a90c4b23fa06c967bb47a26987
-
SSDEEP
3072:1VGejtPUeUwIVGejtPUeUwMMKjxmjLZGDAMJJlzTPPA0ZLpfq8gMPhbi2zhkmH:1VGejtPUeUwIVGejtPUeUwM1iLZGDAMR
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3108 msedge.exe 3108 msedge.exe 3848 msedge.exe 3848 msedge.exe 4688 identity_helper.exe 4688 identity_helper.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe 1768 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe 3848 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3848 wrote to memory of 5100 3848 msedge.exe 84 PID 3848 wrote to memory of 5100 3848 msedge.exe 84 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 4780 3848 msedge.exe 85 PID 3848 wrote to memory of 3108 3848 msedge.exe 86 PID 3848 wrote to memory of 3108 3848 msedge.exe 86 PID 3848 wrote to memory of 1576 3848 msedge.exe 87 PID 3848 wrote to memory of 1576 3848 msedge.exe 87 PID 3848 wrote to memory of 1576 3848 msedge.exe 87 PID 3848 wrote to memory of 1576 3848 msedge.exe 87 PID 3848 wrote to memory of 1576 3848 msedge.exe 87 PID 3848 wrote to memory of 1576 3848 msedge.exe 87 PID 3848 wrote to memory of 1576 3848 msedge.exe 87 PID 3848 wrote to memory of 1576 3848 msedge.exe 87 PID 3848 wrote to memory of 1576 3848 msedge.exe 87 PID 3848 wrote to memory of 1576 3848 msedge.exe 87 PID 3848 wrote to memory of 1576 3848 msedge.exe 87 PID 3848 wrote to memory of 1576 3848 msedge.exe 87 PID 3848 wrote to memory of 1576 3848 msedge.exe 87 PID 3848 wrote to memory of 1576 3848 msedge.exe 87 PID 3848 wrote to memory of 1576 3848 msedge.exe 87 PID 3848 wrote to memory of 1576 3848 msedge.exe 87 PID 3848 wrote to memory of 1576 3848 msedge.exe 87 PID 3848 wrote to memory of 1576 3848 msedge.exe 87 PID 3848 wrote to memory of 1576 3848 msedge.exe 87 PID 3848 wrote to memory of 1576 3848 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c081c15e27286657984ffec3f2cb12b5_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ada746f8,0x7ff9ada74708,0x7ff9ada747182⤵PID:5100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,12203783136541867374,2645988441915683464,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:4780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,12203783136541867374,2645988441915683464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,12203783136541867374,2645988441915683464,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:82⤵PID:1576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12203783136541867374,2645988441915683464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:3916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12203783136541867374,2645988441915683464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:3180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12203783136541867374,2645988441915683464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:12⤵PID:1956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12203783136541867374,2645988441915683464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:12⤵PID:4168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12203783136541867374,2645988441915683464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:12⤵PID:4032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12203783136541867374,2645988441915683464,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:12⤵PID:2020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,12203783136541867374,2645988441915683464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6204 /prefetch:82⤵PID:4200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,12203783136541867374,2645988441915683464,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6204 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12203783136541867374,2645988441915683464,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:12⤵PID:4620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,12203783136541867374,2645988441915683464,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:12⤵PID:3484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,12203783136541867374,2645988441915683464,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1768
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3452
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1512
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e4f80e7950cbd3bb11257d2000cb885e
SHA110ac643904d539042d8f7aa4a312b13ec2106035
SHA2561184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
SHA5122b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0
-
Filesize
152B
MD52dc1a9f2f3f8c3cfe51bb29b078166c5
SHA1eaf3c3dad3c8dc6f18dc3e055b415da78b704402
SHA256dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
SHA512682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25
-
Filesize
595B
MD57482bae1ac51794fc06a16f80da3a87d
SHA1fae449f2fddf3c47576a59f3d6f57d9cd26593e0
SHA256013561dfc3c8a67fa2a1da8de6ea8fbb153b766b49cbd331b6346ad897aa83e5
SHA51295ff6d5ac03b3304f70a66b45af01d64122e37be1c74fee3af816e390f978a12eb74d990b38d6af49801347fa0fffa85789ccef75f18f3217819a5ba727d7384
-
Filesize
5KB
MD5317fdb766711804c565f3e659529189a
SHA121f85c0b1afeb849b03c663bf9dd597312308d47
SHA25657b5a6a73b9030b5ac8386fec535aee8dbfbaa9513472ba364d59c8dedc3472c
SHA51202dd1f685c58a51962650db71623e1403b54e65d7d60d976dffbf42650c29c9b1a58141e3fb4e347259ff9b89bb40db42d713d1f32d4294491c91de59e765492
-
Filesize
6KB
MD5659c9abf2602f97362ec26a32ea87757
SHA133b5c61dc77e23933f71ea3c4371490d6f402d00
SHA256de377c11e6d3839b2c0010376f438986309a5eabe2610024a71d953883f76f44
SHA5125619ab38fb37373d6657d091b750daadf1b02feb4c69ea9b1247346458f43f19b03c2c705e96a1493f5e8c62f63c422529d6b10952ce4c7e2e55acad932954d3
-
Filesize
6KB
MD5f31e6b959111915e82f826bfaefe8f2e
SHA1400e9d9d8c4f27410ea6d74227bf9c78af0a1df4
SHA2565c39e8ba64ec581446797236a6f97e349b601623b5bd4d7e302ad0a9c51fd34f
SHA512546842600b1c2f60bebdfe619c2b1dd5bd830a8968490fd98a1a6bd3646c5bf31bea87fd95c375690900e6ef0e4d69b01d5cc03111ffe6e0450a4d3a32ccbc5a
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5cde6af23824b89b5825ae210fc26904a
SHA143cac236f31d15371f1230db64989d3d2458ffaa
SHA2566b3ad8321b4f188fee715665c0d380de5ef36c0e8a841d156e836c2c17bbd040
SHA51298a164c571788ae96757ff18a6c30b519bb0cc17ebe71b2bb3ac7637ce786cb9b54083eeefe88db6ad6b17078595f43b320be74144913ce449d5fa0817949227