Analysis
-
max time kernel
139s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 00:17
Static task
static1
Behavioral task
behavioral1
Sample
15705d87729cb4bbb7ea4981298a3a94_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
15705d87729cb4bbb7ea4981298a3a94_JaffaCakes118.html
Resource
win10v2004-20240802-en
General
-
Target
15705d87729cb4bbb7ea4981298a3a94_JaffaCakes118.html
-
Size
159KB
-
MD5
15705d87729cb4bbb7ea4981298a3a94
-
SHA1
757078e8e96a8759217187defa5e121ceda90aba
-
SHA256
09819d7c86badccdbaccb03b3fdcdc91a27feeb9f817c22d196c8752c0c8ba18
-
SHA512
a09fa480fb0bff1fe4ce305987b3ab51223e3a4703d125843dd416b3270edfc0ef2e17f52b3976cd519322947aeb72b336bf56fe7140ab1f85ec02319ce45182
-
SSDEEP
3072:iJQfAitP3iyfkMY+BES09JXAnyrZalI+YQ:i2IitP3nsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4820 msedge.exe 4820 msedge.exe 2876 msedge.exe 2876 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 780 identity_helper.exe 780 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe 2876 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2876 wrote to memory of 1612 2876 msedge.exe 82 PID 2876 wrote to memory of 1612 2876 msedge.exe 82 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4428 2876 msedge.exe 83 PID 2876 wrote to memory of 4820 2876 msedge.exe 84 PID 2876 wrote to memory of 4820 2876 msedge.exe 84 PID 2876 wrote to memory of 5076 2876 msedge.exe 85 PID 2876 wrote to memory of 5076 2876 msedge.exe 85 PID 2876 wrote to memory of 5076 2876 msedge.exe 85 PID 2876 wrote to memory of 5076 2876 msedge.exe 85 PID 2876 wrote to memory of 5076 2876 msedge.exe 85 PID 2876 wrote to memory of 5076 2876 msedge.exe 85 PID 2876 wrote to memory of 5076 2876 msedge.exe 85 PID 2876 wrote to memory of 5076 2876 msedge.exe 85 PID 2876 wrote to memory of 5076 2876 msedge.exe 85 PID 2876 wrote to memory of 5076 2876 msedge.exe 85 PID 2876 wrote to memory of 5076 2876 msedge.exe 85 PID 2876 wrote to memory of 5076 2876 msedge.exe 85 PID 2876 wrote to memory of 5076 2876 msedge.exe 85 PID 2876 wrote to memory of 5076 2876 msedge.exe 85 PID 2876 wrote to memory of 5076 2876 msedge.exe 85 PID 2876 wrote to memory of 5076 2876 msedge.exe 85 PID 2876 wrote to memory of 5076 2876 msedge.exe 85 PID 2876 wrote to memory of 5076 2876 msedge.exe 85 PID 2876 wrote to memory of 5076 2876 msedge.exe 85 PID 2876 wrote to memory of 5076 2876 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\15705d87729cb4bbb7ea4981298a3a94_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd171146f8,0x7ffd17114708,0x7ffd171147182⤵PID:1612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,7538419241163763152,3892697379242298487,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:22⤵PID:4428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,7538419241163763152,3892697379242298487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,7538419241163763152,3892697379242298487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:82⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7538419241163763152,3892697379242298487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:12⤵PID:3396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7538419241163763152,3892697379242298487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:3492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,7538419241163763152,3892697379242298487,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4524
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,7538419241163763152,3892697379242298487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:82⤵PID:2192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,7538419241163763152,3892697379242298487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7538419241163763152,3892697379242298487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:12⤵PID:2300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7538419241163763152,3892697379242298487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:12⤵PID:960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7538419241163763152,3892697379242298487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:12⤵PID:3596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,7538419241163763152,3892697379242298487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:12⤵PID:4972
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2924
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2812
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f9664c896e19205022c094d725f820b6
SHA1f8f1baf648df755ba64b412d512446baf88c0184
SHA2567121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e
SHA5123fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae
-
Filesize
152B
MD5847d47008dbea51cb1732d54861ba9c9
SHA1f2099242027dccb88d6f05760b57f7c89d926c0d
SHA25610292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1
SHA512bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f
-
Filesize
5KB
MD533603a39454f9b3bdfa802cdabae20fd
SHA197f17b3020f1adb4f6f8181834b8f4ef1c3b6b37
SHA256c5c9fe828b6c0a04cfe67d9cd067cca8779e7d9aafe5ebd53eec8b21bfcba52a
SHA512b5fe1223e7bd611861ec958e54d97d6f29bd7eeec161491a906f96657d3bc6221f94a503b501546142ba4d883821a9baf768dd94937ec36b583bd73ed331f01f
-
Filesize
6KB
MD50368e9c02bbdb47faf01cdba28c3146e
SHA195b8518727eac93264f77aa2d1063ab12af6e094
SHA256b66b22f6f8e571c8626bfe70955474d74ab12956f3decb01e13d96e7596829a9
SHA512234097688f4c3e3b17c35387c4a766d91bf30cc211bb211c17defbe38c12599c9d8b1be70eaa22209ed44507fa88de8f6c3534f716185ca20f1428ffa91ba24a
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD503a5e166136524a2db6ed167e8431598
SHA1dcfa9d3ccb84dedcd0f79d670757c080be4cc5ed
SHA2565578b3d6cf9562cf5a7f8ffd7177ea6e9053fc94496c52e9d1cbe6b56857de2d
SHA51249cf071da215882fab1f16d3126810e4b75703d886064f211038fa7898ef12cfa5010cd57ab3f51474b2daefdfb608e2e89c55e9c30d92228cdf542ae767e463