Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 02:49
Static task
static1
Behavioral task
behavioral1
Sample
d35c9da89817d8f99dd785a7488d2322_JaffaCakes118.html
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
d35c9da89817d8f99dd785a7488d2322_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d35c9da89817d8f99dd785a7488d2322_JaffaCakes118.html
-
Size
110KB
-
MD5
d35c9da89817d8f99dd785a7488d2322
-
SHA1
65588db994b6a600680a9291eff043a79697b37b
-
SHA256
67baf25701edf70f9dbe2dab441f0b11154c9463ea00b64e3532a7d485a7fdf0
-
SHA512
2d674389b78593eae3cda4a520fbbbaf46ab4f149e94ddbbd51aa44bd1b0d3dcc18f2dd6e9aeff4aaff46241636b0f82645ab6cde528ca03bd9c3761977731b3
-
SSDEEP
3072:tVwegn2NH9p2n/d8MQkp564J84WRgBo2WYKsM/A0NrU:ghn2NH32/dDo2RKsMBq
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1532 msedge.exe 1532 msedge.exe 5104 msedge.exe 5104 msedge.exe 3612 identity_helper.exe 3612 identity_helper.exe 3380 msedge.exe 3380 msedge.exe 3380 msedge.exe 3380 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5104 wrote to memory of 2568 5104 msedge.exe 83 PID 5104 wrote to memory of 2568 5104 msedge.exe 83 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 2880 5104 msedge.exe 84 PID 5104 wrote to memory of 1532 5104 msedge.exe 85 PID 5104 wrote to memory of 1532 5104 msedge.exe 85 PID 5104 wrote to memory of 4268 5104 msedge.exe 86 PID 5104 wrote to memory of 4268 5104 msedge.exe 86 PID 5104 wrote to memory of 4268 5104 msedge.exe 86 PID 5104 wrote to memory of 4268 5104 msedge.exe 86 PID 5104 wrote to memory of 4268 5104 msedge.exe 86 PID 5104 wrote to memory of 4268 5104 msedge.exe 86 PID 5104 wrote to memory of 4268 5104 msedge.exe 86 PID 5104 wrote to memory of 4268 5104 msedge.exe 86 PID 5104 wrote to memory of 4268 5104 msedge.exe 86 PID 5104 wrote to memory of 4268 5104 msedge.exe 86 PID 5104 wrote to memory of 4268 5104 msedge.exe 86 PID 5104 wrote to memory of 4268 5104 msedge.exe 86 PID 5104 wrote to memory of 4268 5104 msedge.exe 86 PID 5104 wrote to memory of 4268 5104 msedge.exe 86 PID 5104 wrote to memory of 4268 5104 msedge.exe 86 PID 5104 wrote to memory of 4268 5104 msedge.exe 86 PID 5104 wrote to memory of 4268 5104 msedge.exe 86 PID 5104 wrote to memory of 4268 5104 msedge.exe 86 PID 5104 wrote to memory of 4268 5104 msedge.exe 86 PID 5104 wrote to memory of 4268 5104 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d35c9da89817d8f99dd785a7488d2322_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9023646f8,0x7ff902364708,0x7ff9023647182⤵PID:2568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,7071249201167420426,17960658343720973690,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:22⤵PID:2880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,7071249201167420426,17960658343720973690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,7071249201167420426,17960658343720973690,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:82⤵PID:4268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7071249201167420426,17960658343720973690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:2884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7071249201167420426,17960658343720973690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:12⤵PID:780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,7071249201167420426,17960658343720973690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:82⤵PID:3516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,7071249201167420426,17960658343720973690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7071249201167420426,17960658343720973690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:12⤵PID:3152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7071249201167420426,17960658343720973690,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:12⤵PID:3308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7071249201167420426,17960658343720973690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:12⤵PID:1008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,7071249201167420426,17960658343720973690,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:12⤵PID:2320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,7071249201167420426,17960658343720973690,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3404 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3380
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1232
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2600
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f9664c896e19205022c094d725f820b6
SHA1f8f1baf648df755ba64b412d512446baf88c0184
SHA2567121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
SHA5123fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
-
Filesize
152B
MD5847d47008dbea51cb1732d54861ba9c9
SHA1f2099242027dccb88d6f05760b57f7c89d926c0d
SHA25610292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
SHA512bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
-
Filesize
323B
MD55f9a19158766a34cbc57cf12ee0c6caf
SHA14198c7d3181199448806474421cd0ab6225a511f
SHA256a04f5ecfe42a1c512d89114c715f24975b37059489947cb0c63b0c29a4796c0a
SHA512a9beda0db249f64329f136b183cb4019c68f574511be479d673727a712b8e131f6853a851618ee5a2fd66fcd1a1b3cee7e1687f8146fa5b844922e7bb43da4b6
-
Filesize
5KB
MD5573a40f18bedf34eca30a836f0167ed8
SHA1727d4351975971c2a7746b5a21c15e41cc141860
SHA2561cd0b60ff51e1513eeb086d78c7e02db6c22be65a67770288f6bad09a11d4685
SHA5120414095b548152da80be7f4d481d429864b2efc7c1a6aa0bec558026093ba35ee39dc746ef0297bd06d4dc03d6a6c0a0f3b595919723e812bea082faa8e0d046
-
Filesize
6KB
MD5e5c2b077da5aa227da78b8b5835390f6
SHA10e869f24de7c637e09e470abb42fabf9b2db6c1e
SHA2561c943e25da0efdc24b8e778aa94f8c14384e9d6e50cd758e6a5bdb3314ed8318
SHA5127121dbd726b4743a870dfb30f22dbe89be009a7b211be68537fc3ee248f16eaadff43e72f66f74b6b4d940460666209e969613b941bce833107ef8a3c5649cfa
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD53c45c0b8c92a66ea7da159c781825a59
SHA19974b41c27276c37b7b481d69cb33906580d3ae5
SHA256ec1ad5a354f87036f47eff76c06ba6149aea76cc4c73f86f6beb1da351c6ed4e
SHA51247934ed738fa505788ecc91c004768d8e9711142ee8548d956d286aa86f95e19856105d17952a6fdbab43a1802d84da5ea280080571c29306437d0b8d26eac08