Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08-10-2024 21:40
Static task
static1
Behavioral task
behavioral1
Sample
25d814ad947529710536f57a653dc20d_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
25d814ad947529710536f57a653dc20d_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
25d814ad947529710536f57a653dc20d_JaffaCakes118.html
-
Size
139KB
-
MD5
25d814ad947529710536f57a653dc20d
-
SHA1
fc32c41464b88985b737a5de9f7213ee74688574
-
SHA256
dacfb4484be1dffef134170f3b2437f632642dc4f138060ec54dcf8bbdd9718e
-
SHA512
e71ca2393a6df49cf5693025d87c3fb16dfcf516b50506061faf84b2e57b2be66656cae0295b1a38865ee43dff3ce961ff5f0ece8a55f256fec31a9d7a3c72e7
-
SSDEEP
1536:SeNKSJVKeIcTaUiPlElyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXu:SeLiylyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2692 msedge.exe 2692 msedge.exe 2020 msedge.exe 2020 msedge.exe 880 msedge.exe 880 msedge.exe 880 msedge.exe 880 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2020 msedge.exe 2020 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe 2020 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2020 wrote to memory of 3052 2020 msedge.exe 85 PID 2020 wrote to memory of 3052 2020 msedge.exe 85 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2988 2020 msedge.exe 86 PID 2020 wrote to memory of 2692 2020 msedge.exe 87 PID 2020 wrote to memory of 2692 2020 msedge.exe 87 PID 2020 wrote to memory of 876 2020 msedge.exe 88 PID 2020 wrote to memory of 876 2020 msedge.exe 88 PID 2020 wrote to memory of 876 2020 msedge.exe 88 PID 2020 wrote to memory of 876 2020 msedge.exe 88 PID 2020 wrote to memory of 876 2020 msedge.exe 88 PID 2020 wrote to memory of 876 2020 msedge.exe 88 PID 2020 wrote to memory of 876 2020 msedge.exe 88 PID 2020 wrote to memory of 876 2020 msedge.exe 88 PID 2020 wrote to memory of 876 2020 msedge.exe 88 PID 2020 wrote to memory of 876 2020 msedge.exe 88 PID 2020 wrote to memory of 876 2020 msedge.exe 88 PID 2020 wrote to memory of 876 2020 msedge.exe 88 PID 2020 wrote to memory of 876 2020 msedge.exe 88 PID 2020 wrote to memory of 876 2020 msedge.exe 88 PID 2020 wrote to memory of 876 2020 msedge.exe 88 PID 2020 wrote to memory of 876 2020 msedge.exe 88 PID 2020 wrote to memory of 876 2020 msedge.exe 88 PID 2020 wrote to memory of 876 2020 msedge.exe 88 PID 2020 wrote to memory of 876 2020 msedge.exe 88 PID 2020 wrote to memory of 876 2020 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\25d814ad947529710536f57a653dc20d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe18946f8,0x7ffbe1894708,0x7ffbe18947182⤵PID:3052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,14436236312238310950,11685069324163890103,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:2988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,14436236312238310950,11685069324163890103,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,14436236312238310950,11685069324163890103,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵PID:876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14436236312238310950,11685069324163890103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:3184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,14436236312238310950,11685069324163890103,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,14436236312238310950,11685069324163890103,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1300 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:880
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3692
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4452
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dc058ebc0f8181946a312f0be99ed79c
SHA10c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA256378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
SHA51236e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
-
Filesize
152B
MD5a0486d6f8406d852dd805b66ff467692
SHA177ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA256c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
SHA512065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
-
Filesize
6KB
MD57bc6bc7da79c446138882489e7746371
SHA12fc5cf86a0ecbd4865a23097d92cace315535643
SHA25693bc1c1d5833d398186cdee768b4f22fb6db7c08d189e097f83c8f24ac4ce704
SHA5120bdf4a3f02eebb3d7203ec5c7afce08dbdd6bac4ff2c4e1ad6fe9f70b31c98cc0d13656e83e5b572e5b1296bdfd48c06a47a8da4e7baebcdbcd34060b1a1d0b6
-
Filesize
6KB
MD59860eaff95639dac1a1e59dd228962e5
SHA173e1058cfbce34b9cfcb0de7a4d3aeae03445753
SHA2561d2cf189c6d7a6bc4d3f428d1a240a06ab963ced7a826b223393cd87a293cf06
SHA512e5c3edcfcd41e811586ee1ad5d2e4079ceacc7c18c591e2f0381d6188f6cf670f33717493adeeff729659d9e1565224b28d25acf12cd7808edf085de1549b7b4
-
Filesize
10KB
MD59188f50a731fcfb558cb59e750baedf5
SHA1eae900fc653c248d131938a760594ba057f89fb0
SHA256ea82005a9ba0757d549c9350f54862fb6f7a1877f7961fd7f407c2547bea19af
SHA51225b732f3f59b7934946f5e44df2f0411ccae29f4498edf0c9ce3ae4b7a06ac6a6309685295325cd66b8355c335eb538c40c266a2a86d3053b9c42e454b05149b
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e