Analysis
-
max time kernel
145s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/09/2024, 11:22
Static task
static1
Behavioral task
behavioral1
Sample
fc3297d728f731f4607a614cb79aa9cc_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fc3297d728f731f4607a614cb79aa9cc_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
fc3297d728f731f4607a614cb79aa9cc_JaffaCakes118.html
-
Size
30KB
-
MD5
fc3297d728f731f4607a614cb79aa9cc
-
SHA1
140c8062fc016a6e077a2cc66b79d392dcdb7e16
-
SHA256
4fda37021eca768f5672e34e4ef07111a891effac0a1bd8e8ce0bc6db6fd0c10
-
SHA512
c4bc0a79de424793c2ee25fab19ff989f70fd331579793a75d5a7ace893af70a87d1e9c4c168932c221bef2aaf3e33c57431300a3f135f496f23839b019ca78e
-
SSDEEP
768:ihzJD2pBHzBY/kuRbXUqWuGeHhqg1Zf9hLd29HmV:iz2pBHzBYVRzYfeHhqg1ZFhL5
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 440 msedge.exe 440 msedge.exe 4404 msedge.exe 4404 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
pid Process 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe 4404 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4404 wrote to memory of 2520 4404 msedge.exe 82 PID 4404 wrote to memory of 2520 4404 msedge.exe 82 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 3156 4404 msedge.exe 83 PID 4404 wrote to memory of 440 4404 msedge.exe 84 PID 4404 wrote to memory of 440 4404 msedge.exe 84 PID 4404 wrote to memory of 3528 4404 msedge.exe 85 PID 4404 wrote to memory of 3528 4404 msedge.exe 85 PID 4404 wrote to memory of 3528 4404 msedge.exe 85 PID 4404 wrote to memory of 3528 4404 msedge.exe 85 PID 4404 wrote to memory of 3528 4404 msedge.exe 85 PID 4404 wrote to memory of 3528 4404 msedge.exe 85 PID 4404 wrote to memory of 3528 4404 msedge.exe 85 PID 4404 wrote to memory of 3528 4404 msedge.exe 85 PID 4404 wrote to memory of 3528 4404 msedge.exe 85 PID 4404 wrote to memory of 3528 4404 msedge.exe 85 PID 4404 wrote to memory of 3528 4404 msedge.exe 85 PID 4404 wrote to memory of 3528 4404 msedge.exe 85 PID 4404 wrote to memory of 3528 4404 msedge.exe 85 PID 4404 wrote to memory of 3528 4404 msedge.exe 85 PID 4404 wrote to memory of 3528 4404 msedge.exe 85 PID 4404 wrote to memory of 3528 4404 msedge.exe 85 PID 4404 wrote to memory of 3528 4404 msedge.exe 85 PID 4404 wrote to memory of 3528 4404 msedge.exe 85 PID 4404 wrote to memory of 3528 4404 msedge.exe 85 PID 4404 wrote to memory of 3528 4404 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fc3297d728f731f4607a614cb79aa9cc_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba3ef46f8,0x7ffba3ef4708,0x7ffba3ef47182⤵PID:2520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,3215257556700233636,6631304541246406145,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:3156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,3215257556700233636,6631304541246406145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,3215257556700233636,6631304541246406145,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:82⤵PID:3528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3215257556700233636,6631304541246406145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:2000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3215257556700233636,6631304541246406145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:4976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3215257556700233636,6631304541246406145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:12⤵PID:2052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3215257556700233636,6631304541246406145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:12⤵PID:2572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3215257556700233636,6631304541246406145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:12⤵PID:3236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3215257556700233636,6631304541246406145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:12⤵PID:2036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,3215257556700233636,6631304541246406145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:82⤵PID:932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,3215257556700233636,6631304541246406145,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:82⤵PID:2392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3215257556700233636,6631304541246406145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:12⤵PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3215257556700233636,6631304541246406145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:12⤵PID:4120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3215257556700233636,6631304541246406145,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:12⤵PID:3304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3215257556700233636,6631304541246406145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:12⤵PID:2448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3215257556700233636,6631304541246406145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2276 /prefetch:12⤵PID:3744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,3215257556700233636,6631304541246406145,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:12⤵PID:3608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,3215257556700233636,6631304541246406145,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4908 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3100
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2228
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2104
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD553bc70ecb115bdbabe67620c416fe9b3
SHA1af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA256b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
SHA512cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
-
Filesize
152B
MD5e765f3d75e6b0e4a7119c8b14d47d8da
SHA1cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA256986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
SHA512a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
-
Filesize
851B
MD5132532e8e6273b4f7fa2995949ac6716
SHA11230ddbc7f5ba74d627c4e71c6dbaea15dfc14c6
SHA2560b4d1bd686f727a9838cf05f7a8f06c5d37ab1d9e2aec98a1f5d80229069c93a
SHA51286b132a189f9f0ea9fcbe84c1cda6d938bae9173edc6bc2d464bbc1b111bed7b973d0cfb07eefa4be3f4ca4ac67db3cab8e9e18a25a0a14c9b26244e27ba1864
-
Filesize
5KB
MD5ef385f584b7f2455ed1ae8115068c9c8
SHA15f378ce8683f930f15f4679e73a87e0e523b7878
SHA2568e24bb1e7c51fdc56649e05651ce1792729d3c3640587fd090f3f81a89a6a003
SHA51222819de4a73033c5481cccea17b0f2d40af26012e185da06b1ba72f19037a5ed1f6299e6e2e97bdd7f2b76a29d98d20ae4fb409607e7a0225433c54a0f1768ab
-
Filesize
6KB
MD5bb53dffb40f68698633beef0d9f4af94
SHA1ab86b647b5d784cb59871cd05a3bdcf3d3e79b73
SHA256aea6a23cdb7bf8b6cb55546ad8ecc80d7576b0b115436324e859732c6c8a4eac
SHA5127007fda673413dd6ad1b25fd665df6ec910a7282cd4ab0298a325a8575fa28b73ac7a947c85f7fa7cdc2a7b8de73eb937e11c525d6c0f4613d4ba5acb9754890
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD597e0f7f9d6288ba2021ee9b17cd5f1e4
SHA11f68a390dc08ff7029f255ce1c0fac7047e8305b
SHA256cffe37c4a04fb775ff1e084072e6fa37cc4f254a53776a91507a9eaad2d8afd4
SHA51236dfbcfcdd843264ac2d41e58e150c9bcbfa9969f249559c34a96f6aaf0e1e89c3bfea51eb6a2923069ab919b0196abf8bea7c286af9f92346bce21eaa967d1a