Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/10/2024, 16:25
Static task
static1
Behavioral task
behavioral1
Sample
7a6a8a850f4c67ac66ce0bfeb75e92f5_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7a6a8a850f4c67ac66ce0bfeb75e92f5_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
7a6a8a850f4c67ac66ce0bfeb75e92f5_JaffaCakes118.html
-
Size
117KB
-
MD5
7a6a8a850f4c67ac66ce0bfeb75e92f5
-
SHA1
7906e9440c75cb561da30f36cbc8150ba2e67171
-
SHA256
d866dc5d25f36c54ced2d2dc1b36e9f44eb6fd86de9fc5f3f53c2eb2aa3f2073
-
SHA512
49697ea663d75e3a1f2fbd3b28c843365d9f942736a474c72ed9997dddeaf01b6de1bbe7e62833c1c44460f6ea3436f2c25257d853455d2262c92a5528b05b8f
-
SSDEEP
1536:SgHyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsn:SgHyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1788 msedge.exe 1788 msedge.exe 2452 msedge.exe 2452 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe 1772 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe 2452 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2452 wrote to memory of 3720 2452 msedge.exe 86 PID 2452 wrote to memory of 3720 2452 msedge.exe 86 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 3076 2452 msedge.exe 87 PID 2452 wrote to memory of 1788 2452 msedge.exe 88 PID 2452 wrote to memory of 1788 2452 msedge.exe 88 PID 2452 wrote to memory of 4700 2452 msedge.exe 89 PID 2452 wrote to memory of 4700 2452 msedge.exe 89 PID 2452 wrote to memory of 4700 2452 msedge.exe 89 PID 2452 wrote to memory of 4700 2452 msedge.exe 89 PID 2452 wrote to memory of 4700 2452 msedge.exe 89 PID 2452 wrote to memory of 4700 2452 msedge.exe 89 PID 2452 wrote to memory of 4700 2452 msedge.exe 89 PID 2452 wrote to memory of 4700 2452 msedge.exe 89 PID 2452 wrote to memory of 4700 2452 msedge.exe 89 PID 2452 wrote to memory of 4700 2452 msedge.exe 89 PID 2452 wrote to memory of 4700 2452 msedge.exe 89 PID 2452 wrote to memory of 4700 2452 msedge.exe 89 PID 2452 wrote to memory of 4700 2452 msedge.exe 89 PID 2452 wrote to memory of 4700 2452 msedge.exe 89 PID 2452 wrote to memory of 4700 2452 msedge.exe 89 PID 2452 wrote to memory of 4700 2452 msedge.exe 89 PID 2452 wrote to memory of 4700 2452 msedge.exe 89 PID 2452 wrote to memory of 4700 2452 msedge.exe 89 PID 2452 wrote to memory of 4700 2452 msedge.exe 89 PID 2452 wrote to memory of 4700 2452 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\7a6a8a850f4c67ac66ce0bfeb75e92f5_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf3dc46f8,0x7ffaf3dc4708,0x7ffaf3dc47182⤵PID:3720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,5966063999813952560,14485300015622273760,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:22⤵PID:3076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,5966063999813952560,14485300015622273760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,5966063999813952560,14485300015622273760,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2484 /prefetch:82⤵PID:4700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5966063999813952560,14485300015622273760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:1616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5966063999813952560,14485300015622273760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:3088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,5966063999813952560,14485300015622273760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:82⤵PID:4692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,5966063999813952560,14485300015622273760,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 /prefetch:82⤵PID:3928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5966063999813952560,14485300015622273760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:12⤵PID:4316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5966063999813952560,14485300015622273760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:12⤵PID:4332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5966063999813952560,14485300015622273760,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:12⤵PID:464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,5966063999813952560,14485300015622273760,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:12⤵PID:3776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,5966063999813952560,14485300015622273760,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5284 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1772
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1972
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD599afa4934d1e3c56bbce114b356e8a99
SHA13f0e7a1a28d9d9c06b6663df5d83a65c84d52581
SHA25608e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8
SHA51276686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da
-
Filesize
152B
MD5443a627d539ca4eab732bad0cbe7332b
SHA186b18b906a1acd2a22f4b2c78ac3564c394a9569
SHA2561e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9
SHA512923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d
-
Filesize
5KB
MD5e30f044a777e9aa6a09b92cc872dc0b1
SHA1321f220455f9dcba97ccf5a10f395590c7cc389e
SHA25671e5af1d6cb92500d264b0dce32c046c7f03bbe39801414726fe8f0b4929566e
SHA512859b059d99be3c8cb3c3a6d2dd377caa1ade23a7bffe9021e96c3fe7493f3f3cce5dde2e6603e4ce3c7c990cfe1da20c95eeb5193a9a9e7edaf4c00de25f109b
-
Filesize
6KB
MD59c45f703e73eec45518460521b7419fd
SHA10a4000ecf0937d9bc015f80e6f1a71f62c9ba00e
SHA256edcdde42caa7b3cedbcad30ba86a1fa17d58bee5b702a8f2ccbdb184b4c82606
SHA512c5cb3385a4d06342fcd2bec2d20d55d1f1ea7d9d283ca1da7884d7216a4de08443be4ae51f7a3aa99ec5504c33a8d6af0392ff84745de522c13991386fe82519
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD531bf06fe5aa810770892e46a39761a17
SHA101f2d722bc52f9673913fe62e654040cb3e6b658
SHA256d5a6770e27bb38a837070f89ba6e946e304e2a9e4ae903376e142b2c55f76b2c
SHA512fde29a6bcba3bd7df55616116dd6752e3061da80c5bd9b0c8640191752a32d087e7eb0051a2f8a8d258e4c9c83a29ea35daefbf109114e1fe137d3480b123618