Analysis
-
max time kernel
145s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/09/2024, 22:03
Static task
static1
Behavioral task
behavioral1
Sample
ee82f33b140d71c206c47f975e18eee0_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ee82f33b140d71c206c47f975e18eee0_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
ee82f33b140d71c206c47f975e18eee0_JaffaCakes118.html
-
Size
14KB
-
MD5
ee82f33b140d71c206c47f975e18eee0
-
SHA1
a9b88f273f0648b0565d380f516b580d75702b90
-
SHA256
2a9ff99adb58080d4843113dfba713972b881210f3a6a57268003f167a42e30b
-
SHA512
1fba1df623b6deb2a533afef826a372a4415f89e7ee2b5481ff731cad22db9c161056dda37af87cc63c2d1215f83baf0e4989baf2eefbedfbc481f12de617f67
-
SSDEEP
384:CyikbylU1B5cTW/+SQZS2qAi7zy1wVMSf2R3R0BR7Bs1TiTcQ6+:CyikbylU1fcTe+xzqAi7zIUMSU0Bj+Ts
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2308 msedge.exe 2308 msedge.exe 3944 msedge.exe 3944 msedge.exe 3628 identity_helper.exe 3628 identity_helper.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe 2616 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3944 wrote to memory of 4356 3944 msedge.exe 82 PID 3944 wrote to memory of 4356 3944 msedge.exe 82 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 4468 3944 msedge.exe 83 PID 3944 wrote to memory of 2308 3944 msedge.exe 84 PID 3944 wrote to memory of 2308 3944 msedge.exe 84 PID 3944 wrote to memory of 3656 3944 msedge.exe 85 PID 3944 wrote to memory of 3656 3944 msedge.exe 85 PID 3944 wrote to memory of 3656 3944 msedge.exe 85 PID 3944 wrote to memory of 3656 3944 msedge.exe 85 PID 3944 wrote to memory of 3656 3944 msedge.exe 85 PID 3944 wrote to memory of 3656 3944 msedge.exe 85 PID 3944 wrote to memory of 3656 3944 msedge.exe 85 PID 3944 wrote to memory of 3656 3944 msedge.exe 85 PID 3944 wrote to memory of 3656 3944 msedge.exe 85 PID 3944 wrote to memory of 3656 3944 msedge.exe 85 PID 3944 wrote to memory of 3656 3944 msedge.exe 85 PID 3944 wrote to memory of 3656 3944 msedge.exe 85 PID 3944 wrote to memory of 3656 3944 msedge.exe 85 PID 3944 wrote to memory of 3656 3944 msedge.exe 85 PID 3944 wrote to memory of 3656 3944 msedge.exe 85 PID 3944 wrote to memory of 3656 3944 msedge.exe 85 PID 3944 wrote to memory of 3656 3944 msedge.exe 85 PID 3944 wrote to memory of 3656 3944 msedge.exe 85 PID 3944 wrote to memory of 3656 3944 msedge.exe 85 PID 3944 wrote to memory of 3656 3944 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ee82f33b140d71c206c47f975e18eee0_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff40046f8,0x7ffff4004708,0x7ffff40047182⤵PID:4356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,9364391614891469457,1826449956428836953,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:22⤵PID:4468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,9364391614891469457,1826449956428836953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,9364391614891469457,1826449956428836953,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:82⤵PID:3656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9364391614891469457,1826449956428836953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9364391614891469457,1826449956428836953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:1632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,9364391614891469457,1826449956428836953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:82⤵PID:2320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,9364391614891469457,1826449956428836953,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9364391614891469457,1826449956428836953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:12⤵PID:3556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9364391614891469457,1826449956428836953,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2156 /prefetch:12⤵PID:896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9364391614891469457,1826449956428836953,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:12⤵PID:636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,9364391614891469457,1826449956428836953,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:12⤵PID:1700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,9364391614891469457,1826449956428836953,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3028 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2616
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:708
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4280
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD59b008261dda31857d68792b46af6dd6d
SHA1e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA2569ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
SHA51278853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
-
Filesize
152B
MD50446fcdd21b016db1f468971fb82a488
SHA1726b91562bb75f80981f381e3c69d7d832c87c9d
SHA25662c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
SHA5121df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
-
Filesize
5KB
MD5d0efc1314b29366740120161dceb82be
SHA134e9f116896516f65ca40c23aca8f8674c1d5620
SHA256c13cc88f1291d861df09b5b12e3d407effd6e51ad0c7deb9d4cb12aa2eb6a380
SHA512ff541cd9d5184a01a296c88a01ed4d7588310561b290cefbddb801062e7daa83fe2646f5a99fd77293d150857357eefc20392b373b1e7808c2d18b9b8d803bac
-
Filesize
6KB
MD5407ab5f0b4b94aee8884125427647061
SHA1cc8406c0b8bbe42136345c7ac58157e22a1e2e20
SHA256ca4d17a638045c7d62a064e9559f311ac56a7d7c488eff5c283d5f0a49af00a7
SHA51280b075068cf18f22f877d5d943536e647fcaa22fbe09c46740516f76f737dff1999b6b7e1f282b5e203fa10481870ca3f0f164c942cd77d4c84640da2f531e87
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD509be3e32ca18497ee1d1d5adf6a4f582
SHA151ab3616f72998042ae8f2308298357fd491ad37
SHA25664f9625462f28357d229397070651b72dcb97499726102d874d93950b0d6985f
SHA512236d897b98afb99ea4971bc21f502d461cb39a24387a94b11ede380cb9cd659ca39e7196cf80822c737051843266382087b8551ce133ba90c44978c189133e6c