Analysis
-
max time kernel
139s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 23:58
Static task
static1
Behavioral task
behavioral1
Sample
1562c3e1a3ee086245b7b7f5df010873_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1562c3e1a3ee086245b7b7f5df010873_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
1562c3e1a3ee086245b7b7f5df010873_JaffaCakes118.html
-
Size
159KB
-
MD5
1562c3e1a3ee086245b7b7f5df010873
-
SHA1
f13bdcac641ddf2cabea8fbd69a7b2a0092df8b4
-
SHA256
ecdea7ba48b4e618ca4a05f5c62512e0d4d39914f8a539521f98291de8c69e4b
-
SHA512
0b630eef88c365bdb4ab655b48ca27c13dbd118d0c64152b209f0f7ce4fa31541a9763ff038b32530e05d68f4f09c1af7218b70736faf0710af2837e74f64597
-
SSDEEP
3072:in4EH71tSDByfkMY+BES09JXAnyrZalI+YQ:i4y71OEsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3788 msedge.exe 3788 msedge.exe 8 msedge.exe 8 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 1064 msedge.exe 2132 identity_helper.exe 2132 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe 8 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 8 wrote to memory of 2384 8 msedge.exe 82 PID 8 wrote to memory of 2384 8 msedge.exe 82 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 4484 8 msedge.exe 83 PID 8 wrote to memory of 3788 8 msedge.exe 84 PID 8 wrote to memory of 3788 8 msedge.exe 84 PID 8 wrote to memory of 1788 8 msedge.exe 85 PID 8 wrote to memory of 1788 8 msedge.exe 85 PID 8 wrote to memory of 1788 8 msedge.exe 85 PID 8 wrote to memory of 1788 8 msedge.exe 85 PID 8 wrote to memory of 1788 8 msedge.exe 85 PID 8 wrote to memory of 1788 8 msedge.exe 85 PID 8 wrote to memory of 1788 8 msedge.exe 85 PID 8 wrote to memory of 1788 8 msedge.exe 85 PID 8 wrote to memory of 1788 8 msedge.exe 85 PID 8 wrote to memory of 1788 8 msedge.exe 85 PID 8 wrote to memory of 1788 8 msedge.exe 85 PID 8 wrote to memory of 1788 8 msedge.exe 85 PID 8 wrote to memory of 1788 8 msedge.exe 85 PID 8 wrote to memory of 1788 8 msedge.exe 85 PID 8 wrote to memory of 1788 8 msedge.exe 85 PID 8 wrote to memory of 1788 8 msedge.exe 85 PID 8 wrote to memory of 1788 8 msedge.exe 85 PID 8 wrote to memory of 1788 8 msedge.exe 85 PID 8 wrote to memory of 1788 8 msedge.exe 85 PID 8 wrote to memory of 1788 8 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1562c3e1a3ee086245b7b7f5df010873_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd95346f8,0x7ffcd9534708,0x7ffcd95347182⤵PID:2384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,11668665473675957613,9619336071578249354,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:22⤵PID:4484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,11668665473675957613,9619336071578249354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,11668665473675957613,9619336071578249354,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:82⤵PID:1788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11668665473675957613,9619336071578249354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:1872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11668665473675957613,9619336071578249354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:1684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,11668665473675957613,9619336071578249354,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5092 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,11668665473675957613,9619336071578249354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3040 /prefetch:82⤵PID:4896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,11668665473675957613,9619336071578249354,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3040 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11668665473675957613,9619336071578249354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:12⤵PID:1180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11668665473675957613,9619336071578249354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:12⤵PID:4488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11668665473675957613,9619336071578249354,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:12⤵PID:4008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11668665473675957613,9619336071578249354,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:12⤵PID:1312
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3560
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5d7114a6cd851f9bf56cf771c37d664a2
SHA1769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA256d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
SHA51233bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
-
Filesize
152B
MD5719923124ee00fb57378e0ebcbe894f7
SHA1cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA256aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
SHA512a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
-
Filesize
5KB
MD59038676f69a93f786e0579d0c07186c4
SHA10bab1874249d728e98ca4db77dabd932d579aa31
SHA2563e99ba28a92a5a90064218b0fa69ce6ee764b7f6986e76adb576d0b87e3bb608
SHA5122798cf07697b11a08c557b7de3fe577d844cc4ef0e85bbdf5d4763f6cb90306a6bda09b9a6d40a714ec545afea54648459ed65905b35c8555f7819da72ec63be
-
Filesize
6KB
MD5a44d6a8a3b02a8260934b8d5143563fb
SHA1458c1b00871cfa91e368c9c63abe76db69b3de3a
SHA2566b767fbba01e65726881eb70251a4906bd95b0ead8ea1740bceb71ae51ec7a89
SHA51219e3ba350164070737e526a68e02e2ce8436a991da97d28cf001a4e6b6bc9f6234248a46be99a5100120aacae26219bc9b6ecb8a1e57dec54d06e6097605058c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD51119f5a7591865fd55c2d37be12b93a4
SHA1a955e75c49d46d4434946bb12a56cfb75f6005c0
SHA256de0343f8456aad7cc7aeb4a69fe917b95700b2b617e0d078a5c015a7913ab328
SHA5122a69861b57daa2fc43641372df8bb931b3d87ea7444a1d27fbd22a25ae12337c68edbb0298ae6b0a4147cda178f151a98c2427e99c607842ab6b40a5218edfa3