Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15-12-2024 05:08
Static task
static1
Behavioral task
behavioral1
Sample
f26f3e79e601b48d784b365d1babbc60_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f26f3e79e601b48d784b365d1babbc60_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
f26f3e79e601b48d784b365d1babbc60_JaffaCakes118.html
-
Size
155KB
-
MD5
f26f3e79e601b48d784b365d1babbc60
-
SHA1
6d6b0689f9fa512e2aa864d7314f41e33b870549
-
SHA256
c4c04494eaf3496a747c0198ba84aa73e5507912bfbd2221dace5312e0f288ea
-
SHA512
4c4d900107f18344b3d5791daf12c20b6a019eac5bda340b9eb0c3d001e43dfc29313d95a36257bc536cb4edb5c37fb788b09d8d9457bec17c431e894f083793
-
SSDEEP
1536:iURTslKLU18+jSL4p+yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXAZ:iGe3+Y+yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3880 msedge.exe 3880 msedge.exe 4412 msedge.exe 4412 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 3000 msedge.exe 1456 identity_helper.exe 1456 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe 4412 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4412 wrote to memory of 4708 4412 msedge.exe 83 PID 4412 wrote to memory of 4708 4412 msedge.exe 83 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 1732 4412 msedge.exe 84 PID 4412 wrote to memory of 3880 4412 msedge.exe 85 PID 4412 wrote to memory of 3880 4412 msedge.exe 85 PID 4412 wrote to memory of 1484 4412 msedge.exe 86 PID 4412 wrote to memory of 1484 4412 msedge.exe 86 PID 4412 wrote to memory of 1484 4412 msedge.exe 86 PID 4412 wrote to memory of 1484 4412 msedge.exe 86 PID 4412 wrote to memory of 1484 4412 msedge.exe 86 PID 4412 wrote to memory of 1484 4412 msedge.exe 86 PID 4412 wrote to memory of 1484 4412 msedge.exe 86 PID 4412 wrote to memory of 1484 4412 msedge.exe 86 PID 4412 wrote to memory of 1484 4412 msedge.exe 86 PID 4412 wrote to memory of 1484 4412 msedge.exe 86 PID 4412 wrote to memory of 1484 4412 msedge.exe 86 PID 4412 wrote to memory of 1484 4412 msedge.exe 86 PID 4412 wrote to memory of 1484 4412 msedge.exe 86 PID 4412 wrote to memory of 1484 4412 msedge.exe 86 PID 4412 wrote to memory of 1484 4412 msedge.exe 86 PID 4412 wrote to memory of 1484 4412 msedge.exe 86 PID 4412 wrote to memory of 1484 4412 msedge.exe 86 PID 4412 wrote to memory of 1484 4412 msedge.exe 86 PID 4412 wrote to memory of 1484 4412 msedge.exe 86 PID 4412 wrote to memory of 1484 4412 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\f26f3e79e601b48d784b365d1babbc60_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdac5c46f8,0x7ffdac5c4708,0x7ffdac5c47182⤵PID:4708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13487203750286771317,2022198209363953435,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:22⤵PID:1732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,13487203750286771317,2022198209363953435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,13487203750286771317,2022198209363953435,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:82⤵PID:1484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13487203750286771317,2022198209363953435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:3028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13487203750286771317,2022198209363953435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:12⤵PID:3424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,13487203750286771317,2022198209363953435,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13487203750286771317,2022198209363953435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 /prefetch:82⤵PID:4056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,13487203750286771317,2022198209363953435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13487203750286771317,2022198209363953435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:12⤵PID:1108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13487203750286771317,2022198209363953435,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:12⤵PID:1600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13487203750286771317,2022198209363953435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:12⤵PID:4028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,13487203750286771317,2022198209363953435,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:12⤵PID:2504
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2308
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e55832d7cd7e868a2c087c4c73678018
SHA1ed7a2f6d6437e907218ffba9128802eaf414a0eb
SHA256a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574
SHA512897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f
-
Filesize
152B
MD5c2d9eeb3fdd75834f0ac3f9767de8d6f
SHA14d16a7e82190f8490a00008bd53d85fb92e379b0
SHA2561e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66
SHA512d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd
-
Filesize
5KB
MD516b3c1ba994aac5d339c303a948ca161
SHA1c5cb901639032fdc07ed41f2b819c34350349abf
SHA2566182b84400a3021e567ffdbc3beb6a332f1e5a17b102bb646b417e816b4801fc
SHA5123178b07bf9e0b6c9e4f4bdbca815416b17f0b6acd9b4f6793f0272c85c4f7cbd7696dca8a5cf6676b8412e54f9f0ce4295bb88eebef4631ca99e6f3e9654df27
-
Filesize
6KB
MD51b101e9b2d8803b983381a468bf4fc9d
SHA10b88a591d1d61c188a1b880281305975c47f7e1c
SHA256244734605945d3f66ab20e52bfdd54b17013ebeced5786b608f36aadd6752c2a
SHA51284de3f8d17efb921637160a44f6885b6b212a9308fd3a3d200698fe98e9e46f3eaf7549fd706d6b444b42a26b606ea280708004578d74f7bacf748aac0388d2d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5d9f079ae7a46239883f3df840e600273
SHA1ed048469510cfba2e599bf1804f2ff2d0e0c1638
SHA25653f912bee2156f213d1dc331b985bf0ce726c76ec540cb391b99bfb434c42870
SHA512718bab840cdf36b9dfc730410c7def8de481bea07c019ec1b164e7d71b518d38807ffdbf07fc4249287e9be69de890ab2905a760bd9e62e65c5da117f0ff3b10