Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 07:59
Static task
static1
Behavioral task
behavioral1
Sample
ff11c58f4dea68c51e048e9b97b10ac4_JaffaCakes118.html
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
ff11c58f4dea68c51e048e9b97b10ac4_JaffaCakes118.html
Resource
win10v2004-20241007-en
General
-
Target
ff11c58f4dea68c51e048e9b97b10ac4_JaffaCakes118.html
-
Size
343KB
-
MD5
ff11c58f4dea68c51e048e9b97b10ac4
-
SHA1
d43b535ace494bd7cdda99ed424e94bd2da3d3ce
-
SHA256
e8d44032579f968cbed97a3d7371cbc45e6fa9f4e0e8b1f235ac738cb643b6c6
-
SHA512
eb97268897d36539c137eb1cc9479b120534aa73c5b6403175b86e86755e30d62db03a9f148fb77545135a4ec02481885ec0cd7615d2c20107c68b18230cc85b
-
SSDEEP
6144:SDsMYod+X3oI+YasMYod+X3oI+YBsMYod+X3oI+YQ:G5d+X3K5d+X3X5d+X3+
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3760 msedge.exe 3760 msedge.exe 3916 msedge.exe 3916 msedge.exe 3712 identity_helper.exe 3712 identity_helper.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe 4444 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3916 wrote to memory of 4880 3916 msedge.exe 83 PID 3916 wrote to memory of 4880 3916 msedge.exe 83 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 324 3916 msedge.exe 84 PID 3916 wrote to memory of 3760 3916 msedge.exe 85 PID 3916 wrote to memory of 3760 3916 msedge.exe 85 PID 3916 wrote to memory of 4696 3916 msedge.exe 86 PID 3916 wrote to memory of 4696 3916 msedge.exe 86 PID 3916 wrote to memory of 4696 3916 msedge.exe 86 PID 3916 wrote to memory of 4696 3916 msedge.exe 86 PID 3916 wrote to memory of 4696 3916 msedge.exe 86 PID 3916 wrote to memory of 4696 3916 msedge.exe 86 PID 3916 wrote to memory of 4696 3916 msedge.exe 86 PID 3916 wrote to memory of 4696 3916 msedge.exe 86 PID 3916 wrote to memory of 4696 3916 msedge.exe 86 PID 3916 wrote to memory of 4696 3916 msedge.exe 86 PID 3916 wrote to memory of 4696 3916 msedge.exe 86 PID 3916 wrote to memory of 4696 3916 msedge.exe 86 PID 3916 wrote to memory of 4696 3916 msedge.exe 86 PID 3916 wrote to memory of 4696 3916 msedge.exe 86 PID 3916 wrote to memory of 4696 3916 msedge.exe 86 PID 3916 wrote to memory of 4696 3916 msedge.exe 86 PID 3916 wrote to memory of 4696 3916 msedge.exe 86 PID 3916 wrote to memory of 4696 3916 msedge.exe 86 PID 3916 wrote to memory of 4696 3916 msedge.exe 86 PID 3916 wrote to memory of 4696 3916 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\ff11c58f4dea68c51e048e9b97b10ac4_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad82b46f8,0x7ffad82b4708,0x7ffad82b47182⤵PID:4880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,618561583354743823,17226071483303194687,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,618561583354743823,17226071483303194687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,618561583354743823,17226071483303194687,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2596 /prefetch:82⤵PID:4696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,618561583354743823,17226071483303194687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:1604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,618561583354743823,17226071483303194687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,618561583354743823,17226071483303194687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:82⤵PID:3660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,618561583354743823,17226071483303194687,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,618561583354743823,17226071483303194687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:12⤵PID:3508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,618561583354743823,17226071483303194687,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:12⤵PID:452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,618561583354743823,17226071483303194687,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:12⤵PID:2584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,618561583354743823,17226071483303194687,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:12⤵PID:396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,618561583354743823,17226071483303194687,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3916 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4444
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3128
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4520
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58749e21d9d0a17dac32d5aa2027f7a75
SHA1a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA256915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
SHA512c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
-
Filesize
152B
MD534d2c4f40f47672ecdf6f66fea242f4a
SHA14bcad62542aeb44cae38a907d8b5a8604115ada2
SHA256b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
SHA51250fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
-
Filesize
5KB
MD526357e405bd76a22987d67e86974bf5c
SHA1d54c273e3c553400a2ef8e73266c939d21351f9d
SHA2564e42c9e5e7ca4472f68210c50ae401646b1caa6ff23a955eeb9ce80e7d5a7bfe
SHA512088066494580476324370cd43a3661663f267d942d72e3e1e8fd4afda86153f68928022aca9709ba8ae813eb1bb7f8bd295b97353777330ea5f3ea6ec02e3434
-
Filesize
6KB
MD5d5a93ee7ea942877678242fd55868510
SHA1f6de96c16ec382806d721a8d74d36a2c1b210486
SHA256a899eba8e25bd266bd6e5c17b0deb5f4cfc10f2d509c556bfb7ed3247c568062
SHA512f83ee7b512ae951db6398d94bd24fc4206357558583a809c991ab63b385d0596d6df0f70577764ac4da9266c09ad22603c2836384994c7ece1a00756a7565655
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
10KB
MD5aea9a80f98a11af066d1f29ecd700115
SHA1d0f88ee1fa3e58057d6b4eb51cbcbaceb1f60405
SHA256caa62baf36d785e5f02d6534675e5601395caff343bce5498f0ae6a4cecac4f3
SHA5128aaf8971a8a331f32b1673656a36fa105bdbdf5f8275f82a42f07d11b13c072a949602361e32f2826c3dace920c0abf7de3c6521ebbdb13e90f31a090f5f1382