Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 06:01
Static task
static1
Behavioral task
behavioral1
Sample
c855491beb2671075fa3e83f8c7f8eff_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c855491beb2671075fa3e83f8c7f8eff_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c855491beb2671075fa3e83f8c7f8eff_JaffaCakes118.html
-
Size
18KB
-
MD5
c855491beb2671075fa3e83f8c7f8eff
-
SHA1
0a47df8e43d9999bb35896c37495f9df5608db8d
-
SHA256
a6a23c5d413c6a892407010019dee31d28bcca8973385bdc206a18fadb3f4d23
-
SHA512
4d608f394d2b84ac45cda1c35cfdca83ab802de5b2cd699c892c0e09ab35f2c20e29698b8ae0ab8f874a00199984210c20d24a1ad13ebf580c348ef3b3787101
-
SSDEEP
384:Itq3nFjIqGG7wA+wtBT/K73EBwonndzw13ut3/D10wsLdgLmPhLqhGhMyME+wYN2:IcVjIqGpIwMdZnoOpIFp
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4588 msedge.exe 4588 msedge.exe 2608 msedge.exe 2608 msedge.exe 2444 identity_helper.exe 2444 identity_helper.exe 4044 msedge.exe 4044 msedge.exe 4044 msedge.exe 4044 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe 2608 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2608 wrote to memory of 4740 2608 msedge.exe 84 PID 2608 wrote to memory of 4740 2608 msedge.exe 84 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 3680 2608 msedge.exe 85 PID 2608 wrote to memory of 4588 2608 msedge.exe 86 PID 2608 wrote to memory of 4588 2608 msedge.exe 86 PID 2608 wrote to memory of 1116 2608 msedge.exe 87 PID 2608 wrote to memory of 1116 2608 msedge.exe 87 PID 2608 wrote to memory of 1116 2608 msedge.exe 87 PID 2608 wrote to memory of 1116 2608 msedge.exe 87 PID 2608 wrote to memory of 1116 2608 msedge.exe 87 PID 2608 wrote to memory of 1116 2608 msedge.exe 87 PID 2608 wrote to memory of 1116 2608 msedge.exe 87 PID 2608 wrote to memory of 1116 2608 msedge.exe 87 PID 2608 wrote to memory of 1116 2608 msedge.exe 87 PID 2608 wrote to memory of 1116 2608 msedge.exe 87 PID 2608 wrote to memory of 1116 2608 msedge.exe 87 PID 2608 wrote to memory of 1116 2608 msedge.exe 87 PID 2608 wrote to memory of 1116 2608 msedge.exe 87 PID 2608 wrote to memory of 1116 2608 msedge.exe 87 PID 2608 wrote to memory of 1116 2608 msedge.exe 87 PID 2608 wrote to memory of 1116 2608 msedge.exe 87 PID 2608 wrote to memory of 1116 2608 msedge.exe 87 PID 2608 wrote to memory of 1116 2608 msedge.exe 87 PID 2608 wrote to memory of 1116 2608 msedge.exe 87 PID 2608 wrote to memory of 1116 2608 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c855491beb2671075fa3e83f8c7f8eff_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9984b46f8,0x7ff9984b4708,0x7ff9984b47182⤵PID:4740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,13361061720169745088,5389626293090249676,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:22⤵PID:3680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,13361061720169745088,5389626293090249676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,13361061720169745088,5389626293090249676,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:82⤵PID:1116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,13361061720169745088,5389626293090249676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:3048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,13361061720169745088,5389626293090249676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:4884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,13361061720169745088,5389626293090249676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:12⤵PID:4500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,13361061720169745088,5389626293090249676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:82⤵PID:2052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,13361061720169745088,5389626293090249676,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,13361061720169745088,5389626293090249676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:12⤵PID:2272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,13361061720169745088,5389626293090249676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:12⤵PID:3348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,13361061720169745088,5389626293090249676,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:12⤵PID:4876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,13361061720169745088,5389626293090249676,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:12⤵PID:3620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,13361061720169745088,5389626293090249676,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4044
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2772
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2484
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5111c361619c017b5d09a13a56938bd54
SHA1e02b363a8ceb95751623f25025a9299a2c931e07
SHA256d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc
SHA512fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2
-
Filesize
152B
MD5983cbc1f706a155d63496ebc4d66515e
SHA1223d0071718b80cad9239e58c5e8e64df6e2a2fe
SHA256cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c
SHA512d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize312B
MD5082c9e11bd9283f7e4277fee0ebadda0
SHA1ddacc5e27b1b19c912406aead39336d09f4df54f
SHA25645412154367915d076ff504850c4dbc3b92c98c9e4eb77870106df38d71003a4
SHA512bf30692f5c1f981dfd22e97788cd13cdfb9be68fab52ec00218c3c08aa053bec2e6cdfe9bfc40064260d4cff06edbc71fee81cac137172a847afabe350750826
-
Filesize
1KB
MD5c354999f0b4d2e3bc3e2133e6612e889
SHA118e2cea4d65733ca1a77ed0d8db9121f167e3298
SHA256db9eb4aec9245a7a12250a5a666e6dcd19f48837e2004c293a98f32597d54979
SHA512b35cfa25718e54089e0eb686370d6d4857718478a865940ed5a67e220d01e0bca3858cee7f6ee6f7bda1f84e33506acd95ef0722a1f01e0dcb7766d4676516ab
-
Filesize
5KB
MD5a815604ab221f015a5966a99a02d43e5
SHA1474411cda901fbf9a54d6dda18a73fe550f3773b
SHA25606d7bcfa8c5064159bd3fd9f19a78dab3b8dbae36e68e8942e5c31ced85eb384
SHA512943d19c32c193569af94d55af5e08ef7dc4512b87e4840d91a622615c6231877eeef5688a72a70d6d7e6bc3982af5ac70dfd9cb374363a6c29267bd5bdb6f448
-
Filesize
6KB
MD59bbb49c4249e6fffcd67921b70694a0f
SHA1cc3d5abd2e91437fd4c65d6ec364fc08d1df3f17
SHA256f808c2879e2ffc0150f7aaf5f26bd455f8f37b0bd358e25b82884fee65d84e09
SHA512d176a5e28261fa85fff2412075759e69338b554db7aa664dcca6f7484a4482261ab642fa729a651066ad4da2234599fc9c7a8182098913b1a6618425c3417460
-
Filesize
6KB
MD5ff3fe60ca43e27d1cbe22ec2c14488e4
SHA1d9fc30684deb2960bf25d9ceeabafe1de0bb9194
SHA256e8332f2ed51db4a1ab73d4d359ef6628d29c8426443376b2fc68bb4a2ddaf306
SHA5128541b62f5741cb7acf2b5b7d8e565e839a419a5160cc02c561fee07b2b366d3136052f16846b876f7c435c5a010cf52c086be0e9e72292945f0495b6b99de59e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD56a74d09961923b6ce65532e8f93b7bfb
SHA1c7dbd58e703cfd4d53e64eeeaa610b58bcee432f
SHA256967acd3bfb431bb291406890d7bebec6ad0bf8cacaf687f480545272beca174b
SHA512fe0117172c7265ada900debb1e9c86e84ce3390117ba12e1ba4d6ce0a472da1d39d4c59c50a69577b15ea2c2ad73d27aa6e477bc6b5d86f7427ab5f92d789799