Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 14:57
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_40be31f9acd0bffe829ca9193867ea6f.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_40be31f9acd0bffe829ca9193867ea6f.html
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_40be31f9acd0bffe829ca9193867ea6f.html
-
Size
20KB
-
MD5
40be31f9acd0bffe829ca9193867ea6f
-
SHA1
f1d3ea2b812d24cbf486f9e69686785240034aa4
-
SHA256
9494b9ccb055f5f9ac4d69b043b0954ea6dd7771927670e7680be3ca547dd907
-
SHA512
77bb69dadddc6ff8010e150b1c18b9167dff45b681e50e20809651cb12f8bfabbef5a1a662c2857c698eb3c68a97699f99dc1b47d76b6961700b8e37ab43b3d0
-
SSDEEP
192:qYSPRgJSSFnJzOF9A+3gA/ee94dbLq4ZLvydFOov88uigLA/0HPXxcJTtlaR2uA8:qYSPcAFG+bhy1Y8sVlvb19W
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2876 msedge.exe 2876 msedge.exe 1008 msedge.exe 1008 msedge.exe 3452 identity_helper.exe 3452 identity_helper.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe 4616 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe 1008 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1008 wrote to memory of 3832 1008 msedge.exe 82 PID 1008 wrote to memory of 3832 1008 msedge.exe 82 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 4808 1008 msedge.exe 83 PID 1008 wrote to memory of 2876 1008 msedge.exe 84 PID 1008 wrote to memory of 2876 1008 msedge.exe 84 PID 1008 wrote to memory of 2740 1008 msedge.exe 85 PID 1008 wrote to memory of 2740 1008 msedge.exe 85 PID 1008 wrote to memory of 2740 1008 msedge.exe 85 PID 1008 wrote to memory of 2740 1008 msedge.exe 85 PID 1008 wrote to memory of 2740 1008 msedge.exe 85 PID 1008 wrote to memory of 2740 1008 msedge.exe 85 PID 1008 wrote to memory of 2740 1008 msedge.exe 85 PID 1008 wrote to memory of 2740 1008 msedge.exe 85 PID 1008 wrote to memory of 2740 1008 msedge.exe 85 PID 1008 wrote to memory of 2740 1008 msedge.exe 85 PID 1008 wrote to memory of 2740 1008 msedge.exe 85 PID 1008 wrote to memory of 2740 1008 msedge.exe 85 PID 1008 wrote to memory of 2740 1008 msedge.exe 85 PID 1008 wrote to memory of 2740 1008 msedge.exe 85 PID 1008 wrote to memory of 2740 1008 msedge.exe 85 PID 1008 wrote to memory of 2740 1008 msedge.exe 85 PID 1008 wrote to memory of 2740 1008 msedge.exe 85 PID 1008 wrote to memory of 2740 1008 msedge.exe 85 PID 1008 wrote to memory of 2740 1008 msedge.exe 85 PID 1008 wrote to memory of 2740 1008 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40be31f9acd0bffe829ca9193867ea6f.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9840e46f8,0x7ff9840e4708,0x7ff9840e47182⤵PID:3832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:4808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:82⤵PID:2740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:12⤵PID:2164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:3924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:12⤵PID:3180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:82⤵PID:2052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:12⤵PID:1244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:12⤵PID:3000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:12⤵PID:4996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:12⤵PID:4964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,11593162253168472189,9282811053975882561,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4616
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4532
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD58bce0d45c0d137e967eb083d42b4d8c5
SHA18c48e5880547bde1d4f8009335953ce72efbbf8c
SHA2569c1a0a7b1bdfcb9dd35a4f1bb8928f524314f279d29a2b0257921e307dafe572
SHA5126857f0ed92b9ad6408815fdc30336211f59b56fd1c6ceee6ac1d69124a8ff629b546a7ad7d4c0e4a9c336cf2d08a24569aedd5a3561fc4163057fc81e879b40c
-
Filesize
152B
MD51b9739f5776a018d1dfea64dee3f4897
SHA13dcea83f53d046c24318fb0748f4d0652b213456
SHA256a667d0d19885a961de72e4ba4b89957e9904bb9ac99e878e7fc106da0b3091e0
SHA512d22f0a192450d4185fe73674d0bde7f2fa1f68bcc16ade038c372028a891d230391e45d08c02db9d11b8fccc250abbc5a29ca3d7759dbab8cb937cb4066e46e8
-
Filesize
152B
MD52c40d5d7c5e0a85321aa5a230e68a231
SHA1c4ac788ba4da6897adc3c9ef661ca6b469fc547e
SHA2569bc3a5bef04210d4751fd4ed395131776e8f7737a5a377be09fcddfb7eb45384
SHA512bb513fae1e4dbaed4ae59181407a24fe987c642451e6546fbcf14555fae575ff2d227fc39dee997fd64407d2927973831bfa14645d675c041b2dfc61ed3d55c0
-
Filesize
5KB
MD53532c782d6470e90ecd7ab84e0c1d2ae
SHA1ae7ba704e13b57d5c0af50788566e29f4e42e6ba
SHA256794fefcbf1fbe2bcfce71e8a75a91106d2393997b6ed79af1e44c0bc064a7093
SHA512f0ee17816a9c2582c223862211e758643f317841ce402f3eb7cc9f247dd7ec11f4ad67147a20fbad4788c3e6efe341a141bb1faea0181842004c9f100ec3f092
-
Filesize
5KB
MD5ca385fe232c47d81cf265a0c004a1008
SHA1ebe9100e0bac74384f7f6034b6282539f469a080
SHA256a725d9375571fd926dac80ab5e0991682ed6646deb236e2e81082cda1a23397b
SHA5127917b991b20c6fb6eef8473eaf7fa063410c6b5cf62c8f1030617e25b8ae39d3df37cb6cf805b990e804a7fe6f94a562486dcc8da4b961bcaedac45c435c5d20
-
Filesize
24KB
MD562fa438b48fdfb61c360e6d4fd356110
SHA16e54e946a5211afa1459715b9f37a18ea92cdd57
SHA256fe3d2e83848ede65097467a54ea813ed25a51119e87121089b3cfc531ebe5798
SHA51201ada296a3fefe713f53d80d2c95b6e41231012d0998077b7948a68d961b61292d1e3b1b3457488eaa739fc4ff0974672ee448d29d2fcce2c1bebab49da96624
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389