Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-10-2024 02:09
Static task
static1
Behavioral task
behavioral1
Sample
3d38bd22c217bc8468f3a609c355810c_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3d38bd22c217bc8468f3a609c355810c_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
3d38bd22c217bc8468f3a609c355810c_JaffaCakes118.html
-
Size
85KB
-
MD5
3d38bd22c217bc8468f3a609c355810c
-
SHA1
c2d04d9a09793d94734246f21a52a9bc6bf5d3e1
-
SHA256
4315019cff6552f8854ef7587394dfd26c31549785dd14d2cc7392219d34e57e
-
SHA512
b0f4794d8fa67416ea5a04bad8e9a763b140ce544afa8a9f818ccdb1dfd138ae7dc8b278e313c60b47a94a1c195ac5d91afd941ce6443eea6f88ddc5e7b36a0f
-
SSDEEP
1536:w+ipVn1BUNqvLKvr7R/5nVYWCU6So0mjiMpbqqvmznhKv++nPLB1VZ:wBvLKvr7R/WiyuznhKv++nTB17
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1036 msedge.exe 1036 msedge.exe 2828 msedge.exe 2828 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe 2444 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2828 msedge.exe 2828 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe 2828 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2828 wrote to memory of 4336 2828 msedge.exe 83 PID 2828 wrote to memory of 4336 2828 msedge.exe 83 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1108 2828 msedge.exe 84 PID 2828 wrote to memory of 1036 2828 msedge.exe 85 PID 2828 wrote to memory of 1036 2828 msedge.exe 85 PID 2828 wrote to memory of 1724 2828 msedge.exe 86 PID 2828 wrote to memory of 1724 2828 msedge.exe 86 PID 2828 wrote to memory of 1724 2828 msedge.exe 86 PID 2828 wrote to memory of 1724 2828 msedge.exe 86 PID 2828 wrote to memory of 1724 2828 msedge.exe 86 PID 2828 wrote to memory of 1724 2828 msedge.exe 86 PID 2828 wrote to memory of 1724 2828 msedge.exe 86 PID 2828 wrote to memory of 1724 2828 msedge.exe 86 PID 2828 wrote to memory of 1724 2828 msedge.exe 86 PID 2828 wrote to memory of 1724 2828 msedge.exe 86 PID 2828 wrote to memory of 1724 2828 msedge.exe 86 PID 2828 wrote to memory of 1724 2828 msedge.exe 86 PID 2828 wrote to memory of 1724 2828 msedge.exe 86 PID 2828 wrote to memory of 1724 2828 msedge.exe 86 PID 2828 wrote to memory of 1724 2828 msedge.exe 86 PID 2828 wrote to memory of 1724 2828 msedge.exe 86 PID 2828 wrote to memory of 1724 2828 msedge.exe 86 PID 2828 wrote to memory of 1724 2828 msedge.exe 86 PID 2828 wrote to memory of 1724 2828 msedge.exe 86 PID 2828 wrote to memory of 1724 2828 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3d38bd22c217bc8468f3a609c355810c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2a4e46f8,0x7ffa2a4e4708,0x7ffa2a4e47182⤵PID:4336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,8953285682633650969,12830552244150760330,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2020 /prefetch:22⤵PID:1108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,8953285682633650969,12830552244150760330,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2540 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,8953285682633650969,12830552244150760330,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:82⤵PID:1724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,8953285682633650969,12830552244150760330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:1008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,8953285682633650969,12830552244150760330,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:3172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,8953285682633650969,12830552244150760330,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4924 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2444
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2988
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3656
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dc058ebc0f8181946a312f0be99ed79c
SHA10c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA256378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
SHA51236e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
-
Filesize
152B
MD5a0486d6f8406d852dd805b66ff467692
SHA177ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA256c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
SHA512065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
-
Filesize
6KB
MD542a2b1a7f48d26a46dd31345f648b114
SHA17e5ef8812768932476d6500cf46f21cbb79b77d1
SHA2561dae5dc4d8e507888e8c7a5c8b54c384695c5b92043aa073a444d6cfe3c4846e
SHA512991e9cff82c0dbee0c3f197f64f9cf0a14e4644be181bf220b6b3fef57d26d88445a26f4996b7c5843570ae33df16ffb24e1af437238aba9da69bbbe580634ba
-
Filesize
6KB
MD5139d52aa58af78bbb5a0289fa7a49857
SHA1ba343b9f0e282a9c706c5620e55c24952aa64174
SHA256e6ccba3b8b69acc5d5e60204fddb765d3c0bfef3d1dfa74ae161128e26b2ccd5
SHA51223853f7abead83c6d0e5c19da61e47372fe3a2ca98bd562ee9654f929a4c4027ae6b0cb4dc73a7a5440fc8f7d959eafb56b46bed5251dd069985a572340a48db
-
Filesize
10KB
MD52aeb928409d245cd17f3b60c59996ca7
SHA13388a2ea4bb99d3c7ecff7ac1bf0fde08d8402fa
SHA256bf73daf9ba166faa883f691792e64e2382f909dbbd7bfea71e9dc74d585ba97b
SHA512f51c83087827b1adf189934e3da86bf6214cb78fecf2e77cb9fb79f3406b73a833d215e2e2b21a299a8daca77e8655a9346e06119e3174d9937ca0cdfda13b47