Analysis
-
max time kernel
139s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 05:46
Static task
static1
Behavioral task
behavioral1
Sample
fa55e7780af385b915d53836c74837a5_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
fa55e7780af385b915d53836c74837a5_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
fa55e7780af385b915d53836c74837a5_JaffaCakes118.html
-
Size
158KB
-
MD5
fa55e7780af385b915d53836c74837a5
-
SHA1
dbae7c8f2783cf800df82e3d9b42980deeb9f594
-
SHA256
eaabdea621c239c5c4909293bf97692dd4aec1334ccde9a6120be11022e2398d
-
SHA512
01d42b8f82ea52103434c03ecf2aa789ab7d70b96faffa30d87072860cce3655798c499a8ed5ed6e3df796590258b775a628e389d9b06ac2353e6b6871ea4b88
-
SSDEEP
3072:im59bMW0pyfkMY+BES09JXAnyrZalI+YQ:ibnMsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3940 msedge.exe 3940 msedge.exe 1544 msedge.exe 1544 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 1676 msedge.exe 832 identity_helper.exe 832 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe 1544 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1544 wrote to memory of 4452 1544 msedge.exe 82 PID 1544 wrote to memory of 4452 1544 msedge.exe 82 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 644 1544 msedge.exe 83 PID 1544 wrote to memory of 3940 1544 msedge.exe 84 PID 1544 wrote to memory of 3940 1544 msedge.exe 84 PID 1544 wrote to memory of 2088 1544 msedge.exe 85 PID 1544 wrote to memory of 2088 1544 msedge.exe 85 PID 1544 wrote to memory of 2088 1544 msedge.exe 85 PID 1544 wrote to memory of 2088 1544 msedge.exe 85 PID 1544 wrote to memory of 2088 1544 msedge.exe 85 PID 1544 wrote to memory of 2088 1544 msedge.exe 85 PID 1544 wrote to memory of 2088 1544 msedge.exe 85 PID 1544 wrote to memory of 2088 1544 msedge.exe 85 PID 1544 wrote to memory of 2088 1544 msedge.exe 85 PID 1544 wrote to memory of 2088 1544 msedge.exe 85 PID 1544 wrote to memory of 2088 1544 msedge.exe 85 PID 1544 wrote to memory of 2088 1544 msedge.exe 85 PID 1544 wrote to memory of 2088 1544 msedge.exe 85 PID 1544 wrote to memory of 2088 1544 msedge.exe 85 PID 1544 wrote to memory of 2088 1544 msedge.exe 85 PID 1544 wrote to memory of 2088 1544 msedge.exe 85 PID 1544 wrote to memory of 2088 1544 msedge.exe 85 PID 1544 wrote to memory of 2088 1544 msedge.exe 85 PID 1544 wrote to memory of 2088 1544 msedge.exe 85 PID 1544 wrote to memory of 2088 1544 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\fa55e7780af385b915d53836c74837a5_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa202f46f8,0x7ffa202f4708,0x7ffa202f47182⤵PID:4452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16128831025919749589,7417251621015951838,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:22⤵PID:644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,16128831025919749589,7417251621015951838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,16128831025919749589,7417251621015951838,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:82⤵PID:2088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16128831025919749589,7417251621015951838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:2124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16128831025919749589,7417251621015951838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:3676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,16128831025919749589,7417251621015951838,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4984 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16128831025919749589,7417251621015951838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 /prefetch:82⤵PID:2036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,16128831025919749589,7417251621015951838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16128831025919749589,7417251621015951838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:12⤵PID:5104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16128831025919749589,7417251621015951838,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:12⤵PID:2216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16128831025919749589,7417251621015951838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:12⤵PID:2584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,16128831025919749589,7417251621015951838,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:12⤵PID:860
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1904
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:852
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556a4f78e21616a6e19da57228569489b
SHA121bfabbfc294d5f2aa1da825c5590d760483bc76
SHA256d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb
SHA512c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b
-
Filesize
152B
MD5e443ee4336fcf13c698b8ab5f3c173d0
SHA19bf70b16f03820cbe3158e1f1396b07b8ac9d75a
SHA25679e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b
SHA512cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd
-
Filesize
5KB
MD50c824e619c138c61a7be64d87764338b
SHA15ca163cbae1f32a77261bc386fd82dfc9dc25a68
SHA256c00230e431816bd50a10f17f826bdfcab128510d72f7cc1a70226e529a5903f7
SHA51247ab634032d267b9ea3e1a05b65e83dfa0a16aafe5aac00067dca31bb9c0422c3459dd3385ed0473ea1533b6425cf80c384db0a3aa9b30e92f85575168a50d2f
-
Filesize
6KB
MD5c9843219530ca7b3bb9ea65e2549f5a3
SHA1083940b93c8e035963fdcf0cebdf76dd805970d1
SHA2561ab2fa61656bea76154164b25e4e580eb02a3c52be3179d32bcf04467eda3ac5
SHA512b0c9f094a461bba0ea0267381fbbfb4c423acb00d21c384af757688a045aa6378dab5987073a5cdc38dbd39aa401abb9aa75b24133c01c06cfbd39688fef5b8f
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5a580925ca47ed918c8ff282995256724
SHA158545baa5acf54cb8b5c94b733689aecaf92e005
SHA25662373893391c7f127ef53cb7bc8ab59fcad11c1694bde51c76abe42f2478d801
SHA5125991880859b70c7e458567240f1ce42a04f4717f0107276652a5fc9c96047f328ed131fa3783c4a9f326819e081c540d60838e78a42d1b1816383cb0dead461b