Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2024, 20:31
Static task
static1
Behavioral task
behavioral1
Sample
36ab11c84df174a78acef70bfec61ad2_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
36ab11c84df174a78acef70bfec61ad2_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
36ab11c84df174a78acef70bfec61ad2_JaffaCakes118.html
-
Size
15KB
-
MD5
36ab11c84df174a78acef70bfec61ad2
-
SHA1
248855ebd5cd8277fa251096bc1ba346abd99450
-
SHA256
ad14f340efd23c093cd5655181493cfc1aefd0bf3cdaf12956f2ed369751fa43
-
SHA512
b3292f3db59f71d73d619770776f111800be60ed52456f39e5afb4dde9e2099882d33a84915a2adba87625e7511d21b4d402de272f73ff86c9fa625612ca4579
-
SSDEEP
384:5Cw7h3coq0P3O/Xq6UyZ07wmGv1B8fxjtAhnE2l2V:5cx0P3O/Xq6UyGfS4
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4908 msedge.exe 4908 msedge.exe 3032 msedge.exe 3032 msedge.exe 4596 identity_helper.exe 4596 identity_helper.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe 3944 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe 3032 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3032 wrote to memory of 4812 3032 msedge.exe 83 PID 3032 wrote to memory of 4812 3032 msedge.exe 83 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4176 3032 msedge.exe 84 PID 3032 wrote to memory of 4908 3032 msedge.exe 85 PID 3032 wrote to memory of 4908 3032 msedge.exe 85 PID 3032 wrote to memory of 3624 3032 msedge.exe 86 PID 3032 wrote to memory of 3624 3032 msedge.exe 86 PID 3032 wrote to memory of 3624 3032 msedge.exe 86 PID 3032 wrote to memory of 3624 3032 msedge.exe 86 PID 3032 wrote to memory of 3624 3032 msedge.exe 86 PID 3032 wrote to memory of 3624 3032 msedge.exe 86 PID 3032 wrote to memory of 3624 3032 msedge.exe 86 PID 3032 wrote to memory of 3624 3032 msedge.exe 86 PID 3032 wrote to memory of 3624 3032 msedge.exe 86 PID 3032 wrote to memory of 3624 3032 msedge.exe 86 PID 3032 wrote to memory of 3624 3032 msedge.exe 86 PID 3032 wrote to memory of 3624 3032 msedge.exe 86 PID 3032 wrote to memory of 3624 3032 msedge.exe 86 PID 3032 wrote to memory of 3624 3032 msedge.exe 86 PID 3032 wrote to memory of 3624 3032 msedge.exe 86 PID 3032 wrote to memory of 3624 3032 msedge.exe 86 PID 3032 wrote to memory of 3624 3032 msedge.exe 86 PID 3032 wrote to memory of 3624 3032 msedge.exe 86 PID 3032 wrote to memory of 3624 3032 msedge.exe 86 PID 3032 wrote to memory of 3624 3032 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\36ab11c84df174a78acef70bfec61ad2_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8640646f8,0x7ff864064708,0x7ff8640647182⤵PID:4812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,2076082056882217846,4280099997128230418,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:22⤵PID:4176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1968,2076082056882217846,4280099997128230418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1968,2076082056882217846,4280099997128230418,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:82⤵PID:3624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2076082056882217846,4280099997128230418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:2152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2076082056882217846,4280099997128230418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2076082056882217846,4280099997128230418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:12⤵PID:5000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2076082056882217846,4280099997128230418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2656 /prefetch:12⤵PID:4664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2076082056882217846,4280099997128230418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:12⤵PID:4932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,2076082056882217846,4280099997128230418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:82⤵PID:2280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1968,2076082056882217846,4280099997128230418,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2076082056882217846,4280099997128230418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:12⤵PID:3844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2076082056882217846,4280099997128230418,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:12⤵PID:1644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2076082056882217846,4280099997128230418,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:12⤵PID:3160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1968,2076082056882217846,4280099997128230418,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:12⤵PID:2452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1968,2076082056882217846,4280099997128230418,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5484 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3944
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4828
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1496
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e55832d7cd7e868a2c087c4c73678018
SHA1ed7a2f6d6437e907218ffba9128802eaf414a0eb
SHA256a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574
SHA512897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f
-
Filesize
152B
MD5c2d9eeb3fdd75834f0ac3f9767de8d6f
SHA14d16a7e82190f8490a00008bd53d85fb92e379b0
SHA2561e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66
SHA512d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd
-
Filesize
215KB
MD51585c4c0ffdb55b2a4fdc0b0f5c317be
SHA1aac0e0f12332063c75c690458b2cfe5acb800d0a
SHA25618a1cfc3b339903a71e6a68791cde83fca626a4c1a22be5cb7755c9f2343e2a5
SHA5127021ed87f0c97edc3a8ff838202fa444841eafcbfa4e00e722b723393a1ac679279aa744e8edde237a05be6060527a0c7e64a36148bd2d1316d5589d78d08e23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize312B
MD5cc4bea6061670a0d3a3ff841a36a2553
SHA1c73121c7ce08262484470ec70aa73362ebe85933
SHA25674944efa49a5d508eef6f088d7db788b29d6a96bf49d75f520e734cba09ad822
SHA512f3e06368563899fa096cde0cf7fecd89c601a3f2273bbce35cff431155c9e63fbb56718a7d1fa50256392da812bfe4430f7ac56920c54379e1cff40906ca6987
-
Filesize
1KB
MD50d5efef755eabaa1f66a1d9303076855
SHA16bc82d8ec714495cfaf1664866b16cb4fdab277b
SHA25602700163e1dc8d051ccbfc2daec98dddf24f7f8f42c39e419e441d2ea31a1b27
SHA51290d6a59d1e9fa8bd9821acdeb4b649f2f88d11a4ec57548c79126006b553f0fae83f7ea05e417f66fa95569b5d6a696f3401483ad55f8a62ed91635a25b91016
-
Filesize
6KB
MD5e1c5e0e894b43e343baf7bca8f705b87
SHA1f267237e4e1c8737a24b7521a6747f860859aa9d
SHA2563eb471442584a75969fdcaed10a24d4e7de5dbddbba643e61244fb821b1bf8c9
SHA512a6675818a5c71e3e30fabe7283908945bf7e9650bd2936276c1bfff572eaa7f02e185c4827c310062ed9454de62e5d4fe642ff6debf3de6585a197bcaa48e83c
-
Filesize
7KB
MD5395cce59be4b7866d6322b0867eda1c8
SHA1ab4803d0d63523447154fb61591bbede67422328
SHA2562885656fbf8d3e9738e92d0cd04ff8bca4f03c44ffbb576f5a08a8f2a05c268b
SHA512378314c6212488bd8a754e52164a5f39adf0787f49874f6d5ebeda3e9a192b3fd21bc054e65c7d0ef76ba807bef2a04ed562edbf299290991881c6baa6aeb032
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
10KB
MD5796af713654c16e0a350c8559d191a11
SHA144674f64309e296a0e0d49eb02e86d30119e1d78
SHA25669d258669589676b52b308d43bad8b6e234397df32ee6cc01b846c2a6d38aa95
SHA512bbc457d7daa96234665af4b25fbd3322e9534cec62ae00636aa6e093d6400b43608f342bdc50da3e250bdb2251fd0adbe88e06376370d3448f834a629ea39cee