Analysis
-
max time kernel
145s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 04:58
Static task
static1
Behavioral task
behavioral1
Sample
2b45fddd7c2b786d7dc41536bd095384_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2b45fddd7c2b786d7dc41536bd095384_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
2b45fddd7c2b786d7dc41536bd095384_JaffaCakes118.html
-
Size
46KB
-
MD5
2b45fddd7c2b786d7dc41536bd095384
-
SHA1
aed923b3706e5819974998332736e474001fdb45
-
SHA256
e324fd0e6cd55b57fbcbc0a52d94c14871b6518f9f4992209766342737655e39
-
SHA512
81b0a6be957d580f13cbac89c9149099c111ec2ead4cde46d563bb791eb6b4cac6acb45eb0dd87313e4ce91a41bc63ecb99fe8616beb841c0685b350a7dac352
-
SSDEEP
768:GZCxA6zB/lopRnTuoAKCc4lRYjKyqKjI+fFbEv2Dzw92bjUuMuF/ToKB/i43TJ8H:GSVzB/lopRnTuoAKCc4lRYj+KjI+fFby
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 396 msedge.exe 396 msedge.exe 448 msedge.exe 448 msedge.exe 4472 identity_helper.exe 4472 identity_helper.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe 804 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe 448 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 448 wrote to memory of 1344 448 msedge.exe 83 PID 448 wrote to memory of 1344 448 msedge.exe 83 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 2296 448 msedge.exe 84 PID 448 wrote to memory of 396 448 msedge.exe 85 PID 448 wrote to memory of 396 448 msedge.exe 85 PID 448 wrote to memory of 2916 448 msedge.exe 86 PID 448 wrote to memory of 2916 448 msedge.exe 86 PID 448 wrote to memory of 2916 448 msedge.exe 86 PID 448 wrote to memory of 2916 448 msedge.exe 86 PID 448 wrote to memory of 2916 448 msedge.exe 86 PID 448 wrote to memory of 2916 448 msedge.exe 86 PID 448 wrote to memory of 2916 448 msedge.exe 86 PID 448 wrote to memory of 2916 448 msedge.exe 86 PID 448 wrote to memory of 2916 448 msedge.exe 86 PID 448 wrote to memory of 2916 448 msedge.exe 86 PID 448 wrote to memory of 2916 448 msedge.exe 86 PID 448 wrote to memory of 2916 448 msedge.exe 86 PID 448 wrote to memory of 2916 448 msedge.exe 86 PID 448 wrote to memory of 2916 448 msedge.exe 86 PID 448 wrote to memory of 2916 448 msedge.exe 86 PID 448 wrote to memory of 2916 448 msedge.exe 86 PID 448 wrote to memory of 2916 448 msedge.exe 86 PID 448 wrote to memory of 2916 448 msedge.exe 86 PID 448 wrote to memory of 2916 448 msedge.exe 86 PID 448 wrote to memory of 2916 448 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2b45fddd7c2b786d7dc41536bd095384_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1fe846f8,0x7ffe1fe84708,0x7ffe1fe847182⤵PID:1344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,8613686947996191712,4975399385687138875,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:2296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,8613686947996191712,4975399385687138875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,8613686947996191712,4975399385687138875,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:82⤵PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8613686947996191712,4975399385687138875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:1008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8613686947996191712,4975399385687138875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:2956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8613686947996191712,4975399385687138875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:12⤵PID:1228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8613686947996191712,4975399385687138875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:12⤵PID:3228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8613686947996191712,4975399385687138875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:12⤵PID:4496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8613686947996191712,4975399385687138875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:12⤵PID:4136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8613686947996191712,4975399385687138875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6120 /prefetch:82⤵PID:5008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,8613686947996191712,4975399385687138875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6120 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8613686947996191712,4975399385687138875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:12⤵PID:748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,8613686947996191712,4975399385687138875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:12⤵PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,8613686947996191712,4975399385687138875,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4804 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:804
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1568
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4040
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD50a9dc42e4013fc47438e96d24beb8eff
SHA1806ab26d7eae031a58484188a7eb1adab06457fc
SHA25658d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
SHA512868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
-
Filesize
152B
MD561cef8e38cd95bf003f5fdd1dc37dae1
SHA111f2f79ecb349344c143eea9a0fed41891a3467f
SHA256ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
SHA5126fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize216B
MD5fd9a316f774e47f0434013a1f378db7e
SHA1a18ab9e55f462bc272fda134f3b93586213e5a64
SHA256a069c5123b62ed29d1ba93542826d731de8038b238e5b841bbf9931eaaeeb8dd
SHA512709e47730e2df468fd8fa587aa39a990bbb9ab90033b0c8046474a3d8a6c1955cedd0e0e2f4748c9eef78658219254a30c500d8d157db4f5e62ccc88fbfedc23
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
2KB
MD5a45e1f18e2447937aadd57d281575e03
SHA1b68d5ed919859598edaca6336053668fac40c4b1
SHA256dd899614c43ccb35a610f100644d86921c753c72debbaad80749f6d191689505
SHA51228820260001fd172171e69cbc31b5eb29e3273ef81059a4ee854e0d0c7581a3fd4d9a5e7a561b28535c050302f2a1cde8f099c99a7ccdd451fbc6e54e414a16d
-
Filesize
2KB
MD5349607f1b97c1a1d67bb254a3315a977
SHA14cd61c054bb6fa770a473262d10aff404780545d
SHA256aa9d9c32dde67561ac8d53bdb8e5d957fa2fa0fe325a863f570d320cf6393fc7
SHA512341fb75e42df6dffcea26a44ca624e383bb4d0fcfcf1689620473bb06504b67fc0f7cd775adc3b31728a1fa8e247d5797be17668b221ae998346975ff06a5f72
-
Filesize
6KB
MD5d59a9073a0fc4956a3fa39faf66afa01
SHA10e9be628e9d401b4fe82b39dfefbe7777d19172a
SHA25641472c56edcae7572b54cce9674ef250456b708ef7800d3993a6d45a021c1139
SHA512e1d87361986d2e8cc88fe86ce229404983c809fe87c403923619b93679a7a1175ab529e2f98b63267058d59632b0c4c7455fbcd4de31b9f7d6745546bdb016e3
-
Filesize
6KB
MD57688ae013355037e87f1944fede16b36
SHA11b31197bd117f1da43548072f056d66fe84284f8
SHA2561b7d1a8eb270bfe00935fef1dff4823a2948ea86507538d1f8803421aca0efa7
SHA512db5e8051de5aeb6796c8bcc064d3aee5b8483f6a707f185c6fcc387285fbad5ca488d14d4f4bc78f7340c705bbccc43e59f1bbae0f667760c117b98723696e08
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD58d7b2d6da5c8871898d4e586927cca04
SHA1b1d58e8ff7db59025e2aefe7f34504ffcbc762a6
SHA2569571e2e8ba75ea025efca599cd4cca8a3d6de1acb2335a689fe6fe76fdec2b68
SHA512374c5164503dbe7b551efd32159514d4643f81355802464bcbce2ff02daa32465576bbba1521ab62072842f736f6adbd1d4bb862281c4ecdd5c2197539f51ad5