Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/10/2024, 23:14
Static task
static1
Behavioral task
behavioral1
Sample
542e1b5063d1ee19376ff66a8adf2096_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
542e1b5063d1ee19376ff66a8adf2096_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
542e1b5063d1ee19376ff66a8adf2096_JaffaCakes118.html
-
Size
10KB
-
MD5
542e1b5063d1ee19376ff66a8adf2096
-
SHA1
9ccd657d483fe909208569f446ff68a8bd9e64c4
-
SHA256
76d1809a2c30fc033efd943a926bdc9da177d4a85ec6898a4c7937c5b0423289
-
SHA512
7694e8fddb694510d7d387f5b86c8f3d16700fedfa75e810ecb376b01737169ba9f0890a502c8971e61f5b3bc8e78c70df01d062382ef06bcc1b2acc81651588
-
SSDEEP
192:2VElIsr03p68k/w1wvqLkZmB+FnMvmM/Y01z6uBuLbdU8d:sElIcupi/gumB+FnMvmM/Y0z6guLZ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1672 msedge.exe 1672 msedge.exe 4032 msedge.exe 4032 msedge.exe 4352 identity_helper.exe 4352 identity_helper.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe 4032 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4032 wrote to memory of 3032 4032 msedge.exe 84 PID 4032 wrote to memory of 3032 4032 msedge.exe 84 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1444 4032 msedge.exe 85 PID 4032 wrote to memory of 1672 4032 msedge.exe 86 PID 4032 wrote to memory of 1672 4032 msedge.exe 86 PID 4032 wrote to memory of 4288 4032 msedge.exe 87 PID 4032 wrote to memory of 4288 4032 msedge.exe 87 PID 4032 wrote to memory of 4288 4032 msedge.exe 87 PID 4032 wrote to memory of 4288 4032 msedge.exe 87 PID 4032 wrote to memory of 4288 4032 msedge.exe 87 PID 4032 wrote to memory of 4288 4032 msedge.exe 87 PID 4032 wrote to memory of 4288 4032 msedge.exe 87 PID 4032 wrote to memory of 4288 4032 msedge.exe 87 PID 4032 wrote to memory of 4288 4032 msedge.exe 87 PID 4032 wrote to memory of 4288 4032 msedge.exe 87 PID 4032 wrote to memory of 4288 4032 msedge.exe 87 PID 4032 wrote to memory of 4288 4032 msedge.exe 87 PID 4032 wrote to memory of 4288 4032 msedge.exe 87 PID 4032 wrote to memory of 4288 4032 msedge.exe 87 PID 4032 wrote to memory of 4288 4032 msedge.exe 87 PID 4032 wrote to memory of 4288 4032 msedge.exe 87 PID 4032 wrote to memory of 4288 4032 msedge.exe 87 PID 4032 wrote to memory of 4288 4032 msedge.exe 87 PID 4032 wrote to memory of 4288 4032 msedge.exe 87 PID 4032 wrote to memory of 4288 4032 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\542e1b5063d1ee19376ff66a8adf2096_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcccc46f8,0x7ffdcccc4708,0x7ffdcccc47182⤵PID:3032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,12274257908567585559,12255925690695162406,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:22⤵PID:1444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,12274257908567585559,12255925690695162406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2472 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,12274257908567585559,12255925690695162406,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:82⤵PID:4288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12274257908567585559,12255925690695162406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12274257908567585559,12255925690695162406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12274257908567585559,12255925690695162406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:12⤵PID:4432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,12274257908567585559,12255925690695162406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:82⤵PID:2920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,12274257908567585559,12255925690695162406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12274257908567585559,12255925690695162406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:12⤵PID:5112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12274257908567585559,12255925690695162406,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:12⤵PID:3240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12274257908567585559,12255925690695162406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:12⤵PID:1644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,12274257908567585559,12255925690695162406,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:12⤵PID:4484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,12274257908567585559,12255925690695162406,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5152 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4212
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4752
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4040
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dc058ebc0f8181946a312f0be99ed79c
SHA10c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA256378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
SHA51236e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
-
Filesize
152B
MD5a0486d6f8406d852dd805b66ff467692
SHA177ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA256c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
SHA512065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize168B
MD565c9d2a648dea9a079fcecbe46f8bd15
SHA1a5fdc3afec9c4184fade5ce6e78cdfbcf89a22f8
SHA256e51701b695d4cb7b71b2583793766724f363b538c9106f0583d34ec0c4f2ea78
SHA5125c9415e067dbc05086475d523be58b70021d362c1802089f5110d8ff4fc1c554bc0fe1e4af0106962c80a523b4f2297d335927af4fab95be9570bfe18bfa35fe
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
5KB
MD5086c146ac5ceb384d86883f61546eee4
SHA1519761e069653b577c66707075882e00d51b65f6
SHA256ae38a63b74e6bc351c16f37aae32067c38078d98d30a627d15f1a58a7adbc1a0
SHA512d90ebddf406d650e488bab95e6f35d50c431849ca2f793b51d123c5e0aa8e68ca794112fd8a84e5c58b84b3724100a1a6d750c16eef49d9862298f1e05e38817
-
Filesize
6KB
MD5e1ba07d676f2526b90e6586b679e97ac
SHA120b15cad917c77c53c3b780895fcc193201c2eb5
SHA25665c7c2986155d7f50e7d60223f9e25f5a91d3c55746f59a4cb3e602880580c96
SHA512fdc887b0ff1c20f97f979b51292182dff937d03957b992f01c76f5fe2e63aaab220c7393417ff16d862f00bde8f58e0252dd7bc9183ddd3fb033f7ad51a2a617
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5860be0dc68c3f6fa32e59dd1c609390d
SHA1feae7e0371d05bb28dad92011d9012b5836be982
SHA256227c55909f7b546fbfbadfdaf67699e91444c3eec481d43bf18a4dd10571d7ca
SHA5126ba7fb0d7523ee50a03831e674283ff27d26bb75c0b953fd25becac1f3e246a487abac15e88c5554eed8f3a96acd4a828bf7557ddd7aa650791bd39f0e11048d