Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 09:51
Static task
static1
Behavioral task
behavioral1
Sample
c07a81ea9e518127b23ab44d3837bcc3_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c07a81ea9e518127b23ab44d3837bcc3_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c07a81ea9e518127b23ab44d3837bcc3_JaffaCakes118.html
-
Size
36KB
-
MD5
c07a81ea9e518127b23ab44d3837bcc3
-
SHA1
e107f85ac46d54bc08c86aaad4ff90ba1d4ddf9c
-
SHA256
54170c2a8fbe5a1c5afe214324c0214a9f64da1cfdbe42c21a6602e341308380
-
SHA512
a0535cdb1761278f18c0d38bc17ec095469abb372589dbe3ea3f6aac197c99c182da139ebba30a17883cdd6577c166426f1387552751e67ac0dc75cc4bf80e8f
-
SSDEEP
768:zwx/MDTHFN88hARAZPXbE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6T9ZOA6DJtxo6lL5:Q/7bJxNVpuCS+/48yK
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1660 msedge.exe 1660 msedge.exe 4440 msedge.exe 4440 msedge.exe 3404 identity_helper.exe 3404 identity_helper.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe 3484 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe 4440 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4440 wrote to memory of 2540 4440 msedge.exe 84 PID 4440 wrote to memory of 2540 4440 msedge.exe 84 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 3376 4440 msedge.exe 85 PID 4440 wrote to memory of 1660 4440 msedge.exe 86 PID 4440 wrote to memory of 1660 4440 msedge.exe 86 PID 4440 wrote to memory of 2964 4440 msedge.exe 87 PID 4440 wrote to memory of 2964 4440 msedge.exe 87 PID 4440 wrote to memory of 2964 4440 msedge.exe 87 PID 4440 wrote to memory of 2964 4440 msedge.exe 87 PID 4440 wrote to memory of 2964 4440 msedge.exe 87 PID 4440 wrote to memory of 2964 4440 msedge.exe 87 PID 4440 wrote to memory of 2964 4440 msedge.exe 87 PID 4440 wrote to memory of 2964 4440 msedge.exe 87 PID 4440 wrote to memory of 2964 4440 msedge.exe 87 PID 4440 wrote to memory of 2964 4440 msedge.exe 87 PID 4440 wrote to memory of 2964 4440 msedge.exe 87 PID 4440 wrote to memory of 2964 4440 msedge.exe 87 PID 4440 wrote to memory of 2964 4440 msedge.exe 87 PID 4440 wrote to memory of 2964 4440 msedge.exe 87 PID 4440 wrote to memory of 2964 4440 msedge.exe 87 PID 4440 wrote to memory of 2964 4440 msedge.exe 87 PID 4440 wrote to memory of 2964 4440 msedge.exe 87 PID 4440 wrote to memory of 2964 4440 msedge.exe 87 PID 4440 wrote to memory of 2964 4440 msedge.exe 87 PID 4440 wrote to memory of 2964 4440 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c07a81ea9e518127b23ab44d3837bcc3_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb34c46f8,0x7ffcb34c4708,0x7ffcb34c47182⤵PID:2540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,11253209534477086641,557783566027864824,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:22⤵PID:3376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,11253209534477086641,557783566027864824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,11253209534477086641,557783566027864824,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:82⤵PID:2964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11253209534477086641,557783566027864824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:5116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11253209534477086641,557783566027864824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:12⤵PID:4344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,11253209534477086641,557783566027864824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:82⤵PID:2352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,11253209534477086641,557783566027864824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11253209534477086641,557783566027864824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:12⤵PID:3352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11253209534477086641,557783566027864824,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:12⤵PID:2348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11253209534477086641,557783566027864824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:12⤵PID:844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11253209534477086641,557783566027864824,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:12⤵PID:2720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,11253209534477086641,557783566027864824,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2712 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3484
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3636
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1332
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59e3fc58a8fb86c93d19e1500b873ef6f
SHA1c6aae5f4e26f5570db5e14bba8d5061867a33b56
SHA256828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4
SHA512e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e
-
Filesize
152B
MD527304926d60324abe74d7a4b571c35ea
SHA178b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1
SHA2567039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de
SHA512f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd
-
Filesize
613B
MD56f8f0d2e3303c465f53b78fedbf5b829
SHA19aaab927952bd65a71b44fa204fbabfb5e5214fb
SHA2560e8bf4a1bcde05e58a48eb99df8b87e1a56e60344d99ee8c337a2ec165bec669
SHA512b00fb3f96e7b77d6ec5f045b43801592f7e8df50dcf598bdd56180c83c8a6861d46a60f50584c005aec2fb958796fc4b0e161b0aa7a8de507c81725c2e769646
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
5KB
MD5d897745cd2b42a65ccd12e16a7531048
SHA134ee5ee302c174dc218b864c7d2a284c2dd1fba7
SHA2564a62811540a51ffe16ec581a34e2bff1379d1e40633a3eac2ded5500189e7e14
SHA51286f93a0b453cfcfbe08b2bd8334fc38cccfb3a13ac84cdc8d2cbf10048bc5b1840cc8d4ed1d6c9fee998e1427c569e3ee3990dc61bb5d6af343a16c987c99ca3
-
Filesize
6KB
MD549a760438b12a8362fa4625dbf5fbe5e
SHA10138f97b52779f36b96995191a031fe920d4e91a
SHA256e80ff4c5b372ae3b53892c5c146b68419271111cde92b3cdd421740f387fcc78
SHA5121efb5c06191c316bf0fb727c0b72821328ab2a214d23315384caff95a552c04eeb4872da6206369d5c2bf2b337e3a90a81f6b380ee5a8fea75de986bcfebbd09
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5188041c3e2bb6a755d54e7d127f4032f
SHA1bcd9e3b502c6bd5e654fa8b00ebef1e1635bd80f
SHA256fbbc7c2130bdec9ae5e28018c000b34e0fe2bf31679ed87f241191ded75fe0cc
SHA512603e0fafe3f2cc9fd2445ae06c25e5607b1e1237ab0a6ddd18f999e931379638894ebf6d5e77e80c5def1f5b044f14b11fe02430f3f371b2ab05a7a7517d7bb0