Analysis
-
max time kernel
31s -
max time network
42s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26-08-2024 04:35
Static task
static1
Behavioral task
behavioral1
Sample
c24ace94f4627fef39459f48cc7248fc_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c24ace94f4627fef39459f48cc7248fc_JaffaCakes118.html
Resource
win10v2004-20240802-en
Errors
General
-
Target
c24ace94f4627fef39459f48cc7248fc_JaffaCakes118.html
-
Size
120KB
-
MD5
c24ace94f4627fef39459f48cc7248fc
-
SHA1
2147bdb6ef8293515ce6ac2356a7c424a3cd8e85
-
SHA256
a3839a8a56970dab88fc8d72459abf40decfd9ed3a999ad57d0d7eb5ff63e16f
-
SHA512
ba34c64487d736ca54c0dc062da5edf1e3ac47a6b06252af66b5b80c7975110d5c61cc7a14d08dbbd1b1946c1fa3225b176c0caf05669e7f46bfcc190d624348
-
SSDEEP
1536:2zbi0epQvmQML+CDUB4XGvGRBsFalwKrWcRhXuT+N11pkIx:21eQML+CPGvsxlweThg+71prx
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
msedge.exemsedge.exepid process 3668 msedge.exe 3668 msedge.exe 2424 msedge.exe 2424 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe 2424 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2424 wrote to memory of 2684 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 2684 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3948 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3668 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 3668 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 2492 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 2492 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 2492 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 2492 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 2492 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 2492 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 2492 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 2492 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 2492 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 2492 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 2492 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 2492 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 2492 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 2492 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 2492 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 2492 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 2492 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 2492 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 2492 2424 msedge.exe msedge.exe PID 2424 wrote to memory of 2492 2424 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c24ace94f4627fef39459f48cc7248fc_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffacade46f8,0x7ffacade4708,0x7ffacade47182⤵PID:2684
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,9699378079140298966,3783804823745994919,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:22⤵PID:3948
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,9699378079140298966,3783804823745994919,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3668 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,9699378079140298966,3783804823745994919,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:82⤵PID:2492
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9699378079140298966,3783804823745994919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:1468
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9699378079140298966,3783804823745994919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:3336
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9699378079140298966,3783804823745994919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:12⤵PID:1292
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9699378079140298966,3783804823745994919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:12⤵PID:2176
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9699378079140298966,3783804823745994919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:12⤵PID:3912
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9699378079140298966,3783804823745994919,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:12⤵PID:2728
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2968
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1968
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ff63763eedb406987ced076e36ec9acf
SHA116365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA2568f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
SHA512ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
-
Filesize
152B
MD52783c40400a8912a79cfd383da731086
SHA1001a131fe399c30973089e18358818090ca81789
SHA256331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
SHA512b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
-
Filesize
6KB
MD5bb758f9e9b71f62eff7701317bab0cda
SHA163026468a28e7e8ab37588f54c54f587d6d05000
SHA2566e5a4c2e9346d50e254c7c4d028376cf6e1a23dfee6652da67ba6bed54ad04aa
SHA512cff9611d4291311f22c17f0b0718d71eb4d706b8564055756581c5e221519bd1b67b8eda2df75742149a459c1e2b529636f3bd3b5dc969d2cce0b88dce4ed3d8
-
Filesize
5KB
MD59525ec352e9d62282886637e93f734e6
SHA1ebe11273bc238632937b7be30fb4955afb5f753d
SHA2567f0b76deefb39f7b0176359f6618152d00248714553dc618bb4ff5a2ce67964b
SHA5124595696c85547d203b94b10ffb066c3d24342db391498097198ad0ef0d30f3bf4957a86dbb464b10321a4f4cba247525a2a9a41d1071d06e8e085b3c18f1699a
-
Filesize
10KB
MD5257b3f87d90cba3d8a3db45caff53417
SHA145bc959ca593deab00bfd69d7da6987c32d8f610
SHA256eef130b3c67f8b78cb5f9d80e9b4d0159067a7148c44f00d7105280a79bebc47
SHA5122348ef95c4cd23b3537e0a2856e1aca8854a86d2182711f7a1c9f63940cd81d65ec1c5536dcbfe2ff214836e6f117842c140f1532b245258ae95de61c2a9c28c
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e