Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07-09-2024 12:31
Static task
static1
Behavioral task
behavioral1
Sample
d1f0083076ff21704267df2d3073458e_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d1f0083076ff21704267df2d3073458e_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d1f0083076ff21704267df2d3073458e_JaffaCakes118.html
-
Size
23KB
-
MD5
d1f0083076ff21704267df2d3073458e
-
SHA1
b5e6e77e80021b15f155788334a28003f52edb8c
-
SHA256
38b1df959a49f2b31bdec880278b830e136cb3986e7753f9d861239e97657982
-
SHA512
cf532dd6daac79d0308648a52217463cfd9c1c51f70dc2ccad01c2ebd054627bc32d9bb6fd714d8207369a12c5f4d112eec02c2ab403d33b56910e9ab9ba854f
-
SSDEEP
192:uw/9b5nrDGnQjxn5Q/unQieVNnqnQOkEntOsnQTbnBnQtBXZvMB1qnrXnQ7tnYYK:fQ/ameIC
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 332 msedge.exe 332 msedge.exe 2236 msedge.exe 2236 msedge.exe 3520 identity_helper.exe 3520 identity_helper.exe 5068 msedge.exe 5068 msedge.exe 5068 msedge.exe 5068 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe 2236 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 916 2236 msedge.exe 83 PID 2236 wrote to memory of 916 2236 msedge.exe 83 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 2692 2236 msedge.exe 85 PID 2236 wrote to memory of 332 2236 msedge.exe 86 PID 2236 wrote to memory of 332 2236 msedge.exe 86 PID 2236 wrote to memory of 3756 2236 msedge.exe 87 PID 2236 wrote to memory of 3756 2236 msedge.exe 87 PID 2236 wrote to memory of 3756 2236 msedge.exe 87 PID 2236 wrote to memory of 3756 2236 msedge.exe 87 PID 2236 wrote to memory of 3756 2236 msedge.exe 87 PID 2236 wrote to memory of 3756 2236 msedge.exe 87 PID 2236 wrote to memory of 3756 2236 msedge.exe 87 PID 2236 wrote to memory of 3756 2236 msedge.exe 87 PID 2236 wrote to memory of 3756 2236 msedge.exe 87 PID 2236 wrote to memory of 3756 2236 msedge.exe 87 PID 2236 wrote to memory of 3756 2236 msedge.exe 87 PID 2236 wrote to memory of 3756 2236 msedge.exe 87 PID 2236 wrote to memory of 3756 2236 msedge.exe 87 PID 2236 wrote to memory of 3756 2236 msedge.exe 87 PID 2236 wrote to memory of 3756 2236 msedge.exe 87 PID 2236 wrote to memory of 3756 2236 msedge.exe 87 PID 2236 wrote to memory of 3756 2236 msedge.exe 87 PID 2236 wrote to memory of 3756 2236 msedge.exe 87 PID 2236 wrote to memory of 3756 2236 msedge.exe 87 PID 2236 wrote to memory of 3756 2236 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d1f0083076ff21704267df2d3073458e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8996946f8,0x7ff899694708,0x7ff8996947182⤵PID:916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,2586524499220777985,6352324026080363125,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:22⤵PID:2692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,2586524499220777985,6352324026080363125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,2586524499220777985,6352324026080363125,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:82⤵PID:3756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2586524499220777985,6352324026080363125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:3076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2586524499220777985,6352324026080363125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:3428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,2586524499220777985,6352324026080363125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 /prefetch:82⤵PID:2312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,2586524499220777985,6352324026080363125,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2586524499220777985,6352324026080363125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2444 /prefetch:12⤵PID:372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2586524499220777985,6352324026080363125,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:12⤵PID:1520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2586524499220777985,6352324026080363125,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵PID:4780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2586524499220777985,6352324026080363125,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:2896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,2586524499220777985,6352324026080363125,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5068
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2896
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD553bc70ecb115bdbabe67620c416fe9b3
SHA1af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA256b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
SHA512cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
-
Filesize
152B
MD5e765f3d75e6b0e4a7119c8b14d47d8da
SHA1cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA256986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
SHA512a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
-
Filesize
6KB
MD56965e8302b51c4948464b4efdb5201ed
SHA1e2c1942466363e4fc290944ee90fb727a9aba9ee
SHA2566a56340d637835e61bb4631835c80ce4e196829e4a6c7df230081c8fa5ad5c1a
SHA5120aeca3f24a5ad286dbe1576f870d63fead20c9b026af547f1340c43b8b7a203bbb91e35c8198c26de2c140e2eb35da9a3617ac2c4e7eb7dd8eac3d81bf360e78
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e29a4b13-f4c5-44da-b35f-33c090d0e560.tmp
Filesize5KB
MD53690daf27f9ed7b8a7cd0ade87a4707c
SHA1140d32fe3dbd17b7d9cfa0bf71bf239c67c2307c
SHA256773e963c00b1d2be8d81254304959bce260cb67c2d2ac3754419fea3e65a4f7f
SHA512e49ad53a38c21f911ecf46963da6885939443a0f6b42de3e86788d90b6721643ddba6345d13122877b8a8a0d9364f391042ff69f13f3ea436fc5b962a4c40be6
-
Filesize
10KB
MD5342468537b8c3c0f1ca9a8820ea195e4
SHA16a42ae3f1a46e0597dffd41a34d3a53cb57eda2c
SHA25675ca5fc692502da9bb15b859355bd6177f2160c9814886237503e5c9444608cf
SHA51253688285e6a81c5a1bc91594296202b6df787b040fff9a5e63cd86aab297abeba48ddd36616534ab59104b1c218dee4a0a158dd6ea848bcade2590d1cf3af8a2