Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
30/03/2024, 11:37
Static task
static1
Behavioral task
behavioral1
Sample
3afc00b1291741426063eae9e741edad_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
3afc00b1291741426063eae9e741edad_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
3afc00b1291741426063eae9e741edad_JaffaCakes118.html
-
Size
118KB
-
MD5
3afc00b1291741426063eae9e741edad
-
SHA1
4537191a012d7c7ecc4ae509aa676a8c919ce20e
-
SHA256
b91a9bc1c254bcb285f38a83f8a9e8d503cd8af6deeddea5d023662d60cb6e95
-
SHA512
28f299c0bc66cb55201319ce2d3ffc6d1fce418db3ebc1e6da4e7fc7ddea708347552c1e490760152e329b3e3450de1185c7929575e5c4bf38c4635145cac3bc
-
SSDEEP
1536:S3yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsQE:S3yfkMY+BES09JXAnyrZalI+YWH9
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3436 msedge.exe 3436 msedge.exe 2148 msedge.exe 2148 msedge.exe 2440 identity_helper.exe 2440 identity_helper.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe 2632 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe 2148 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2148 wrote to memory of 4944 2148 msedge.exe 85 PID 2148 wrote to memory of 4944 2148 msedge.exe 85 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 232 2148 msedge.exe 86 PID 2148 wrote to memory of 3436 2148 msedge.exe 87 PID 2148 wrote to memory of 3436 2148 msedge.exe 87 PID 2148 wrote to memory of 2108 2148 msedge.exe 88 PID 2148 wrote to memory of 2108 2148 msedge.exe 88 PID 2148 wrote to memory of 2108 2148 msedge.exe 88 PID 2148 wrote to memory of 2108 2148 msedge.exe 88 PID 2148 wrote to memory of 2108 2148 msedge.exe 88 PID 2148 wrote to memory of 2108 2148 msedge.exe 88 PID 2148 wrote to memory of 2108 2148 msedge.exe 88 PID 2148 wrote to memory of 2108 2148 msedge.exe 88 PID 2148 wrote to memory of 2108 2148 msedge.exe 88 PID 2148 wrote to memory of 2108 2148 msedge.exe 88 PID 2148 wrote to memory of 2108 2148 msedge.exe 88 PID 2148 wrote to memory of 2108 2148 msedge.exe 88 PID 2148 wrote to memory of 2108 2148 msedge.exe 88 PID 2148 wrote to memory of 2108 2148 msedge.exe 88 PID 2148 wrote to memory of 2108 2148 msedge.exe 88 PID 2148 wrote to memory of 2108 2148 msedge.exe 88 PID 2148 wrote to memory of 2108 2148 msedge.exe 88 PID 2148 wrote to memory of 2108 2148 msedge.exe 88 PID 2148 wrote to memory of 2108 2148 msedge.exe 88 PID 2148 wrote to memory of 2108 2148 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3afc00b1291741426063eae9e741edad_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffda20746f8,0x7ffda2074708,0x7ffda20747182⤵PID:4944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,15207920829182638003,2396362347211402359,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:22⤵PID:232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,15207920829182638003,2396362347211402359,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,15207920829182638003,2396362347211402359,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:82⤵PID:2108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,15207920829182638003,2396362347211402359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:3424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,15207920829182638003,2396362347211402359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:2720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,15207920829182638003,2396362347211402359,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:82⤵PID:1644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,15207920829182638003,2396362347211402359,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,15207920829182638003,2396362347211402359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:12⤵PID:3484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,15207920829182638003,2396362347211402359,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:12⤵PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,15207920829182638003,2396362347211402359,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:12⤵PID:4040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,15207920829182638003,2396362347211402359,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:12⤵PID:3292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,15207920829182638003,2396362347211402359,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1256 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2632
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2500
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2188
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5e494d16e4b331d7fc483b3ae3b2e0973
SHA1d13ca61b6404902b716f7b02f0070dec7f36edbf
SHA256a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165
SHA512016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737
-
Filesize
152B
MD50764f5481d3c05f5d391a36463484b49
SHA12c96194f04e768ac9d7134bc242808e4d8aeb149
SHA256cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3
SHA512a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224
-
Filesize
6KB
MD5262cbcbd1ed693458273a805c255aa15
SHA177a68d3f99782b3fa2f92820284eebb92ed9b52d
SHA25645b168b8d36f7f85cd9a7b3e52e4f351deaed467b9fb827964eda8155f913be8
SHA512c27bac08b09cc58f1d287d169b4139909b873aeeaba8912e1299cf66e24c4674bf005ebd8a7c8bbff211e716edc11e36f45d8bdbd10800cf3c04cb6ae065ba8d
-
Filesize
6KB
MD582f1fb5ed0c4912adc57514ed177508b
SHA1666eb75d87b0aa0a6eb84cf94dc838e4016aa93e
SHA256d9b27fee44bb3b70bdc2eb7123011286c5cf1b99abba72f055328461ffc13973
SHA5121e7578fa1e57b2e36c3ed7fbf0cc26fb5b95dfff8725fe3b9fb1113342057d0cbbdf95863525d3ce5d42531c25de67d017a9c9c3a8cdee539630fc99e70bc8d3
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD55f098f62035b15f4686f06dfb62fcc37
SHA1c7c155798fda6076a9b6a1a56fd34a637cbea29f
SHA256c95e1d947a4f8391bcecde23041e67d24b31cd86751e09d475ed4b7ab5450bb2
SHA51248a01b56d71e3d6a1751adc439e0703f6afa238e0f33cb206e7476ec7fd22ade64e2096ae6fd7eda73cab37e87d13600e481a2cf1231cbc96e886f76b9c291b2