Analysis
-
max time kernel
145s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-10-2024 09:56
Static task
static1
Behavioral task
behavioral1
Sample
2f16395f4fd8ae12e2d4f77776811956_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2f16395f4fd8ae12e2d4f77776811956_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
2f16395f4fd8ae12e2d4f77776811956_JaffaCakes118.html
-
Size
57KB
-
MD5
2f16395f4fd8ae12e2d4f77776811956
-
SHA1
345bd71506f1702672aeceb5d4c7b14ac257aa2c
-
SHA256
a739d282896e17bec78691fdb1546d85a9a6728e5ee97c758088700e783e7443
-
SHA512
40873f12eb09e8fe3d37e80b345cd875f4161cd1fd1af9bdc4c43640dc20732a310be242039ee954ea889443bb3ca6dc9cf1b8992f11a29f212421092c9abe26
-
SSDEEP
1536:gQZBCCOdG0IxCPh52QAGyY6nfU4RPC+d+3u5D8FwcmiAhQgRnaOYVDSpThBdPhPw:gk2w0Ix42QAGyY6nfU4RPC+d+3u5D8FL
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1796 msedge.exe 1796 msedge.exe 4664 msedge.exe 4664 msedge.exe 1536 identity_helper.exe 1536 identity_helper.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe 3364 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe 4664 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4664 wrote to memory of 1748 4664 msedge.exe 83 PID 4664 wrote to memory of 1748 4664 msedge.exe 83 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 392 4664 msedge.exe 84 PID 4664 wrote to memory of 1796 4664 msedge.exe 85 PID 4664 wrote to memory of 1796 4664 msedge.exe 85 PID 4664 wrote to memory of 3336 4664 msedge.exe 86 PID 4664 wrote to memory of 3336 4664 msedge.exe 86 PID 4664 wrote to memory of 3336 4664 msedge.exe 86 PID 4664 wrote to memory of 3336 4664 msedge.exe 86 PID 4664 wrote to memory of 3336 4664 msedge.exe 86 PID 4664 wrote to memory of 3336 4664 msedge.exe 86 PID 4664 wrote to memory of 3336 4664 msedge.exe 86 PID 4664 wrote to memory of 3336 4664 msedge.exe 86 PID 4664 wrote to memory of 3336 4664 msedge.exe 86 PID 4664 wrote to memory of 3336 4664 msedge.exe 86 PID 4664 wrote to memory of 3336 4664 msedge.exe 86 PID 4664 wrote to memory of 3336 4664 msedge.exe 86 PID 4664 wrote to memory of 3336 4664 msedge.exe 86 PID 4664 wrote to memory of 3336 4664 msedge.exe 86 PID 4664 wrote to memory of 3336 4664 msedge.exe 86 PID 4664 wrote to memory of 3336 4664 msedge.exe 86 PID 4664 wrote to memory of 3336 4664 msedge.exe 86 PID 4664 wrote to memory of 3336 4664 msedge.exe 86 PID 4664 wrote to memory of 3336 4664 msedge.exe 86 PID 4664 wrote to memory of 3336 4664 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2f16395f4fd8ae12e2d4f77776811956_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4f9746f8,0x7ffd4f974708,0x7ffd4f9747182⤵PID:1748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,11972264372442028072,7702232387692656970,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:22⤵PID:392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,11972264372442028072,7702232387692656970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,11972264372442028072,7702232387692656970,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:82⤵PID:3336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11972264372442028072,7702232387692656970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:3736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11972264372442028072,7702232387692656970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11972264372442028072,7702232387692656970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:12⤵PID:3984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11972264372442028072,7702232387692656970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:12⤵PID:832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11972264372442028072,7702232387692656970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:12⤵PID:1764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,11972264372442028072,7702232387692656970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 /prefetch:82⤵PID:2456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,11972264372442028072,7702232387692656970,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11972264372442028072,7702232387692656970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:12⤵PID:4192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11972264372442028072,7702232387692656970,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:12⤵PID:584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11972264372442028072,7702232387692656970,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:12⤵PID:1960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,11972264372442028072,7702232387692656970,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:12⤵PID:2520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,11972264372442028072,7702232387692656970,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=212 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3364
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3964
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4140
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5d41c7903707533d9655ec4f6b0503f3b
SHA18d4a6589027f98f48df5f4650c687197d023215f
SHA256b6be942b663abda98b94f3565a22e05cc14a15a3d3f8ada4fc9e97dcd13ad357
SHA512f835ed9e4c77afb5d8906b38c4998acecaef873aa869215ee39c546713faff3a1668f476aacc1d9c9b9ac7fa37a4bb28e9331a4016467e5ae8e22d522812ceaa
-
Filesize
152B
MD5b8880802fc2bb880a7a869faa01315b0
SHA151d1a3fa2c272f094515675d82150bfce08ee8d3
SHA256467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812
SHA512e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2
-
Filesize
152B
MD5ba6ef346187b40694d493da98d5da979
SHA1643c15bec043f8673943885199bb06cd1652ee37
SHA256d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73
SHA5122e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c
-
Filesize
213KB
MD5f942900ff0a10f251d338c612c456948
SHA14a283d3c8f3dc491e43c430d97c3489ee7a3d320
SHA25638b76a54655aff71271a9ad376ac17f20187abd581bf5aced69ccde0fe6e2fd6
SHA5129b393ce73598ed1997d28ceeddb23491a4d986c337984878ebb0ae06019e30ea77448d375d3d6563c774856d6bc98ee3ca0e0ba88ea5769a451a5e814f6ddb41
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize504B
MD53d9766db874f429978429dd8184a556f
SHA1dfa761a66aa8f577c94dd007ccf65166bfa7a29a
SHA25681738113ac3b705b512d9915e9fa719203bbdf9137de833e120f97a00366bd77
SHA51246fc6753982d496f842e0761e7e08bb065586ac81f9068e910ae71f7fee9d67c8d58db06ffc5dd3d530d88cdcaeddecbcc3c10d70b0273fdbc8ff62c6af7685a
-
Filesize
1KB
MD52fd9f468ec8c978c95a521ae0710ca69
SHA1b41d0001a244cee20e07c0cb88a3d8a73147633c
SHA256f256072eb9630f6af434e379825d6dc27edeef79f86fdacab5698da8974df24d
SHA5126df71cbe5643c40edb3bfcfbc80d30d0493185441b03e0312d02e955d901604f66841d2d018f5ad779679e7ee7b4670a15bcc5b515adef3c9525c0eb8aacfdd2
-
Filesize
6KB
MD59af797d05d3413f7bf9f8c863ff8a59b
SHA1a13a0d3c478490301bd52b1ff22fb71f22e37002
SHA256bfc591760e6e60a3a4809ce8cff668492bc2a0b92ee79353feefdce6fd55b832
SHA512716116b88d4959a74817140e50b541c1d5ff1de3f7caafc4596c8e4224fbbb27ffab927b1e4586c16b7bc27fd5157c4a05050f59ca1841824c3dc79803eb1959
-
Filesize
6KB
MD5d7bfde627921d66cc5dacd696c7bd9d7
SHA1ce769fcc66a4f6dc9657afa19db8579d2177ed1b
SHA256a0c88546a2d03f36886f8cfb51e825b922138da31e081c18ad06074abac3c476
SHA512d4d485704efa037c8219d9ca77d0011d1be6caf6349f6e113ab62367859d353efca24bfdc9adc50afd0988b554e1b12c6f13b068df1b7cbc8c58153e5e13179e
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389