Analysis
-
max time kernel
139s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15-12-2024 23:29
Static task
static1
Behavioral task
behavioral1
Sample
f63a164d28bcdbe6d601548e814d9215_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f63a164d28bcdbe6d601548e814d9215_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
f63a164d28bcdbe6d601548e814d9215_JaffaCakes118.html
-
Size
157KB
-
MD5
f63a164d28bcdbe6d601548e814d9215
-
SHA1
8c96cb5da455ba9a674952ab0a54ab70e4a9316e
-
SHA256
95f0c88c7632b7feb41cd3f64e6345d4c418bee25aff4ead90cdfa2a56fad0da
-
SHA512
5faa623a7bdb112828b0328e663545cee8f7f75a807814bcdbe2e0a3303fb7bcada8b7b16e8bd7010750185f973f00d4e346c4640181bb76bda604e83ba69eeb
-
SSDEEP
1536:iSRTiV/EW+KXdkFyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJA:igYNkFyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3740 msedge.exe 3740 msedge.exe 2100 msedge.exe 2100 msedge.exe 824 msedge.exe 824 msedge.exe 824 msedge.exe 824 msedge.exe 3316 identity_helper.exe 3316 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe 2100 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 4688 2100 msedge.exe 82 PID 2100 wrote to memory of 4688 2100 msedge.exe 82 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3944 2100 msedge.exe 83 PID 2100 wrote to memory of 3740 2100 msedge.exe 84 PID 2100 wrote to memory of 3740 2100 msedge.exe 84 PID 2100 wrote to memory of 1632 2100 msedge.exe 85 PID 2100 wrote to memory of 1632 2100 msedge.exe 85 PID 2100 wrote to memory of 1632 2100 msedge.exe 85 PID 2100 wrote to memory of 1632 2100 msedge.exe 85 PID 2100 wrote to memory of 1632 2100 msedge.exe 85 PID 2100 wrote to memory of 1632 2100 msedge.exe 85 PID 2100 wrote to memory of 1632 2100 msedge.exe 85 PID 2100 wrote to memory of 1632 2100 msedge.exe 85 PID 2100 wrote to memory of 1632 2100 msedge.exe 85 PID 2100 wrote to memory of 1632 2100 msedge.exe 85 PID 2100 wrote to memory of 1632 2100 msedge.exe 85 PID 2100 wrote to memory of 1632 2100 msedge.exe 85 PID 2100 wrote to memory of 1632 2100 msedge.exe 85 PID 2100 wrote to memory of 1632 2100 msedge.exe 85 PID 2100 wrote to memory of 1632 2100 msedge.exe 85 PID 2100 wrote to memory of 1632 2100 msedge.exe 85 PID 2100 wrote to memory of 1632 2100 msedge.exe 85 PID 2100 wrote to memory of 1632 2100 msedge.exe 85 PID 2100 wrote to memory of 1632 2100 msedge.exe 85 PID 2100 wrote to memory of 1632 2100 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\f63a164d28bcdbe6d601548e814d9215_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbbcb46f8,0x7fffbbcb4708,0x7fffbbcb47182⤵PID:4688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16450057172525685355,15338622039376969567,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵PID:3944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,16450057172525685355,15338622039376969567,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,16450057172525685355,15338622039376969567,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:82⤵PID:1632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16450057172525685355,15338622039376969567,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16450057172525685355,15338622039376969567,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:4712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,16450057172525685355,15338622039376969567,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2728 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16450057172525685355,15338622039376969567,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4108 /prefetch:82⤵PID:2928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,16450057172525685355,15338622039376969567,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4108 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16450057172525685355,15338622039376969567,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:12⤵PID:3544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16450057172525685355,15338622039376969567,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:12⤵PID:1124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16450057172525685355,15338622039376969567,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:12⤵PID:1036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,16450057172525685355,15338622039376969567,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:12⤵PID:4276
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2684
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1832
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD56960857d16aadfa79d36df8ebbf0e423
SHA1e1db43bd478274366621a8c6497e270d46c6ed4f
SHA256f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32
SHA5126deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe
-
Filesize
152B
MD5f426165d1e5f7df1b7a3758c306cd4ae
SHA159ef728fbbb5c4197600f61daec48556fec651c1
SHA256b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841
SHA5128d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6
-
Filesize
6KB
MD5977153b94826753c82a8c3205e81489f
SHA196dde4be5f8bec6f03a531b4b7b8a65e9250aacc
SHA2569b310f778807b7d15d9f4f2e173c4776d8366822481862c3fb535486afac41c0
SHA512d22eaa76d8f969dc2e8c8acae52e3e683fbc853218131bf4a9a9f2a2adcae066b7d305e868869d10992d673b652940f24184a225ab767ac1ac020bbefc725b53
-
Filesize
5KB
MD5d3bf1edca16bd514e33ac57dd4152d4a
SHA1c46d2a8891776f836d1d87ed565529233e070e37
SHA2568694b5d582896dde39284e7b46d9d6edce245fd035a3fcdc83e673c4304dc18a
SHA512b82983018e25923f826c62b476bf9806479f8f8128477174524f18e08874774a184673876362e2279cfa30646f32e6f69ebc13387153b2c6c41effda4b3168e2
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
10KB
MD524d8a937caaad12d1d732c6baa29832f
SHA1c4dbf72e41b074a26557a057ae928acee4ffbd8a
SHA256e2c908712ed8945ef6e1ef55aab8ee7e886519fcfc1883d2015520b36dc39959
SHA51233f96c253e84b8cfea31f0186117e9cd35b26dd76de8f4d7cd0e72eaf71e6a8263ece88b714a5b527cbbdd8b960c65d022899a894098c9d1f13b12a47528487e