Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 12:30
Static task
static1
Behavioral task
behavioral1
Sample
d45db7626633f1b26a6697b198e04997_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d45db7626633f1b26a6697b198e04997_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
d45db7626633f1b26a6697b198e04997_JaffaCakes118.html
-
Size
138KB
-
MD5
d45db7626633f1b26a6697b198e04997
-
SHA1
1bfc929096192e330f094131d189462e31c6866b
-
SHA256
2a1fa1eb0b062c6adc45405deb6eae392e9070c47514ab464f6b87e328674503
-
SHA512
be4280f5e2ac8aed2a59885ba59273c8626a54d2967395a7e84161cc6decddb08145839d51f6d938fa8fa29b1d9d962d1580d12182950ae43b390410df662a88
-
SSDEEP
1536:StvJtr3FlgyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:StkyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 316 msedge.exe 316 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe 668 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2252 msedge.exe 2252 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe 2252 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2252 wrote to memory of 1208 2252 msedge.exe 83 PID 2252 wrote to memory of 1208 2252 msedge.exe 83 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 876 2252 msedge.exe 84 PID 2252 wrote to memory of 316 2252 msedge.exe 85 PID 2252 wrote to memory of 316 2252 msedge.exe 85 PID 2252 wrote to memory of 2952 2252 msedge.exe 86 PID 2252 wrote to memory of 2952 2252 msedge.exe 86 PID 2252 wrote to memory of 2952 2252 msedge.exe 86 PID 2252 wrote to memory of 2952 2252 msedge.exe 86 PID 2252 wrote to memory of 2952 2252 msedge.exe 86 PID 2252 wrote to memory of 2952 2252 msedge.exe 86 PID 2252 wrote to memory of 2952 2252 msedge.exe 86 PID 2252 wrote to memory of 2952 2252 msedge.exe 86 PID 2252 wrote to memory of 2952 2252 msedge.exe 86 PID 2252 wrote to memory of 2952 2252 msedge.exe 86 PID 2252 wrote to memory of 2952 2252 msedge.exe 86 PID 2252 wrote to memory of 2952 2252 msedge.exe 86 PID 2252 wrote to memory of 2952 2252 msedge.exe 86 PID 2252 wrote to memory of 2952 2252 msedge.exe 86 PID 2252 wrote to memory of 2952 2252 msedge.exe 86 PID 2252 wrote to memory of 2952 2252 msedge.exe 86 PID 2252 wrote to memory of 2952 2252 msedge.exe 86 PID 2252 wrote to memory of 2952 2252 msedge.exe 86 PID 2252 wrote to memory of 2952 2252 msedge.exe 86 PID 2252 wrote to memory of 2952 2252 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d45db7626633f1b26a6697b198e04997_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf51a46f8,0x7ffbf51a4708,0x7ffbf51a47182⤵PID:1208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,9124989986783471705,5393554783832352837,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:22⤵PID:876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,9124989986783471705,5393554783832352837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,9124989986783471705,5393554783832352837,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:82⤵PID:2952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9124989986783471705,5393554783832352837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:3432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,9124989986783471705,5393554783832352837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:4228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,9124989986783471705,5393554783832352837,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:668
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2708
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d7114a6cd851f9bf56cf771c37d664a2
SHA1769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA256d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
SHA51233bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
-
Filesize
152B
MD5719923124ee00fb57378e0ebcbe894f7
SHA1cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA256aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
SHA512a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
-
Filesize
5KB
MD50c2315999f5ba44e4d34c4dd833e0006
SHA13e5f564c0a98a911be0d2f5f9a0c91d0c8e6fc69
SHA25619a416335a513e71a8fa0d8c3d0d7588c50de027312161a129de43736f9d3e60
SHA512f25f7ad550873f55ceb85fc5a9e18a8e9bbb3e2ff376a6428566b46f05870a7290f503ac705f331ae033845ef6d17d41f42d3bedb6c5b1d13b6359443cc12d9a
-
Filesize
6KB
MD5109b7c8186dc1b9476b735082e9b0ba7
SHA1225d5be824ffd6101642431a7d71af6ba4ac4d1d
SHA2568b8d6fcff436307eafff8a0dd61bfac8e6f81475853ad3f28009896212b7778c
SHA5126bc965ed53a4f9abae4fcc7ee1b3e0b6e7bc3e92441cc2cc6fa21d0fb4c6617f063c7083450d87f48c68a6e1129ac3886f9c0dff11c15818238df51de62da8ab
-
Filesize
10KB
MD53dcaf93413beb757e971e3ea109358db
SHA1471c5eec12046f82057deb8ee6ab14a87c0b71ec
SHA2565c1a98d18297187e4390a78d56293b1ffa9140f457db2dada7a1c540bb22faf7
SHA5120ba4f4e51a1d38be4f45d0e4cd31dc9970c8e2ac3a0e7e0628d82abf10d21eb39c197f6db216b4a292d66b277c49c2f670a07c26e617a994b54b628e6ba66841