Analysis
-
max time kernel
145s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-10-2024 17:48
Static task
static1
Behavioral task
behavioral1
Sample
52ed651652f6450375574fde209aaa93_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
52ed651652f6450375574fde209aaa93_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
52ed651652f6450375574fde209aaa93_JaffaCakes118.html
-
Size
10KB
-
MD5
52ed651652f6450375574fde209aaa93
-
SHA1
74d829359a9cee13a61e0fdb8353810a2e73660f
-
SHA256
b09da92aa923955f5d705b7cc34b202adff8669e48227d3d85a921b43588ef98
-
SHA512
0f6c96e19d970c1bca162c8e402034845874760cba640a8b7ed285c293c3b3b7eae294c1750e1868b5629325454f972f90ff1d3af3357a4f81b57109de596223
-
SSDEEP
96:uzVs+ux7Oei0LLY1k9o84d12ef7CSTUjwGT/k5mpxo3aRxsPf7zruGv9f7zSKRvw:csz7Oei0AYS/qgu9wzrFdz9DzlPHb76f
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1420 msedge.exe 1420 msedge.exe 3312 msedge.exe 3312 msedge.exe 3124 identity_helper.exe 3124 identity_helper.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe 4852 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe 3312 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3312 wrote to memory of 2208 3312 msedge.exe 84 PID 3312 wrote to memory of 2208 3312 msedge.exe 84 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 4992 3312 msedge.exe 85 PID 3312 wrote to memory of 1420 3312 msedge.exe 86 PID 3312 wrote to memory of 1420 3312 msedge.exe 86 PID 3312 wrote to memory of 2460 3312 msedge.exe 87 PID 3312 wrote to memory of 2460 3312 msedge.exe 87 PID 3312 wrote to memory of 2460 3312 msedge.exe 87 PID 3312 wrote to memory of 2460 3312 msedge.exe 87 PID 3312 wrote to memory of 2460 3312 msedge.exe 87 PID 3312 wrote to memory of 2460 3312 msedge.exe 87 PID 3312 wrote to memory of 2460 3312 msedge.exe 87 PID 3312 wrote to memory of 2460 3312 msedge.exe 87 PID 3312 wrote to memory of 2460 3312 msedge.exe 87 PID 3312 wrote to memory of 2460 3312 msedge.exe 87 PID 3312 wrote to memory of 2460 3312 msedge.exe 87 PID 3312 wrote to memory of 2460 3312 msedge.exe 87 PID 3312 wrote to memory of 2460 3312 msedge.exe 87 PID 3312 wrote to memory of 2460 3312 msedge.exe 87 PID 3312 wrote to memory of 2460 3312 msedge.exe 87 PID 3312 wrote to memory of 2460 3312 msedge.exe 87 PID 3312 wrote to memory of 2460 3312 msedge.exe 87 PID 3312 wrote to memory of 2460 3312 msedge.exe 87 PID 3312 wrote to memory of 2460 3312 msedge.exe 87 PID 3312 wrote to memory of 2460 3312 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\52ed651652f6450375574fde209aaa93_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff267146f8,0x7fff26714708,0x7fff267147182⤵PID:2208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,16921980751341242800,11231465430648978982,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:22⤵PID:4992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,16921980751341242800,11231465430648978982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,16921980751341242800,11231465430648978982,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:82⤵PID:2460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,16921980751341242800,11231465430648978982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:2652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,16921980751341242800,11231465430648978982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:5096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,16921980751341242800,11231465430648978982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 /prefetch:82⤵PID:3468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,16921980751341242800,11231465430648978982,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,16921980751341242800,11231465430648978982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:12⤵PID:4724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,16921980751341242800,11231465430648978982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:12⤵PID:2708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,16921980751341242800,11231465430648978982,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:12⤵PID:324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,16921980751341242800,11231465430648978982,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:12⤵PID:5016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,16921980751341242800,11231465430648978982,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2980 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4852
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1644
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1812
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58749e21d9d0a17dac32d5aa2027f7a75
SHA1a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA256915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
SHA512c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
-
Filesize
152B
MD534d2c4f40f47672ecdf6f66fea242f4a
SHA14bcad62542aeb44cae38a907d8b5a8604115ada2
SHA256b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
SHA51250fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
-
Filesize
5KB
MD5fd27366ca4b04a8f0269409430810b0a
SHA1b976aceb0af4242579603deac43b8f7fa35720e0
SHA256a1729a14064ede093ddae97de469612f7fb6262e45547bbfa15402ad8200ce85
SHA51223687878f5644cb9229b35592606fba590000575a85beaa1e0eb3e2f1174312d7dd5c1af9a3a2c97be29a335e76f554279d0d4c99118291a0f7aef0090cd2fa2
-
Filesize
6KB
MD5d4e49d73ef3b61ee5f4e259285ab2b96
SHA17e4aaabfd3db85a856504b320b2cca78abd697cb
SHA2560c769a1aa061f97b4b25914f6b58052e1c29b4794dc697f8437a3a23623a0362
SHA512cafe624712d88fe456a702fdbbde2689490ab6578e58a19111d08f9da60194709ac6cf234738f280c81e636899935d1ad2d9cb2871cdcb440e0019875d86d74b
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5cd5fee3370d04c11dc3e30ced0ccdbf7
SHA10520715925d2c4f364aae0052e1449f249b139d5
SHA256765705b50838711b71a1e2388409a60381b50702738070290cde3ef023316777
SHA5121fdc9efee4a1e00459148b5bbc4f67d4027ffcf839ee8a374e44bc82b4b0238c4791c25a44ec03a3307d0c852d476f3a65f697e1e52582139683113fb05bf571