Analysis
-
max time kernel
145s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28-09-2024 09:50
Static task
static1
Behavioral task
behavioral1
Sample
fc0975c4ae65ccbec125e87660980d34_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fc0975c4ae65ccbec125e87660980d34_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
fc0975c4ae65ccbec125e87660980d34_JaffaCakes118.html
-
Size
32KB
-
MD5
fc0975c4ae65ccbec125e87660980d34
-
SHA1
2413678e774acdfaa0ec11c1ac080c2ed3ba8771
-
SHA256
d4e07f07d78279d120a9161135b610a11ebb6556239deeb45e76fab4b2d15d45
-
SHA512
1cd3b7e28067a40a4777c54a117eb8fceee9e5b7aa92be5650160fdcaa06343ce01ddaa91393739c7b80260ae9e515ef9dfb0192795b01b10a6a1e5b97cf3e95
-
SSDEEP
768:Zcd9QZBC7mOdMYupC5I9nC4D9jTXbwGwTweMkiPd:gQZBCCOdK0IxCOjTXbwGwTwBkiPd
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2480 msedge.exe 2480 msedge.exe 4964 msedge.exe 4964 msedge.exe 4360 identity_helper.exe 4360 identity_helper.exe 316 msedge.exe 316 msedge.exe 316 msedge.exe 316 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe 4964 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4964 wrote to memory of 4060 4964 msedge.exe 82 PID 4964 wrote to memory of 4060 4964 msedge.exe 82 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 3120 4964 msedge.exe 83 PID 4964 wrote to memory of 2480 4964 msedge.exe 84 PID 4964 wrote to memory of 2480 4964 msedge.exe 84 PID 4964 wrote to memory of 4908 4964 msedge.exe 85 PID 4964 wrote to memory of 4908 4964 msedge.exe 85 PID 4964 wrote to memory of 4908 4964 msedge.exe 85 PID 4964 wrote to memory of 4908 4964 msedge.exe 85 PID 4964 wrote to memory of 4908 4964 msedge.exe 85 PID 4964 wrote to memory of 4908 4964 msedge.exe 85 PID 4964 wrote to memory of 4908 4964 msedge.exe 85 PID 4964 wrote to memory of 4908 4964 msedge.exe 85 PID 4964 wrote to memory of 4908 4964 msedge.exe 85 PID 4964 wrote to memory of 4908 4964 msedge.exe 85 PID 4964 wrote to memory of 4908 4964 msedge.exe 85 PID 4964 wrote to memory of 4908 4964 msedge.exe 85 PID 4964 wrote to memory of 4908 4964 msedge.exe 85 PID 4964 wrote to memory of 4908 4964 msedge.exe 85 PID 4964 wrote to memory of 4908 4964 msedge.exe 85 PID 4964 wrote to memory of 4908 4964 msedge.exe 85 PID 4964 wrote to memory of 4908 4964 msedge.exe 85 PID 4964 wrote to memory of 4908 4964 msedge.exe 85 PID 4964 wrote to memory of 4908 4964 msedge.exe 85 PID 4964 wrote to memory of 4908 4964 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fc0975c4ae65ccbec125e87660980d34_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe07ae46f8,0x7ffe07ae4708,0x7ffe07ae47182⤵PID:4060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,11841146823670932198,5127824441274740552,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2308 /prefetch:22⤵PID:3120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2256,11841146823670932198,5127824441274740552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2708 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2256,11841146823670932198,5127824441274740552,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:82⤵PID:4908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,11841146823670932198,5127824441274740552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,11841146823670932198,5127824441274740552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:4976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,11841146823670932198,5127824441274740552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4304 /prefetch:12⤵PID:1376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,11841146823670932198,5127824441274740552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4432 /prefetch:12⤵PID:4800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,11841146823670932198,5127824441274740552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:12⤵PID:3208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2256,11841146823670932198,5127824441274740552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:82⤵PID:3808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2256,11841146823670932198,5127824441274740552,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5708 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,11841146823670932198,5127824441274740552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:12⤵PID:4468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,11841146823670932198,5127824441274740552,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:12⤵PID:4660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,11841146823670932198,5127824441274740552,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:12⤵PID:4612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2256,11841146823670932198,5127824441274740552,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:12⤵PID:4120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2256,11841146823670932198,5127824441274740552,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:316
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4592
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3024
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e4f80e7950cbd3bb11257d2000cb885e
SHA110ac643904d539042d8f7aa4a312b13ec2106035
SHA2561184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124
SHA5122b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0
-
Filesize
152B
MD52dc1a9f2f3f8c3cfe51bb29b078166c5
SHA1eaf3c3dad3c8dc6f18dc3e055b415da78b704402
SHA256dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa
SHA512682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25
-
Filesize
213KB
MD5f942900ff0a10f251d338c612c456948
SHA14a283d3c8f3dc491e43c430d97c3489ee7a3d320
SHA25638b76a54655aff71271a9ad376ac17f20187abd581bf5aced69ccde0fe6e2fd6
SHA5129b393ce73598ed1997d28ceeddb23491a4d986c337984878ebb0ae06019e30ea77448d375d3d6563c774856d6bc98ee3ca0e0ba88ea5769a451a5e814f6ddb41
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize504B
MD5608e875cda309a72e68280c27aa876c6
SHA1c482145ca86d851d0cbea5df7f731eb210511f1b
SHA256d4e84d4298b27fffaf6a51ad4629a32f855b9f5e4ee78d7e25fd11f144463de1
SHA5123c578e0231acb1a250cc54826609b597e3cc663a9effc1cccd9cef7c05b2cb50f6c7e78b9285111f75fca16056d0d7874689f3c5d8fa74b48f51803a6f42202f
-
Filesize
1KB
MD573ef6b8e8953f463fd48e31a84ee013b
SHA18c688ce34424f3b3c183327728d119d659596b8c
SHA25616f24cf03a2e5067acc658ac7bce284e7c2cfde5cae613518d6f3440fc95b489
SHA5121af6ed36578719f80d67b2e8f9301743b5c0c9fe2f3cab68e2c10e1fc8c218ed49998a52cd7b5c4daa3cf254a4b9001c6c81cc61b8993618391c12c35c9d8830
-
Filesize
5KB
MD5cd9ab43231e907c6efca8b6dd2557323
SHA18e23de1dffc63d762e0430cb3b0158e582343905
SHA25673826b41f8030f7945984f2d7cd53b2a4c7834f0b22531851382c3b6ad0fd511
SHA512c652c20adfcbd26478f1ccacecd6c66f903165077014f16b9da907458da311d5dcbea14dc9d1682bc880c3e28ed2d7d4e2d9554170fbf2f57e0ed99572f846b2
-
Filesize
6KB
MD5e76e2ae51b1def92ba35250533655d50
SHA16e5599a8db0d1797249b4bead59cfb1350754bbd
SHA256a5ba49da62189aa85f67aad57147e238b2a7ba47a0465f1f59a173f055daf469
SHA512fa3ff8994a68f05aac36bf1048ead757e2feb9cd32dd745519ea851135f8b0a4bd88a45a0a27867791c7a3730becebf699b5652e16fa3fa64c4646e647801f83
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD569e9befdc5f3088bf76bcbe6e4e548aa
SHA1ef5d0febc4b006468cae03d4b87c61ca48f6ed5d
SHA256549908712dbc94a4f31afdc4b931417cbc040f947cf44b4d8984aefe2aa461db
SHA512760c5d87560e3468c0ce5a6173f1d8aef275df46a802d91f386111719ef142ff1efe62166e99d10dd0d56553dfdc074f6a0c2fefa38d46c40a5aeb11fd67e3e1