Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 08:40
Static task
static1
Behavioral task
behavioral1
Sample
fad8c93158e87d079b8b69773b26b421_JaffaCakes118.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fad8c93158e87d079b8b69773b26b421_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
fad8c93158e87d079b8b69773b26b421_JaffaCakes118.html
-
Size
122KB
-
MD5
fad8c93158e87d079b8b69773b26b421
-
SHA1
1d894c75ed3a4d8e547ebfcc1cad71c55131f1db
-
SHA256
9b64d4b191f14b5587be95c2129c4f54c4d7b6199dc61de2236fdce406681ad5
-
SHA512
8300139a764ae19e33d98693b40a70a8a4333cf7f6e9496d1ec2619177ce250802b58b9606b97c0cadcfc26db6a34f8dc74d01ad63f614967a675fe940455ba2
-
SSDEEP
1536:3HLuAbyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dK:X3yfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 820 msedge.exe 820 msedge.exe 4380 msedge.exe 4380 msedge.exe 3016 identity_helper.exe 3016 identity_helper.exe 1868 msedge.exe 1868 msedge.exe 1868 msedge.exe 1868 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4380 wrote to memory of 4592 4380 msedge.exe 82 PID 4380 wrote to memory of 4592 4380 msedge.exe 82 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 2004 4380 msedge.exe 83 PID 4380 wrote to memory of 820 4380 msedge.exe 84 PID 4380 wrote to memory of 820 4380 msedge.exe 84 PID 4380 wrote to memory of 3456 4380 msedge.exe 85 PID 4380 wrote to memory of 3456 4380 msedge.exe 85 PID 4380 wrote to memory of 3456 4380 msedge.exe 85 PID 4380 wrote to memory of 3456 4380 msedge.exe 85 PID 4380 wrote to memory of 3456 4380 msedge.exe 85 PID 4380 wrote to memory of 3456 4380 msedge.exe 85 PID 4380 wrote to memory of 3456 4380 msedge.exe 85 PID 4380 wrote to memory of 3456 4380 msedge.exe 85 PID 4380 wrote to memory of 3456 4380 msedge.exe 85 PID 4380 wrote to memory of 3456 4380 msedge.exe 85 PID 4380 wrote to memory of 3456 4380 msedge.exe 85 PID 4380 wrote to memory of 3456 4380 msedge.exe 85 PID 4380 wrote to memory of 3456 4380 msedge.exe 85 PID 4380 wrote to memory of 3456 4380 msedge.exe 85 PID 4380 wrote to memory of 3456 4380 msedge.exe 85 PID 4380 wrote to memory of 3456 4380 msedge.exe 85 PID 4380 wrote to memory of 3456 4380 msedge.exe 85 PID 4380 wrote to memory of 3456 4380 msedge.exe 85 PID 4380 wrote to memory of 3456 4380 msedge.exe 85 PID 4380 wrote to memory of 3456 4380 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\fad8c93158e87d079b8b69773b26b421_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x44,0x48,0x104,0xe0,0x108,0x7ffc3d6846f8,0x7ffc3d684708,0x7ffc3d6847182⤵PID:4592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,17226707433727494064,14694793845654955130,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:22⤵PID:2004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,17226707433727494064,14694793845654955130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,17226707433727494064,14694793845654955130,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵PID:3456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17226707433727494064,14694793845654955130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:3440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17226707433727494064,14694793845654955130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:1196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,17226707433727494064,14694793845654955130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:82⤵PID:2888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,17226707433727494064,14694793845654955130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4968 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17226707433727494064,14694793845654955130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:12⤵PID:4444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17226707433727494064,14694793845654955130,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:12⤵PID:1672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17226707433727494064,14694793845654955130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:12⤵PID:3088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17226707433727494064,14694793845654955130,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:12⤵PID:824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,17226707433727494064,14694793845654955130,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2704 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1868
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3944
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5dc058ebc0f8181946a312f0be99ed79c
SHA10c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA256378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
SHA51236e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
-
Filesize
152B
MD5a0486d6f8406d852dd805b66ff467692
SHA177ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA256c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
SHA512065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
-
Filesize
6KB
MD5e11dc04783dfb30f72737a8ba6057f3f
SHA1d85e6acf4bd4482575b1c27fccacb2aa032c39c7
SHA2562d257a90d1cf4aad46d39729f0364b9a5d638c99c3687a8dd6848ab09eebe080
SHA512b544d093c81004fb03f70fdf099cc86196f088048a00acebfac747c77727efedd38b4f15c30c1aafe3fa2f2ef52b9747618c8936de3da5c6413965a127724e75
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e2a7dcf3-0f60-4c3e-afdb-6d248d675eff.tmp
Filesize5KB
MD5a79e466a3041cdc69a7680f97c461b67
SHA1f9f381d9e7cba4f550bfed82088a1e831b057431
SHA25611bd34439e7cb127014e071cf98b5d4576c586df2939372e4f801bf2787d5e98
SHA512ac16b6f80c1a4b75d81b67408506e8bd5d5ca543efa5a5b4326f7fb883c368524441376ecd1d8bf94bf48a84d52c677a41f3dbafc2b51eb2160fb0623366767c
-
Filesize
10KB
MD58fd2e8c7f6040032618426618b3fa755
SHA1fb0724b119d61009c0b43d4c59e5f02d06327be1
SHA25602594eaa5f86df0bd457386ba22a764169c41baf923beab83becdbbff0e64b2e
SHA5129248bcab2349d0b774c6e4fea2c67b9acff9070c1a3e071bff34a6a34b637dda8eb744fc0f2af1a4c78d8c54fe5944e43918e7af755bee2cf0f86a6464b6ce1c