Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/01/2025, 09:14
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_e2a9315614e8e50127acaf4a254e406d.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_e2a9315614e8e50127acaf4a254e406d.html
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_e2a9315614e8e50127acaf4a254e406d.html
-
Size
112KB
-
MD5
e2a9315614e8e50127acaf4a254e406d
-
SHA1
6bedf2500b90f5d3588c6b6e7371e0a5175c2aec
-
SHA256
a66242655c013342a3cd2b85063ccea413a5e7d5433817f00422245f9e84f0e7
-
SHA512
481a86425fd0de7d21d6961965eda55517c839616dc7b7905f1a46c3cf61582ee2790630c044e0222e43760a504a26d1255b2595a33d4f361dd7770dd9368d29
-
SSDEEP
3072:SoSRQ8tMtIuMfWNQyIMhe5TdGU12fNgYHCnTzR2IigGQH2cF:StQf+TzRnV
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1956 msedge.exe 1956 msedge.exe 1080 msedge.exe 1080 msedge.exe 4672 identity_helper.exe 4672 identity_helper.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe 212 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1080 wrote to memory of 3736 1080 msedge.exe 83 PID 1080 wrote to memory of 3736 1080 msedge.exe 83 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1588 1080 msedge.exe 84 PID 1080 wrote to memory of 1956 1080 msedge.exe 85 PID 1080 wrote to memory of 1956 1080 msedge.exe 85 PID 1080 wrote to memory of 1584 1080 msedge.exe 86 PID 1080 wrote to memory of 1584 1080 msedge.exe 86 PID 1080 wrote to memory of 1584 1080 msedge.exe 86 PID 1080 wrote to memory of 1584 1080 msedge.exe 86 PID 1080 wrote to memory of 1584 1080 msedge.exe 86 PID 1080 wrote to memory of 1584 1080 msedge.exe 86 PID 1080 wrote to memory of 1584 1080 msedge.exe 86 PID 1080 wrote to memory of 1584 1080 msedge.exe 86 PID 1080 wrote to memory of 1584 1080 msedge.exe 86 PID 1080 wrote to memory of 1584 1080 msedge.exe 86 PID 1080 wrote to memory of 1584 1080 msedge.exe 86 PID 1080 wrote to memory of 1584 1080 msedge.exe 86 PID 1080 wrote to memory of 1584 1080 msedge.exe 86 PID 1080 wrote to memory of 1584 1080 msedge.exe 86 PID 1080 wrote to memory of 1584 1080 msedge.exe 86 PID 1080 wrote to memory of 1584 1080 msedge.exe 86 PID 1080 wrote to memory of 1584 1080 msedge.exe 86 PID 1080 wrote to memory of 1584 1080 msedge.exe 86 PID 1080 wrote to memory of 1584 1080 msedge.exe 86 PID 1080 wrote to memory of 1584 1080 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e2a9315614e8e50127acaf4a254e406d.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff998cb46f8,0x7ff998cb4708,0x7ff998cb47182⤵PID:3736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,13008818559932067305,16373635465183484542,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:1588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,13008818559932067305,16373635465183484542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,13008818559932067305,16373635465183484542,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:82⤵PID:1584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13008818559932067305,16373635465183484542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:5052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13008818559932067305,16373635465183484542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:4284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,13008818559932067305,16373635465183484542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:82⤵PID:2412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,13008818559932067305,16373635465183484542,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13008818559932067305,16373635465183484542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:12⤵PID:1460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13008818559932067305,16373635465183484542,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:12⤵PID:1488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13008818559932067305,16373635465183484542,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:12⤵PID:1652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2028,13008818559932067305,16373635465183484542,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:12⤵PID:2848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,13008818559932067305,16373635465183484542,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:212
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1516
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58749e21d9d0a17dac32d5aa2027f7a75
SHA1a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA256915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
SHA512c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
-
Filesize
152B
MD534d2c4f40f47672ecdf6f66fea242f4a
SHA14bcad62542aeb44cae38a907d8b5a8604115ada2
SHA256b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
SHA51250fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
-
Filesize
5KB
MD5efc00c22b7166c3cff74c6a8973ace98
SHA1f8da65e42218251bde9554facb3c6a3615cd04b5
SHA256158f5d4013858f7d24fdb8b1a83f374795f888712efa1af085fae73425e48554
SHA5128669dd9ed20c6378303edfc0ce55e7e3b45590830577429cef627b037e0dcc39d8776f1f3a0f80846808c4cc292446ac5947e7817cc2a962c32fa3bc5d727309
-
Filesize
6KB
MD5bfe27e48e39ff2c7abac8327f7664f3d
SHA1e85e0719b503ce56216e9b99f28a41e110d5a1ab
SHA2565ebc3c6c6f6017f95f81ddbfc8368b633cad35ed5ba688822fc7e6d619cdd144
SHA512f48e860340e3741ca5ca0c68a74669de9d3d8896b2cbe87aa9ad85917c09fc8a12b648d5136758556611afc1dada5378d70b164fc9508e4c8205076cf50b1119
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5a9543d072436601f4d89f9785e5bab22
SHA121960eb04c34785ee8abd03b65e14615151934e8
SHA256f198837d3e1a2fd8938ab94cb5a74bcbcca0a989d7d62cc579b9b35f94c74e4b
SHA512959be51407d8408c422b58d837fe1066b8174df41d0301712e2801c785bdc319a066dda9102ce398f41718097deae7c0350eb6d06858841b5e33813ac70f9ad3