Analysis
-
max time kernel
139s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/10/2024, 15:48
Static task
static1
Behavioral task
behavioral1
Sample
7a4d3165a759fe6e938ec9e84b4bd662_JaffaCakes118.html
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
7a4d3165a759fe6e938ec9e84b4bd662_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
7a4d3165a759fe6e938ec9e84b4bd662_JaffaCakes118.html
-
Size
157KB
-
MD5
7a4d3165a759fe6e938ec9e84b4bd662
-
SHA1
dc7f73650b0d1870f8a59e084a61d382b1a045c7
-
SHA256
befd7d92423a5d783ab274a68fc39b7e64e8a108f6b199186d86bbe268c959a5
-
SHA512
3559f9f63999a875308db78687a90c753fe78eed6576c911e8145cfc5ca00cca96502fcdc0edfb35360859b7e2ce73fb1f87d286a8288df47d6af099150f5de3
-
SSDEEP
1536:iCRTkhY1F/+MYcU5mHyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXAZ:iQPPHyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4268 msedge.exe 4268 msedge.exe 4672 msedge.exe 4672 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 1052 msedge.exe 2600 identity_helper.exe 2600 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe 4672 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4672 wrote to memory of 4412 4672 msedge.exe 84 PID 4672 wrote to memory of 4412 4672 msedge.exe 84 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 1624 4672 msedge.exe 85 PID 4672 wrote to memory of 4268 4672 msedge.exe 86 PID 4672 wrote to memory of 4268 4672 msedge.exe 86 PID 4672 wrote to memory of 2592 4672 msedge.exe 87 PID 4672 wrote to memory of 2592 4672 msedge.exe 87 PID 4672 wrote to memory of 2592 4672 msedge.exe 87 PID 4672 wrote to memory of 2592 4672 msedge.exe 87 PID 4672 wrote to memory of 2592 4672 msedge.exe 87 PID 4672 wrote to memory of 2592 4672 msedge.exe 87 PID 4672 wrote to memory of 2592 4672 msedge.exe 87 PID 4672 wrote to memory of 2592 4672 msedge.exe 87 PID 4672 wrote to memory of 2592 4672 msedge.exe 87 PID 4672 wrote to memory of 2592 4672 msedge.exe 87 PID 4672 wrote to memory of 2592 4672 msedge.exe 87 PID 4672 wrote to memory of 2592 4672 msedge.exe 87 PID 4672 wrote to memory of 2592 4672 msedge.exe 87 PID 4672 wrote to memory of 2592 4672 msedge.exe 87 PID 4672 wrote to memory of 2592 4672 msedge.exe 87 PID 4672 wrote to memory of 2592 4672 msedge.exe 87 PID 4672 wrote to memory of 2592 4672 msedge.exe 87 PID 4672 wrote to memory of 2592 4672 msedge.exe 87 PID 4672 wrote to memory of 2592 4672 msedge.exe 87 PID 4672 wrote to memory of 2592 4672 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\7a4d3165a759fe6e938ec9e84b4bd662_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa6dfa46f8,0x7ffa6dfa4708,0x7ffa6dfa47182⤵PID:4412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1585495729906536206,16410046484226575842,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:22⤵PID:1624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,1585495729906536206,16410046484226575842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,1585495729906536206,16410046484226575842,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:82⤵PID:2592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1585495729906536206,16410046484226575842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:1380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1585495729906536206,16410046484226575842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:2660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1585495729906536206,16410046484226575842,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4028 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1585495729906536206,16410046484226575842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:82⤵PID:1028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1585495729906536206,16410046484226575842,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1585495729906536206,16410046484226575842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:12⤵PID:5108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1585495729906536206,16410046484226575842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:12⤵PID:860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1585495729906536206,16410046484226575842,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:12⤵PID:1664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1585495729906536206,16410046484226575842,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:12⤵PID:408
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2956
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3168
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5b8880802fc2bb880a7a869faa01315b0
SHA151d1a3fa2c272f094515675d82150bfce08ee8d3
SHA256467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812
SHA512e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2
-
Filesize
152B
MD5ba6ef346187b40694d493da98d5da979
SHA1643c15bec043f8673943885199bb06cd1652ee37
SHA256d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73
SHA5122e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c
-
Filesize
5KB
MD56581bb601c74de581fa59cc11fd69aa5
SHA10ea93b248997a7f0ef73968d72e71f6d4927e550
SHA256ee277850c77e10efad64e9785a2fb103d841afd0abca5a3a024fa48599023554
SHA512fff234586b9e80d2105a641f5749204484edfaf543279321695605226698d48a32231ea27a48611900da3b5af277fd354417bffdd7868bd7783fd236083018ce
-
Filesize
6KB
MD5d2122d0f4391b10db3b0a7c727b9c3ee
SHA192b2bd0ca1cfd5ba2ef503b2056b269f970973ef
SHA256452d4781c6005431a65c22902336de87227bef067f50798f4f7ad6e633b11642
SHA512b8e7d06ca2fcdcc5b77b02e4e7281daf30616d60a98ebcd382910f0244ea5b9a1f32be6b34568844aa7627bfd46a2b2979205d5f038de09a3bcf2b6734ea0e8e
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
10KB
MD5322c9991949698a36f4291fbdc346778
SHA1f14073bcdfe03ff45edbeb13328200f0790e3606
SHA256eaae07d0d0ba70cb0ff30cc1b0d30cfeaa12a3695200c8f9c0ea8c1fc5a6a146
SHA512664947932df87b3dcf8396bf66fd93827c11fd7adc56656b8de1f715a4e3283ea3c1676e5329d40faeae0611115aa7fa73b9c498653360a82329cf7880d5e3d2