Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 14:58
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_40bf91d70dcc489211c3fbe0d44227c7.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_40bf91d70dcc489211c3fbe0d44227c7.html
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_40bf91d70dcc489211c3fbe0d44227c7.html
-
Size
31KB
-
MD5
40bf91d70dcc489211c3fbe0d44227c7
-
SHA1
adbfea0896c3aeaf7c452b92bb0a52ec000fe875
-
SHA256
a9c9d28353c4ea0ae361800a794beb1035a49f7062853cc7e7403c522dafa7fc
-
SHA512
58c4c91915cb4d289bd2129e3126be58029582ba201f23cc312fb28dd7cb0fba95ee571a8fbed9bf7c31a2f9f6708b9751a799839a66ab490ac7117f3efb0fc9
-
SSDEEP
384:mAp3ZBh449GVCz3n1SISsI9xGfGdq2W9v3ePnuTvrZt0qnSvwiE:pp3ZBhhD1SmgWQuTvkwt
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3632 msedge.exe 3632 msedge.exe 4316 msedge.exe 4316 msedge.exe 3092 identity_helper.exe 3092 identity_helper.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe 4596 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe 4316 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4316 wrote to memory of 1780 4316 msedge.exe 83 PID 4316 wrote to memory of 1780 4316 msedge.exe 83 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 1888 4316 msedge.exe 84 PID 4316 wrote to memory of 3632 4316 msedge.exe 85 PID 4316 wrote to memory of 3632 4316 msedge.exe 85 PID 4316 wrote to memory of 4248 4316 msedge.exe 86 PID 4316 wrote to memory of 4248 4316 msedge.exe 86 PID 4316 wrote to memory of 4248 4316 msedge.exe 86 PID 4316 wrote to memory of 4248 4316 msedge.exe 86 PID 4316 wrote to memory of 4248 4316 msedge.exe 86 PID 4316 wrote to memory of 4248 4316 msedge.exe 86 PID 4316 wrote to memory of 4248 4316 msedge.exe 86 PID 4316 wrote to memory of 4248 4316 msedge.exe 86 PID 4316 wrote to memory of 4248 4316 msedge.exe 86 PID 4316 wrote to memory of 4248 4316 msedge.exe 86 PID 4316 wrote to memory of 4248 4316 msedge.exe 86 PID 4316 wrote to memory of 4248 4316 msedge.exe 86 PID 4316 wrote to memory of 4248 4316 msedge.exe 86 PID 4316 wrote to memory of 4248 4316 msedge.exe 86 PID 4316 wrote to memory of 4248 4316 msedge.exe 86 PID 4316 wrote to memory of 4248 4316 msedge.exe 86 PID 4316 wrote to memory of 4248 4316 msedge.exe 86 PID 4316 wrote to memory of 4248 4316 msedge.exe 86 PID 4316 wrote to memory of 4248 4316 msedge.exe 86 PID 4316 wrote to memory of 4248 4316 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40bf91d70dcc489211c3fbe0d44227c7.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf7a146f8,0x7ffbf7a14708,0x7ffbf7a147182⤵PID:1780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,10601480932234771270,13132047441279836714,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:22⤵PID:1888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,10601480932234771270,13132047441279836714,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,10601480932234771270,13132047441279836714,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:82⤵PID:4248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10601480932234771270,13132047441279836714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:12⤵PID:4256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10601480932234771270,13132047441279836714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:12⤵PID:4452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10601480932234771270,13132047441279836714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:12⤵PID:3528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10601480932234771270,13132047441279836714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:12⤵PID:4540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,10601480932234771270,13132047441279836714,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:82⤵PID:4948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,10601480932234771270,13132047441279836714,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10601480932234771270,13132047441279836714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:12⤵PID:4604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10601480932234771270,13132047441279836714,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:12⤵PID:2652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10601480932234771270,13132047441279836714,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:12⤵PID:2860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,10601480932234771270,13132047441279836714,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:12⤵PID:3904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,10601480932234771270,13132047441279836714,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4984 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4596
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:396
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2192
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD599afa4934d1e3c56bbce114b356e8a99
SHA13f0e7a1a28d9d9c06b6663df5d83a65c84d52581
SHA25608e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8
SHA51276686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da
-
Filesize
152B
MD5443a627d539ca4eab732bad0cbe7332b
SHA186b18b906a1acd2a22f4b2c78ac3564c394a9569
SHA2561e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9
SHA512923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d
-
Filesize
188B
MD5fb32748c36e54732ee8f920312c4e8d7
SHA1e69ea436803866cc26b7dfbe16a4064bc2c0a64b
SHA256fa1b09c35467733babe6bf6d53e433b6dccf8550fcd137ce2de64bcd722ce5e3
SHA512d165f74f3b16afa0c4f3cea3eaea9aaf8fe2b6be4b3cef74bb240d8cae62015b7e03c1ca69ef2ecc7d813c978e5695b90389d9ca9e16233e4b9377ebce74f3f9
-
Filesize
5KB
MD53ada208fc5b7033eae42cd19989d07b7
SHA1d9e40552090627a3d0b6fbce9b6d018ce667ba2c
SHA256a0c37ddb7214a8e9e8c43ea6fb690002f8febb493a4bb98f55dd09449d28172a
SHA51205a2a59039b7296ad1e27e2a373a693b80e0db379e66d841ebd0d4962ed16c11dc3efd21b2b58a913f12db4666a081c3d4410edc5abfcfaef2adf32629f0d689
-
Filesize
6KB
MD519ca28ad90e8fa0240610bc5dacda70d
SHA1deca66ec90e13bcc8ff12ca6d74dcc8bd3aedb1f
SHA2567834eee3a238fa9fea01d8061f46c5715ee1e97d0aad91a269ee587b4e468b73
SHA5128432cef95c6b8bbf2b97d4f0392f2ed961eb4141df1f2a502142c1ada47d51c095ec7a2a2a46d8606af26e51d34e2c5dde982dfed3e7a6ac4ee7e2964a26484f
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
10KB
MD571cb031486fccabf42e71160648f9127
SHA10d7e43b9740a4e0bfc80079fea6c809ae6ffafa1
SHA256f454b11fed77bd808a3d2aa2fcdbe4f9dd7f2a3059518faf92f0bd3ba55318d3
SHA512bf02ce2c037027aedd2729ef40edc27f3d77ad0c9f8ab1e4b20806e643d410281ca874b9517f0b9478559f6b4507bc63f29421f1108d5b863a9192bf6f39feb8