Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 20:52
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_4394db2fbe28c0771689a0b515bea645.html
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
JaffaCakes118_4394db2fbe28c0771689a0b515bea645.html
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_4394db2fbe28c0771689a0b515bea645.html
-
Size
4KB
-
MD5
4394db2fbe28c0771689a0b515bea645
-
SHA1
0a6bf8f380696d219766f1f9722043989d8bcecb
-
SHA256
5f73ea59351b24e8e2db8c2d34d94c4f204041fca14c161fa60c621560c8c29e
-
SHA512
08eb0cfbaeefca2d8c586ff1a75ae0ea9eac73372355cf91a800d1549c423a9363fe27b96b6eca5331d3ee5f6c307712727f12cfafc7653105daf9a5ee2301f9
-
SSDEEP
96:784i28Ao+xufeEeWhb1fwGu6XVDYMyjX0fgfRtMwuM/6uciypM:7qJJD51IyXJgBMw9/6FpM
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1384 msedge.exe 1384 msedge.exe 1600 msedge.exe 1600 msedge.exe 1336 identity_helper.exe 1336 identity_helper.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe 3676 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe 1600 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1600 wrote to memory of 2584 1600 msedge.exe 83 PID 1600 wrote to memory of 2584 1600 msedge.exe 83 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 756 1600 msedge.exe 84 PID 1600 wrote to memory of 1384 1600 msedge.exe 85 PID 1600 wrote to memory of 1384 1600 msedge.exe 85 PID 1600 wrote to memory of 3276 1600 msedge.exe 86 PID 1600 wrote to memory of 3276 1600 msedge.exe 86 PID 1600 wrote to memory of 3276 1600 msedge.exe 86 PID 1600 wrote to memory of 3276 1600 msedge.exe 86 PID 1600 wrote to memory of 3276 1600 msedge.exe 86 PID 1600 wrote to memory of 3276 1600 msedge.exe 86 PID 1600 wrote to memory of 3276 1600 msedge.exe 86 PID 1600 wrote to memory of 3276 1600 msedge.exe 86 PID 1600 wrote to memory of 3276 1600 msedge.exe 86 PID 1600 wrote to memory of 3276 1600 msedge.exe 86 PID 1600 wrote to memory of 3276 1600 msedge.exe 86 PID 1600 wrote to memory of 3276 1600 msedge.exe 86 PID 1600 wrote to memory of 3276 1600 msedge.exe 86 PID 1600 wrote to memory of 3276 1600 msedge.exe 86 PID 1600 wrote to memory of 3276 1600 msedge.exe 86 PID 1600 wrote to memory of 3276 1600 msedge.exe 86 PID 1600 wrote to memory of 3276 1600 msedge.exe 86 PID 1600 wrote to memory of 3276 1600 msedge.exe 86 PID 1600 wrote to memory of 3276 1600 msedge.exe 86 PID 1600 wrote to memory of 3276 1600 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4394db2fbe28c0771689a0b515bea645.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff1bea46f8,0x7fff1bea4708,0x7fff1bea47182⤵PID:2584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,6175890049081836534,16575275940014481896,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:22⤵PID:756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,6175890049081836534,16575275940014481896,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,6175890049081836534,16575275940014481896,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:82⤵PID:3276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6175890049081836534,16575275940014481896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:4336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6175890049081836534,16575275940014481896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:2876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6175890049081836534,16575275940014481896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2884 /prefetch:12⤵PID:2636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,6175890049081836534,16575275940014481896,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:82⤵PID:1704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,6175890049081836534,16575275940014481896,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6175890049081836534,16575275940014481896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:12⤵PID:3140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6175890049081836534,16575275940014481896,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:12⤵PID:3244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6175890049081836534,16575275940014481896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:12⤵PID:3380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6175890049081836534,16575275940014481896,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:12⤵PID:3904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,6175890049081836534,16575275940014481896,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5296 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3676
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3036
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58749e21d9d0a17dac32d5aa2027f7a75
SHA1a5d555f8b035c7938a4a864e89218c0402ab7cde
SHA256915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304
SHA512c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a
-
Filesize
152B
MD534d2c4f40f47672ecdf6f66fea242f4a
SHA14bcad62542aeb44cae38a907d8b5a8604115ada2
SHA256b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33
SHA51250fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6
-
Filesize
5KB
MD573e0eb1666665cdae1bb86d94fb9c17e
SHA13d6294c35914f39336e56b3e1fc806d06cb86d81
SHA2562a1b9caee6f4e35763d958318fce9702114ee29446485380c675f255cd901c75
SHA51201088fa406c8d34430fbdb5fb598fab47c6bcbcbe07fed54030fcf11216718c6c1cad788449644f918dd5dea53476a72cce1fbb16df8db6baab1e33d457668aa
-
Filesize
6KB
MD51f61e3c3d64ee26929fea661be36a91d
SHA1ce7179e62a08d459baf3ba7bf66572f230f92faa
SHA2561d8fce6aabe30dc5327433469aa8b9d6d0e6e8c868a0968b40141051055518af
SHA5128467ff4a680747c4153b3983e6a81214e93fe4cdaceebe7a5abf9ec41becbadd206e66edccfc98cad4bf68a25bee460c1fed3069a74fcfdd93d3ded31420a89a
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5c42bfa51baa1c23198db9d7c590ed2d2
SHA1bcdad4af212c32a8951efbb52f6ae137c19deed1
SHA256c005702a292a0537f4743131b7a540595461d9355698a04528974aea5a4dfe64
SHA512dbdaaa82c204f765cc100a3516acc4584f22e7f907050b6a56e50c74227a30ecd0623e3e78559d260b5099bf1f2ccfc6e470568fff560428f2ec655865f1f181