Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2024, 04:37
Static task
static1
Behavioral task
behavioral1
Sample
45e098c608220e5dffd13d0c5c2a3fb4_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
45e098c608220e5dffd13d0c5c2a3fb4_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
45e098c608220e5dffd13d0c5c2a3fb4_JaffaCakes118.html
-
Size
139KB
-
MD5
45e098c608220e5dffd13d0c5c2a3fb4
-
SHA1
d61123d05f8003ba7fafee335496eba4dd3c7eeb
-
SHA256
9de02d6b7659af18fdac6510f7a58fec97eac33f51aff98fcfb1e2881385bfe4
-
SHA512
70d0f882f62787903757c8ea548f594533bdd69f86063ac70aeb393666d4064d8d593552bdf13cae934d05c0baba20dd588b43d16f2998c39a5595ed73cb1095
-
SSDEEP
1536:SMNjBC5Q/vmwBghw9EQlUZtyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP06:SMhyyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3168 msedge.exe 3168 msedge.exe 1924 msedge.exe 1924 msedge.exe 3132 msedge.exe 3132 msedge.exe 3132 msedge.exe 3132 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1924 msedge.exe 1924 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe 1924 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1924 wrote to memory of 556 1924 msedge.exe 84 PID 1924 wrote to memory of 556 1924 msedge.exe 84 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 400 1924 msedge.exe 85 PID 1924 wrote to memory of 3168 1924 msedge.exe 86 PID 1924 wrote to memory of 3168 1924 msedge.exe 86 PID 1924 wrote to memory of 2020 1924 msedge.exe 87 PID 1924 wrote to memory of 2020 1924 msedge.exe 87 PID 1924 wrote to memory of 2020 1924 msedge.exe 87 PID 1924 wrote to memory of 2020 1924 msedge.exe 87 PID 1924 wrote to memory of 2020 1924 msedge.exe 87 PID 1924 wrote to memory of 2020 1924 msedge.exe 87 PID 1924 wrote to memory of 2020 1924 msedge.exe 87 PID 1924 wrote to memory of 2020 1924 msedge.exe 87 PID 1924 wrote to memory of 2020 1924 msedge.exe 87 PID 1924 wrote to memory of 2020 1924 msedge.exe 87 PID 1924 wrote to memory of 2020 1924 msedge.exe 87 PID 1924 wrote to memory of 2020 1924 msedge.exe 87 PID 1924 wrote to memory of 2020 1924 msedge.exe 87 PID 1924 wrote to memory of 2020 1924 msedge.exe 87 PID 1924 wrote to memory of 2020 1924 msedge.exe 87 PID 1924 wrote to memory of 2020 1924 msedge.exe 87 PID 1924 wrote to memory of 2020 1924 msedge.exe 87 PID 1924 wrote to memory of 2020 1924 msedge.exe 87 PID 1924 wrote to memory of 2020 1924 msedge.exe 87 PID 1924 wrote to memory of 2020 1924 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\45e098c608220e5dffd13d0c5c2a3fb4_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeca3f46f8,0x7ffeca3f4708,0x7ffeca3f47182⤵PID:556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,11384128666872319988,17766930698293888284,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:22⤵PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,11384128666872319988,17766930698293888284,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,11384128666872319988,17766930698293888284,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:82⤵PID:2020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11384128666872319988,17766930698293888284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:1264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11384128666872319988,17766930698293888284,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:12⤵PID:2240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,11384128666872319988,17766930698293888284,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4768 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3132
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1048
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD585ba073d7015b6ce7da19235a275f6da
SHA1a23c8c2125e45a0788bac14423ae1f3eab92cf00
SHA2565ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617
SHA512eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3
-
Filesize
152B
MD57de1bbdc1f9cf1a58ae1de4951ce8cb9
SHA1010da169e15457c25bd80ef02d76a940c1210301
SHA2566e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e
SHA512e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c
-
Filesize
6KB
MD5f67e3c8e8cec4113030749d9c219c5f4
SHA123c043e964db536c99d27a9dbc4a47f60fb17985
SHA256ef0ad7c5ff37a636cee11be46535b33cb2e4a22829da587fc62c9fdd7d123d85
SHA512d80377ef91688c3048a7f3e6aeb168fc1dfd95cf893e7071ae8cafd7b40298bdfeb8ed4b34e342eedb744a8752ab980dc41df7d1defbe98f5dab5b4a120d1df5
-
Filesize
6KB
MD515a1c1c868d47b88c6196dd2c4127247
SHA1fa34815d7982be11940f71400d61cde041abab72
SHA256a759e01b209f8af60dc3c77d1787f62f8a3d686386bd635b19646913e56e378e
SHA5121c213f70b59bbce74800fbca030a570748a4a6e58c70699ce843dd12c7b3cbc8076f57e4b38306798ed82f9b1b75223f3db22ccaabf443751c728fe46e7639ac
-
Filesize
10KB
MD55b08444b5559432e8c3dc3f4780dc1f5
SHA1b40b1009df288d313bcc7cb9c2c21a829c7fe7ee
SHA2564927c3545ed210e23fd5915c4b6c5259f867359be32e93b9c89caab95cddfb28
SHA5121699448ab95320be6ec3953e96c5e18e9a34d8f7948388c2463268f0466081dfe923de48a7abaedf573105fd220532a2919297a395cc69a93361ea62cdde0de5