Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 22:19
Static task
static1
Behavioral task
behavioral1
Sample
03c094c70db0f6a5b3e0b29d779bc0a1_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
03c094c70db0f6a5b3e0b29d779bc0a1_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
03c094c70db0f6a5b3e0b29d779bc0a1_JaffaCakes118.html
-
Size
35KB
-
MD5
03c094c70db0f6a5b3e0b29d779bc0a1
-
SHA1
b00b19e9dc779f030c3e708ce37e47f7f25d2e95
-
SHA256
890fc3a95a4ee2b01019fab61c246c6b614f2bd8a2abacbfd166ed58cf3e3b86
-
SHA512
dbf6a1d4275bbd15a5535d52aed450230d019a7637e704993a58bf084bb4ccb51d3a81e81dfd85849f7a2d5fbd07f5331779657f672b605891b1a8581e8763e8
-
SSDEEP
768:zwx/MDTHg688hAR3ZPXmE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TIZOf6sggf6lLR/:Q/DbJxNVNu0Sx/P8gK
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3184 msedge.exe 3184 msedge.exe 4748 msedge.exe 4748 msedge.exe 4916 identity_helper.exe 4916 identity_helper.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe 4380 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe 4748 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4748 wrote to memory of 4704 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 4704 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3344 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3184 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 3184 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 2724 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 2724 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 2724 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 2724 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 2724 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 2724 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 2724 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 2724 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 2724 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 2724 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 2724 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 2724 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 2724 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 2724 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 2724 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 2724 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 2724 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 2724 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 2724 4748 msedge.exe msedge.exe PID 4748 wrote to memory of 2724 4748 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\03c094c70db0f6a5b3e0b29d779bc0a1_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3af846f8,0x7ffe3af84708,0x7ffe3af847182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,9630338586963671276,5994141414847074236,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,9630338586963671276,5994141414847074236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,9630338586963671276,5994141414847074236,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3020 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9630338586963671276,5994141414847074236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9630338586963671276,5994141414847074236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,9630338586963671276,5994141414847074236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,9630338586963671276,5994141414847074236,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5024 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9630338586963671276,5994141414847074236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9630338586963671276,5994141414847074236,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9630338586963671276,5994141414847074236,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4556 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9630338586963671276,5994141414847074236,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,9630338586963671276,5994141414847074236,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5dbac49e66219979194c79f1cf1cb3dd1
SHA14ef87804a04d51ae1fac358f92382548b27f62f2
SHA256f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562
SHA512bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a9e55f5864d6e2afd2fd84e25a3bc228
SHA1a5efcff9e3df6252c7fe8535d505235f82aab276
SHA2560f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452
SHA51212f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD56a90077df1676e679c5d5ddf4d614043
SHA16b217583131d51a3d63d7bf610083978f000bef5
SHA256a54070590b7cb5b2bbf77c20c6195cccdf0da261c6ef61921baa643175c0a2f3
SHA5127bf8200098182afaa9732f11ea3c8d4a8a2f4dd0af0b5e8ad23e5b6b0f96a1191c12133d948305e1ff1e3dc4e736c938eafb18b3d4904f2690f3c2066ce5c38b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD553762bde89d687316df409b1613f8534
SHA1093f4cf1c540456358155822a003c2d6ec66b02c
SHA256f3e930c83d2ca7d31312297cab2258b8e74c111184857b7a5cf4bfc4cb66f753
SHA512d865b1f147c12ec9dd54fbc5cebeec64b4993f45a6b78282cd66c74fc76f5c1c7fe75fbcade7502101f26b80e6aac2515ead5ee86627dd44c6984a500ec84913
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
8KB
MD5c2b1d736601807891f108be748498c2c
SHA11f364b7ab887027cf0812de2025249eb754059ef
SHA256784e1f1052b1127be171d65f4be07a3fe7bcd19bc53fdb1657ad6a35df8a3f0b
SHA512ab174fd63ba6ae238278b00b1159a467c68acf6659b177567c7e4e37a88f77efb01028ba0c852ac519ecc47246240e58ca9002661522186d4089e4e5fd707bf4
-
\??\pipe\LOCAL\crashpad_4748_JVQXCBXBQNRKVRGFMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e