Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 09:34
Static task
static1
Behavioral task
behavioral1
Sample
c0737d4e2f8e417d869c82aa08a91ca3_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
c0737d4e2f8e417d869c82aa08a91ca3_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c0737d4e2f8e417d869c82aa08a91ca3_JaffaCakes118.html
-
Size
15KB
-
MD5
c0737d4e2f8e417d869c82aa08a91ca3
-
SHA1
77a103b84205e0e594032056a3e4924e0f397c50
-
SHA256
22dde695137f2ff28cfb200bbebb8baa61f74a31c706b0cfa052d956896d9560
-
SHA512
c02f77520f7d1daf515ec35b2fff5fc70ad0963131d370d84bd34ec282e9a6e6ad1e0895901fbd37d15945088d5cd93839c7944819fc928414a8439baa9dde61
-
SSDEEP
384:x5uw/TlivoTh48w4il9bvDAfqvuPr7aixWgWt:x5NEATh48w4il9bvDAfqvWar
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1912 msedge.exe 1912 msedge.exe 1560 msedge.exe 1560 msedge.exe 3736 identity_helper.exe 3736 identity_helper.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe 1388 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe 1560 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1560 wrote to memory of 4060 1560 msedge.exe 84 PID 1560 wrote to memory of 4060 1560 msedge.exe 84 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 436 1560 msedge.exe 85 PID 1560 wrote to memory of 1912 1560 msedge.exe 86 PID 1560 wrote to memory of 1912 1560 msedge.exe 86 PID 1560 wrote to memory of 2516 1560 msedge.exe 87 PID 1560 wrote to memory of 2516 1560 msedge.exe 87 PID 1560 wrote to memory of 2516 1560 msedge.exe 87 PID 1560 wrote to memory of 2516 1560 msedge.exe 87 PID 1560 wrote to memory of 2516 1560 msedge.exe 87 PID 1560 wrote to memory of 2516 1560 msedge.exe 87 PID 1560 wrote to memory of 2516 1560 msedge.exe 87 PID 1560 wrote to memory of 2516 1560 msedge.exe 87 PID 1560 wrote to memory of 2516 1560 msedge.exe 87 PID 1560 wrote to memory of 2516 1560 msedge.exe 87 PID 1560 wrote to memory of 2516 1560 msedge.exe 87 PID 1560 wrote to memory of 2516 1560 msedge.exe 87 PID 1560 wrote to memory of 2516 1560 msedge.exe 87 PID 1560 wrote to memory of 2516 1560 msedge.exe 87 PID 1560 wrote to memory of 2516 1560 msedge.exe 87 PID 1560 wrote to memory of 2516 1560 msedge.exe 87 PID 1560 wrote to memory of 2516 1560 msedge.exe 87 PID 1560 wrote to memory of 2516 1560 msedge.exe 87 PID 1560 wrote to memory of 2516 1560 msedge.exe 87 PID 1560 wrote to memory of 2516 1560 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c0737d4e2f8e417d869c82aa08a91ca3_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0a7546f8,0x7ffa0a754708,0x7ffa0a7547182⤵PID:4060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,9374702786877043316,15152678625886618982,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:22⤵PID:436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,9374702786877043316,15152678625886618982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,9374702786877043316,15152678625886618982,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:82⤵PID:2516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9374702786877043316,15152678625886618982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:2908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9374702786877043316,15152678625886618982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:1192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,9374702786877043316,15152678625886618982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:82⤵PID:4656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,9374702786877043316,15152678625886618982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9374702786877043316,15152678625886618982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:12⤵PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9374702786877043316,15152678625886618982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2664 /prefetch:12⤵PID:4448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9374702786877043316,15152678625886618982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:12⤵PID:3728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9374702786877043316,15152678625886618982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3768 /prefetch:12⤵PID:1644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,9374702786877043316,15152678625886618982,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2892 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1388
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5076
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f9664c896e19205022c094d725f820b6
SHA1f8f1baf648df755ba64b412d512446baf88c0184
SHA2567121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
SHA5123fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
-
Filesize
152B
MD5847d47008dbea51cb1732d54861ba9c9
SHA1f2099242027dccb88d6f05760b57f7c89d926c0d
SHA25610292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
SHA512bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
-
Filesize
479B
MD5d72231a083ae32988a2bc4618411a69b
SHA11751adc35d6e29cd8dd288d24cdc2cddcf08033f
SHA25687bb38ca86ce7fec0a01c14d55441efb65f01cb241ef4a7dc46136ea1defda09
SHA512a35d8c44d075cb35f116986071e89c7c04c8efe29fa492d32f166f02246aa0824f917ae78440a7a5e61f5857eb3f679f1adff41dba34e92551ab12b5e716a1f2
-
Filesize
5KB
MD55ff8ca1f4080622831f2a0bf210f27ad
SHA137e2a203f4310bb61917cc63c807c6a38f0660e0
SHA2567bd9bda4958f1a9cac1045c2da5a5fc86c5611aa026ec3b0b309d4de30cd6a57
SHA5127c3fc18b472f0da58562693f51fe53077cdb9512828d57c1104a54af5d7d2ad040d23ebe56c95aa41264167f251936ca6f028da2f5996555d61ce5fab74f416d
-
Filesize
6KB
MD5a7063b2aea0fbceb5173e3e00b834698
SHA1f8ba3f255069018253fb1ccd50f8a4084ebf4b7a
SHA256e46493005f0bbbc5bba35497e537035b88bc99dda24795f5395832a89b8dfa9a
SHA512ca4a1e6dcf35090db11a622027bd79483380353c186d2ff955d3f4919e71dd574b0abce7dcd5b39a0374fc8bd3dd24784bcb680c8dbf84b4186f52f67ac7fc9e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5905154672e78090b6b38c73bba70645f
SHA1d075ad04538673eb566caf0e9acc92a86afc287d
SHA256d01e0f1fce2ca6c4b611d708501198dafe508490226d4dcea6976350befb352d
SHA5120cdb6517c2cb95ec42f18a5ceb0a5308917dfbb8a44afcc7c5d5587dd455220eb71530d880cd142240c2229ceae899dd9b8db1114f444accbae8a3e485dee5a3