Analysis
-
max time kernel
145s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 10:10
Static task
static1
Behavioral task
behavioral1
Sample
c082217176503a0b4b86a6c9353f5139_JaffaCakes118.html
Resource
win7-20240729-en
General
-
Target
c082217176503a0b4b86a6c9353f5139_JaffaCakes118.html
-
Size
26KB
-
MD5
c082217176503a0b4b86a6c9353f5139
-
SHA1
b7804d86bf626b450542f3a281aa2d4bbaea91be
-
SHA256
f36de63629e24c37a71b3a34bcf4a62f622cbda93520d9544f8f02b296eaaf6c
-
SHA512
f3ee51c59ecb67363a25b45aa618f6aa08fe00899c20200371de29cc28b22461c4c3a1c3f8a73371f64036001d4ff5b8338f4d2d280be791aaaa28a4918b4557
-
SSDEEP
768:SDb74ex802rCvC3CCCBC+CzC2yEoaoUonoZoOOCOPOpOgOv5dDdB5RPR:Sm0o2CFUvm65Bt
Malware Config
Signatures
-
Detected phishing page
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2640 msedge.exe 2640 msedge.exe 4320 msedge.exe 4320 msedge.exe 4660 identity_helper.exe 4660 identity_helper.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe 2436 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe 4320 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4320 wrote to memory of 4900 4320 msedge.exe 84 PID 4320 wrote to memory of 4900 4320 msedge.exe 84 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 5084 4320 msedge.exe 85 PID 4320 wrote to memory of 2640 4320 msedge.exe 86 PID 4320 wrote to memory of 2640 4320 msedge.exe 86 PID 4320 wrote to memory of 5004 4320 msedge.exe 87 PID 4320 wrote to memory of 5004 4320 msedge.exe 87 PID 4320 wrote to memory of 5004 4320 msedge.exe 87 PID 4320 wrote to memory of 5004 4320 msedge.exe 87 PID 4320 wrote to memory of 5004 4320 msedge.exe 87 PID 4320 wrote to memory of 5004 4320 msedge.exe 87 PID 4320 wrote to memory of 5004 4320 msedge.exe 87 PID 4320 wrote to memory of 5004 4320 msedge.exe 87 PID 4320 wrote to memory of 5004 4320 msedge.exe 87 PID 4320 wrote to memory of 5004 4320 msedge.exe 87 PID 4320 wrote to memory of 5004 4320 msedge.exe 87 PID 4320 wrote to memory of 5004 4320 msedge.exe 87 PID 4320 wrote to memory of 5004 4320 msedge.exe 87 PID 4320 wrote to memory of 5004 4320 msedge.exe 87 PID 4320 wrote to memory of 5004 4320 msedge.exe 87 PID 4320 wrote to memory of 5004 4320 msedge.exe 87 PID 4320 wrote to memory of 5004 4320 msedge.exe 87 PID 4320 wrote to memory of 5004 4320 msedge.exe 87 PID 4320 wrote to memory of 5004 4320 msedge.exe 87 PID 4320 wrote to memory of 5004 4320 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c082217176503a0b4b86a6c9353f5139_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbda5446f8,0x7ffbda544708,0x7ffbda5447182⤵PID:4900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,2354464561924398361,2555220062722476152,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:22⤵PID:5084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,2354464561924398361,2555220062722476152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,2354464561924398361,2555220062722476152,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:82⤵PID:5004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2354464561924398361,2555220062722476152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:2288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2354464561924398361,2555220062722476152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:2524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,2354464561924398361,2555220062722476152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:82⤵PID:4600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,2354464561924398361,2555220062722476152,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2354464561924398361,2555220062722476152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:12⤵PID:396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2354464561924398361,2555220062722476152,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:12⤵PID:4252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2354464561924398361,2555220062722476152,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:12⤵PID:2780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,2354464561924398361,2555220062722476152,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:1852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,2354464561924398361,2555220062722476152,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3336 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2436
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2400
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d4829218222c8bedb9ffe89dffd37095
SHA1aae577f33f413ec3d09f2e7ff5d9cc20a602241c
SHA25649239b229a2519583ba5d6de3702480b8a8ebf3cfaa8945100dbab25fcb02b7b
SHA51203e26a2e3de41b8a829b5543da504c7d7ccdc4c112d629efcac24dcda23acb50a52b5b99572b5efb2a01cf392a457cf9fac85663b3d63f7606be00dba218f8f1
-
Filesize
152B
MD515e9c4b4eefb3e1c08a010e748e10f58
SHA13172378f2c7a00553ce086dbf53fcf3126c5a724
SHA25607b56a769467e8b57f9b7acd9d32da266ca5000803758c18bb6818ac236c7000
SHA512811058b539e914a812c88543bb6657de736f691d18d6dadb5e1f6ced286780fb334dc5f575babbcf4fd2dceda30d1bf4004b374c5775e7f278346b100b29eb7e
-
Filesize
182B
MD5507b269295df17636d0e9dd1d817eb1e
SHA1d5aa98a3dcf56675132cb2a0864e7d9d07725fff
SHA25688ea8c3c5f0141ec3cc389e9cc776837817d36d23b4fd84b5a941d5369ca5b81
SHA512a85de9410cf198028558d5be86e1d1a44af5b0afb7296e41183546594fa0fe32024f9edbb7bbf7a558e80cf1decf41481540aba56ad19f34d8b55cf094c12553
-
Filesize
5KB
MD57e31e06a60de06ff7e20c0f56be83926
SHA1be198e1f81462ac38feaf64ef56f56b5e7a4b597
SHA2565e4169e0b0e5f0cc32c59bc71e4b63ec579491309a92b377532cd19f0fd4e424
SHA512fce5997d615f51f1c4cc27fae0f993a16be96d2db82d09a5eec2de814e4eeee4bf65e92377bb1926dea546891059c322171c70e5d6e6973ec819e26e89587b3d
-
Filesize
5KB
MD56c5efbe497a19935f052f18db726593b
SHA13c97f865d6283dec80219e541968607eb2e4a912
SHA2569b9e0b37e27125aa63be93c7e4e9b213f2ae79613e028d0bc88ca4d19c1e9dce
SHA5120351e3c640a2f4adec2949bb9b6a49764cc327acb1d8d649bc0b103e7ac487d9a5bfabbbd5616aa1bc4511136c70f8242d11ab5696df2fe24fb5f6fe1515900c
-
Filesize
24KB
MD57915ba0545666aa5833cf9f9f86d45d6
SHA1743ecc319bc2a54973582d4a5198042a48fbe8db
SHA256f8fcc045da13bde0f5dec3ada86342105cbff34ebc2442bcf51e8ed509a95b20
SHA512a53036251a22cdc95579ea8641c5574f1dc1f7dfd0390f00ebeafbbea0c1a2c0c3e6dba23bbbb8d8e2c77a3e1e816ccfaf84a97da1c334019c8df1414999d1f9
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5fe5aa2073eae4286c92ba1e9fac8d335
SHA1a01e15f93a06360354222cf2bb7ec393e85a6e4e
SHA2569cda12a7a8aa32e5c2a35dcdd27039d8860136be606f200d749a72a96d4d4bab
SHA512f4fbb7560a1dd4026ec08bec38c7bb81fc519e4436e795a928f830beba3e94a169db977c2fe1c942f8dedfc270f5766a7376d0c2bff8adcf73e7454c80af208d