Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/10/2024, 20:27
Static task
static1
Behavioral task
behavioral1
Sample
7ab7d9822231769a383d90c8be8bbe7e_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7ab7d9822231769a383d90c8be8bbe7e_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
7ab7d9822231769a383d90c8be8bbe7e_JaffaCakes118.html
-
Size
157KB
-
MD5
7ab7d9822231769a383d90c8be8bbe7e
-
SHA1
c2fac917d4bd374271a0eab7c1a95d9aac0186f2
-
SHA256
803503882366242f5376857be75680cfacb28a5090a677a701d08301e9f4c9d3
-
SHA512
9e815fd9af1d679714fe45c62a6409dabb9b8d092bc8b7db51def4599520b509fc4d2e7b078fce5d1dd4e163f01ab52d1fc872a7e7ee4dec74fdde38aba0f64f
-
SSDEEP
1536:iG5ZRTUgW+q0ADt9JM8VryLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09wd:iUKXryfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 4968 msedge.exe 4968 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 4364 msedge.exe 4364 msedge.exe 4364 msedge.exe 4364 msedge.exe 4020 identity_helper.exe 4020 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe 1520 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1520 wrote to memory of 3944 1520 msedge.exe 84 PID 1520 wrote to memory of 3944 1520 msedge.exe 84 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 3520 1520 msedge.exe 85 PID 1520 wrote to memory of 4968 1520 msedge.exe 86 PID 1520 wrote to memory of 4968 1520 msedge.exe 86 PID 1520 wrote to memory of 5092 1520 msedge.exe 87 PID 1520 wrote to memory of 5092 1520 msedge.exe 87 PID 1520 wrote to memory of 5092 1520 msedge.exe 87 PID 1520 wrote to memory of 5092 1520 msedge.exe 87 PID 1520 wrote to memory of 5092 1520 msedge.exe 87 PID 1520 wrote to memory of 5092 1520 msedge.exe 87 PID 1520 wrote to memory of 5092 1520 msedge.exe 87 PID 1520 wrote to memory of 5092 1520 msedge.exe 87 PID 1520 wrote to memory of 5092 1520 msedge.exe 87 PID 1520 wrote to memory of 5092 1520 msedge.exe 87 PID 1520 wrote to memory of 5092 1520 msedge.exe 87 PID 1520 wrote to memory of 5092 1520 msedge.exe 87 PID 1520 wrote to memory of 5092 1520 msedge.exe 87 PID 1520 wrote to memory of 5092 1520 msedge.exe 87 PID 1520 wrote to memory of 5092 1520 msedge.exe 87 PID 1520 wrote to memory of 5092 1520 msedge.exe 87 PID 1520 wrote to memory of 5092 1520 msedge.exe 87 PID 1520 wrote to memory of 5092 1520 msedge.exe 87 PID 1520 wrote to memory of 5092 1520 msedge.exe 87 PID 1520 wrote to memory of 5092 1520 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\7ab7d9822231769a383d90c8be8bbe7e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef70146f8,0x7ffef7014708,0x7ffef70147182⤵PID:3944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,419250033403962838,17601097496166653708,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:3520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,419250033403962838,17601097496166653708,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,419250033403962838,17601097496166653708,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:82⤵PID:5092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,419250033403962838,17601097496166653708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:2072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,419250033403962838,17601097496166653708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,419250033403962838,17601097496166653708,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,419250033403962838,17601097496166653708,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:82⤵PID:520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,419250033403962838,17601097496166653708,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,419250033403962838,17601097496166653708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:12⤵PID:4312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,419250033403962838,17601097496166653708,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:12⤵PID:4840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,419250033403962838,17601097496166653708,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:12⤵PID:2992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,419250033403962838,17601097496166653708,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:12⤵PID:4232
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2280
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1732
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5b8880802fc2bb880a7a869faa01315b0
SHA151d1a3fa2c272f094515675d82150bfce08ee8d3
SHA256467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812
SHA512e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2
-
Filesize
152B
MD5ba6ef346187b40694d493da98d5da979
SHA1643c15bec043f8673943885199bb06cd1652ee37
SHA256d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73
SHA5122e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c
-
Filesize
5KB
MD5a083f5569f12488594ec491eb7a909a9
SHA1f009a3aa068dc5425e515947fab599b8fe993975
SHA2567df80921212ffc21c3f0c672e624763f7009c4bcdbc45164466d5434268024e4
SHA512eff4df4e943b282e6668fc788dc31d1755a51c59c7ac618e1692c9e4a3b9f58e4d1f5a17e513bd96678cc7a57b476905be7c07c62f43a416b2feb94d7ec75577
-
Filesize
6KB
MD5b73bd9c873d29413b10ebc1dc7101aa3
SHA1ffc0416e2ed318f794ce33241d18e264958def00
SHA256cee52915508d30dbc313a3f8b65ee52ee9d3ab44325eb23023367430850ab071
SHA5128173313128fad78a6aa00a82c63736c7c29f7c23b2e2007191b22c5594158ca1944a1bb4c19e585f7cef1f20d0f2c72867bad057d8b7bd791f99881dcc635c45
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5abcd76aa28816b349285bce9b32b689a
SHA1a2d070479500848e5d548b91b076a61de6c50a4a
SHA2565c6ea8d0a35d5f1ae72c8170acb08eaf9500b94f68b0f2a1a76c68dc434e7163
SHA512fa2dc6f57057ada9a16ad321f6db4cc9e436cb1839821c5f3b39f4e6024e9697fa2424493a66ed4f008a9b43dbf504ae16750ce84e47e3f226be279eb7d42be5