Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/10/2024, 20:59
Static task
static1
Behavioral task
behavioral1
Sample
255ddb0263ef30b937f78e71149d75ac_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
255ddb0263ef30b937f78e71149d75ac_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
255ddb0263ef30b937f78e71149d75ac_JaffaCakes118.html
-
Size
25KB
-
MD5
255ddb0263ef30b937f78e71149d75ac
-
SHA1
ba74740d7ec0c8e8bde6ae7f0f2cbb61e319360a
-
SHA256
af15240823a8e2da6eed199ea2adeea7680521112487b9f5cef8139dcba36bb3
-
SHA512
a0e39ca2ae60d6caa562ddfd721e96a259df1cd25a73f9a16a0d8c6d431a57f4efb939be3e859510d7189472a860cc6449ed956138f01c799a270f151a0d9604
-
SSDEEP
384:vdg2H8ofNGwoaCOOUtxKTeBfKTpA3yHMaDILgWQQ/U4yhoy7jfIWrYc51IlSAuVS:1g2HlfNjltITe0+CsdNG9p6
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3416 msedge.exe 3416 msedge.exe 4180 msedge.exe 4180 msedge.exe 4492 identity_helper.exe 4492 identity_helper.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe 3100 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe 4180 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4180 wrote to memory of 5024 4180 msedge.exe 83 PID 4180 wrote to memory of 5024 4180 msedge.exe 83 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3148 4180 msedge.exe 84 PID 4180 wrote to memory of 3416 4180 msedge.exe 85 PID 4180 wrote to memory of 3416 4180 msedge.exe 85 PID 4180 wrote to memory of 3748 4180 msedge.exe 86 PID 4180 wrote to memory of 3748 4180 msedge.exe 86 PID 4180 wrote to memory of 3748 4180 msedge.exe 86 PID 4180 wrote to memory of 3748 4180 msedge.exe 86 PID 4180 wrote to memory of 3748 4180 msedge.exe 86 PID 4180 wrote to memory of 3748 4180 msedge.exe 86 PID 4180 wrote to memory of 3748 4180 msedge.exe 86 PID 4180 wrote to memory of 3748 4180 msedge.exe 86 PID 4180 wrote to memory of 3748 4180 msedge.exe 86 PID 4180 wrote to memory of 3748 4180 msedge.exe 86 PID 4180 wrote to memory of 3748 4180 msedge.exe 86 PID 4180 wrote to memory of 3748 4180 msedge.exe 86 PID 4180 wrote to memory of 3748 4180 msedge.exe 86 PID 4180 wrote to memory of 3748 4180 msedge.exe 86 PID 4180 wrote to memory of 3748 4180 msedge.exe 86 PID 4180 wrote to memory of 3748 4180 msedge.exe 86 PID 4180 wrote to memory of 3748 4180 msedge.exe 86 PID 4180 wrote to memory of 3748 4180 msedge.exe 86 PID 4180 wrote to memory of 3748 4180 msedge.exe 86 PID 4180 wrote to memory of 3748 4180 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\255ddb0263ef30b937f78e71149d75ac_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdae9c46f8,0x7ffdae9c4708,0x7ffdae9c47182⤵PID:5024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,1595021993464150625,6646720560706877985,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:22⤵PID:3148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,1595021993464150625,6646720560706877985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,1595021993464150625,6646720560706877985,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:82⤵PID:3748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1595021993464150625,6646720560706877985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:1984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1595021993464150625,6646720560706877985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:1908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,1595021993464150625,6646720560706877985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:82⤵PID:4624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,1595021993464150625,6646720560706877985,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1595021993464150625,6646720560706877985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:12⤵PID:716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1595021993464150625,6646720560706877985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:12⤵PID:1624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1595021993464150625,6646720560706877985,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:12⤵PID:5112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1595021993464150625,6646720560706877985,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:12⤵PID:1532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,1595021993464150625,6646720560706877985,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5196 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3100
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1992
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58749e21d9d0a17dac32d5aa2027f7a75
SHA1a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA256915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
SHA512c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
-
Filesize
152B
MD534d2c4f40f47672ecdf6f66fea242f4a
SHA14bcad62542aeb44cae38a907d8b5a8604115ada2
SHA256b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
SHA51250fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
-
Filesize
6KB
MD5c8ddf0be3e3061bf95ebe2b488e57a7f
SHA12679bdcbfa876daa1b633c9c46a4926c5bb5f43a
SHA256543cf3045d3a8fec18a4c4b6277ccf2b307e57ecb3c1081cc0076372ed286c78
SHA5120bf4ac67fd57b322435c6d2b1ea538c412b8798a70b890d8efcdb05be07b0b32ff2bbfbe4948b33eccdf76ac334bec436f8b19380ca73c48a9894210f38fe9f4
-
Filesize
6KB
MD544e517832ec05d1057a30c95efd1b712
SHA115fb967a65ca0ac8975f4f0e6d4da7e614fd7c7c
SHA25600de73b67e3d0ee689a69532bd9add281e16e8b955dcade81ffd1dfb25c752b9
SHA512489551823a0526142ade7790fc55dbfcfa7c501e03f7940a826edfb8c92c9ba3de51cc436dc20914f4a428de58d652b3a7cf5b5d7a955b32aa1b9a17fcb0f005
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD52724ee4a39450a1a9ff58e9d580ae7d9
SHA1fc977e3b7d3391548df6b0c34fb30d861677bc70
SHA256bde77274908c5b279afe9ddf780fa300ecad1c4b6ae7be5d31c5cc15db075706
SHA512fa5c37cd34214c378a98ab7cb882efe5f92ce0337dc40a0e24f94a82747791fa3bc2dc8c2f216fc32e986607894eebfc7ee1665c7f291a6c84abbfe2dc73f8d8