Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-12-2024 20:56
Static task
static1
Behavioral task
behavioral1
Sample
e83e34b204e77abc4d113c5fc64c63fb_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e83e34b204e77abc4d113c5fc64c63fb_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
e83e34b204e77abc4d113c5fc64c63fb_JaffaCakes118.html
-
Size
158KB
-
MD5
e83e34b204e77abc4d113c5fc64c63fb
-
SHA1
3b08b44d3e46894f09abaca32cabb096d962bf91
-
SHA256
8449880c56f8edb1b1e56f6a027390c08d50652b3bafe21f6790ae9a69da4a06
-
SHA512
34d68be02f9755d6cac359684bcf631d02c8849518c2304d8bdd4dc634e6920a074e5f56ef9f45c726a5ce8fb29df52b39e6e292687a24e7fe3bafaaee5019ad
-
SSDEEP
1536:iERT550LwRlOB0TxyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3om:i2G5uxyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2584 msedge.exe 2584 msedge.exe 4864 msedge.exe 4864 msedge.exe 4012 msedge.exe 4012 msedge.exe 4012 msedge.exe 4012 msedge.exe 4204 identity_helper.exe 4204 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe 4864 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4864 wrote to memory of 3724 4864 msedge.exe 85 PID 4864 wrote to memory of 3724 4864 msedge.exe 85 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 4408 4864 msedge.exe 86 PID 4864 wrote to memory of 2584 4864 msedge.exe 87 PID 4864 wrote to memory of 2584 4864 msedge.exe 87 PID 4864 wrote to memory of 2592 4864 msedge.exe 88 PID 4864 wrote to memory of 2592 4864 msedge.exe 88 PID 4864 wrote to memory of 2592 4864 msedge.exe 88 PID 4864 wrote to memory of 2592 4864 msedge.exe 88 PID 4864 wrote to memory of 2592 4864 msedge.exe 88 PID 4864 wrote to memory of 2592 4864 msedge.exe 88 PID 4864 wrote to memory of 2592 4864 msedge.exe 88 PID 4864 wrote to memory of 2592 4864 msedge.exe 88 PID 4864 wrote to memory of 2592 4864 msedge.exe 88 PID 4864 wrote to memory of 2592 4864 msedge.exe 88 PID 4864 wrote to memory of 2592 4864 msedge.exe 88 PID 4864 wrote to memory of 2592 4864 msedge.exe 88 PID 4864 wrote to memory of 2592 4864 msedge.exe 88 PID 4864 wrote to memory of 2592 4864 msedge.exe 88 PID 4864 wrote to memory of 2592 4864 msedge.exe 88 PID 4864 wrote to memory of 2592 4864 msedge.exe 88 PID 4864 wrote to memory of 2592 4864 msedge.exe 88 PID 4864 wrote to memory of 2592 4864 msedge.exe 88 PID 4864 wrote to memory of 2592 4864 msedge.exe 88 PID 4864 wrote to memory of 2592 4864 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\e83e34b204e77abc4d113c5fc64c63fb_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9b5c46f8,0x7ffa9b5c4708,0x7ffa9b5c47182⤵PID:3724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,5741186921173172004,13587756776968943643,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:4408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,5741186921173172004,13587756776968943643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,5741186921173172004,13587756776968943643,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:82⤵PID:2592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5741186921173172004,13587756776968943643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:3172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5741186921173172004,13587756776968943643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:1948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,5741186921173172004,13587756776968943643,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5008 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,5741186921173172004,13587756776968943643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:82⤵PID:3688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,5741186921173172004,13587756776968943643,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5741186921173172004,13587756776968943643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:12⤵PID:2420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5741186921173172004,13587756776968943643,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:12⤵PID:4092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5741186921173172004,13587756776968943643,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:12⤵PID:4588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5741186921173172004,13587756776968943643,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:12⤵PID:4772
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2936
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1460
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58749e21d9d0a17dac32d5aa2027f7a75
SHA1a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA256915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
SHA512c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
-
Filesize
152B
MD534d2c4f40f47672ecdf6f66fea242f4a
SHA14bcad62542aeb44cae38a907d8b5a8604115ada2
SHA256b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
SHA51250fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\47a7cc2c-7bf3-4efb-9d58-7bb8dfcaa776.tmp
Filesize6KB
MD5fedf7d85e252243375e9a6b5ab91e210
SHA1118bf0f159648d9eb4095e975b45c1d4714f682a
SHA256b8f85a6bb8b4d7ae055079ba4708285379a99d6a3f409ac48d6dd2881c27555d
SHA5129c54aec22aaad0b9f2ff9bda433b0e4261e9c8a3f171be8119143fa594fbe479a1add5aa2bd3448b45c2f266a3294e5d280d77060a72f7077b84c318b46171bd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\68788053-839b-4346-9975-b5515581bd59.tmp
Filesize5KB
MD52a157706053d21a322796f05d710dc6c
SHA13208c6b6692744325951532de1bcc789afb1c91a
SHA256d6781dd58bb85b94396be4e88a2b490f611fb654c6bf6cf8f931f5360b597f5f
SHA5126a3291eeda1eeda5e7fe41c8a4ba5b9542959eee89b9c9cdb2180f483071d047e553c40e515ac5d6ceaa6c825953fd4f44038d3b9ad629d03de61d2c9e3b7086
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5c2ef9d35e0db17f89238eb07a9763cbc
SHA154095dff99d917246b2dadc11988cd827d7f1658
SHA2566aaccfdf0c6b291fb159040f6d3362bfb7b4a0e5b73de8a0069045e57e50b56c
SHA5122396a53a178e45fb8ba909aaa473b9a1ec5d2f56de3c5658733be4a53648b653e70441bff62019b98a9fc1b8aba287abb3dbba0093e6e0d1c48b426de437e83e