Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/08/2024, 13:23
Static task
static1
Behavioral task
behavioral1
Sample
c8e66697ca7e9ae1a5f5ec8916c1b3ee_JaffaCakes118.html
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c8e66697ca7e9ae1a5f5ec8916c1b3ee_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
c8e66697ca7e9ae1a5f5ec8916c1b3ee_JaffaCakes118.html
-
Size
53KB
-
MD5
c8e66697ca7e9ae1a5f5ec8916c1b3ee
-
SHA1
c6d7d549cab8eacdef30629625a093ba6d16f4c1
-
SHA256
58e063125886dd71a5d28a2d2819da6bf61659a1494f971e07648de56d2a9aee
-
SHA512
a6cc44a5ca4fad883b1fe513b2dfa279a2cff63841d7319519dcd6e689486ffe11c72cd2d0b00b20ded48a8731eb2e992330bdce557ff4ee9cba192cd45e2758
-
SSDEEP
1536:CkgUiIakTqGivi+PyUorunlY+63Nj+q5Vy0R0w2AzTICbb9ob/t9M/dNwIUTDmD5:CkgUiIakTqGivi+PyUorunlY+63Nj+qt
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 5028 msedge.exe 5028 msedge.exe 3492 msedge.exe 3492 msedge.exe 3980 identity_helper.exe 3980 identity_helper.exe 5100 msedge.exe 5100 msedge.exe 5100 msedge.exe 5100 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3492 wrote to memory of 3004 3492 msedge.exe 84 PID 3492 wrote to memory of 3004 3492 msedge.exe 84 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 4848 3492 msedge.exe 85 PID 3492 wrote to memory of 5028 3492 msedge.exe 86 PID 3492 wrote to memory of 5028 3492 msedge.exe 86 PID 3492 wrote to memory of 1112 3492 msedge.exe 87 PID 3492 wrote to memory of 1112 3492 msedge.exe 87 PID 3492 wrote to memory of 1112 3492 msedge.exe 87 PID 3492 wrote to memory of 1112 3492 msedge.exe 87 PID 3492 wrote to memory of 1112 3492 msedge.exe 87 PID 3492 wrote to memory of 1112 3492 msedge.exe 87 PID 3492 wrote to memory of 1112 3492 msedge.exe 87 PID 3492 wrote to memory of 1112 3492 msedge.exe 87 PID 3492 wrote to memory of 1112 3492 msedge.exe 87 PID 3492 wrote to memory of 1112 3492 msedge.exe 87 PID 3492 wrote to memory of 1112 3492 msedge.exe 87 PID 3492 wrote to memory of 1112 3492 msedge.exe 87 PID 3492 wrote to memory of 1112 3492 msedge.exe 87 PID 3492 wrote to memory of 1112 3492 msedge.exe 87 PID 3492 wrote to memory of 1112 3492 msedge.exe 87 PID 3492 wrote to memory of 1112 3492 msedge.exe 87 PID 3492 wrote to memory of 1112 3492 msedge.exe 87 PID 3492 wrote to memory of 1112 3492 msedge.exe 87 PID 3492 wrote to memory of 1112 3492 msedge.exe 87 PID 3492 wrote to memory of 1112 3492 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c8e66697ca7e9ae1a5f5ec8916c1b3ee_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff992e646f8,0x7ff992e64708,0x7ff992e647182⤵PID:3004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12651102623542083483,4132375567457128184,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:4848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,12651102623542083483,4132375567457128184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,12651102623542083483,4132375567457128184,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2784 /prefetch:82⤵PID:1112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12651102623542083483,4132375567457128184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:3948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12651102623542083483,4132375567457128184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:1876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12651102623542083483,4132375567457128184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:12⤵PID:2764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12651102623542083483,4132375567457128184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:82⤵PID:2144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12651102623542083483,4132375567457128184,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12651102623542083483,4132375567457128184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:12⤵PID:448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12651102623542083483,4132375567457128184,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:12⤵PID:1632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12651102623542083483,4132375567457128184,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:12⤵PID:3476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12651102623542083483,4132375567457128184,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:12⤵PID:548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12651102623542083483,4132375567457128184,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1860 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5100
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3168
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f9664c896e19205022c094d725f820b6
SHA1f8f1baf648df755ba64b412d512446baf88c0184
SHA2567121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
SHA5123fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
-
Filesize
152B
MD5847d47008dbea51cb1732d54861ba9c9
SHA1f2099242027dccb88d6f05760b57f7c89d926c0d
SHA25610292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
SHA512bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
-
Filesize
5KB
MD581bda9e05e0c03d5555a0a3cdc93fcdc
SHA1ee4f035e45b0b8d567ee134975f0b6f411c4398b
SHA2563864534321df0c0db4ce70c52b3d02d63813902d060762be7e2805184b23520c
SHA51298e4e91cc2e7effd17aa0bbfe81a8c79f582478fcffbb0818e6a3a8e1cfc0bb51c6902869a626b137f55f8482681d5d814233bf131c3e1c78fa0db81071706a2
-
Filesize
6KB
MD506eb216ceb9ba1428f0e6c9920ea10c6
SHA1176deb991b9d37c1b82e83c3859002a12bf570d9
SHA2568c2746ecae06da88cfc2c40b60b5ec655a7cf6c5be7c9d6631a0069f128f23b3
SHA5122e82d69c6fbb1fc1cdf4619c2836df08e2ea4162ed721019af729d399ee013481a43fe8b993b01e3864e981fedcacfbb28c60b950a0491674df47301b4d07075
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5eab70d19611432e21ab727bba92d5250
SHA10c7a8c437f6932686caa1143b60da7af147dbf21
SHA2563118680c5f3313f6e46e01edac21e51d7430d4c0336a28293101afc0983a2244
SHA5129b89cc9fa18a0cf88aee531a533921f05818e07405e3e623da7f5ffdba795f037a50b7b15bcee244043345a585b365131bdce9146b56206d88ec7f1ae466e8fe