Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/04/2024, 05:30
Static task
static1
Behavioral task
behavioral1
Sample
dc70b9e03d22d473d947354499fe4f64_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
dc70b9e03d22d473d947354499fe4f64_JaffaCakes118.html
Resource
win10v2004-20240226-en
General
-
Target
dc70b9e03d22d473d947354499fe4f64_JaffaCakes118.html
-
Size
1KB
-
MD5
dc70b9e03d22d473d947354499fe4f64
-
SHA1
24b0fe13ccb3dd4439912f2dbd5a3e64f17c0c6c
-
SHA256
76004c42fc5e907d9263a3d33270e4d3e78671439f21ac3e6e85b2dbab5cbfe0
-
SHA512
c2638c8ca8106d8f0ecfc97e81ee44a126161d0147189d4b9afc63084b14780f8501ce1ed6d59f0a5d9bc611e47c3b4b752c75932f5d334cd764b94f339cc771
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2112 msedge.exe 2112 msedge.exe 1376 msedge.exe 1376 msedge.exe 3112 identity_helper.exe 3112 identity_helper.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe 4832 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe 1376 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1376 wrote to memory of 1948 1376 msedge.exe 86 PID 1376 wrote to memory of 1948 1376 msedge.exe 86 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2712 1376 msedge.exe 87 PID 1376 wrote to memory of 2112 1376 msedge.exe 88 PID 1376 wrote to memory of 2112 1376 msedge.exe 88 PID 1376 wrote to memory of 212 1376 msedge.exe 89 PID 1376 wrote to memory of 212 1376 msedge.exe 89 PID 1376 wrote to memory of 212 1376 msedge.exe 89 PID 1376 wrote to memory of 212 1376 msedge.exe 89 PID 1376 wrote to memory of 212 1376 msedge.exe 89 PID 1376 wrote to memory of 212 1376 msedge.exe 89 PID 1376 wrote to memory of 212 1376 msedge.exe 89 PID 1376 wrote to memory of 212 1376 msedge.exe 89 PID 1376 wrote to memory of 212 1376 msedge.exe 89 PID 1376 wrote to memory of 212 1376 msedge.exe 89 PID 1376 wrote to memory of 212 1376 msedge.exe 89 PID 1376 wrote to memory of 212 1376 msedge.exe 89 PID 1376 wrote to memory of 212 1376 msedge.exe 89 PID 1376 wrote to memory of 212 1376 msedge.exe 89 PID 1376 wrote to memory of 212 1376 msedge.exe 89 PID 1376 wrote to memory of 212 1376 msedge.exe 89 PID 1376 wrote to memory of 212 1376 msedge.exe 89 PID 1376 wrote to memory of 212 1376 msedge.exe 89 PID 1376 wrote to memory of 212 1376 msedge.exe 89 PID 1376 wrote to memory of 212 1376 msedge.exe 89
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\dc70b9e03d22d473d947354499fe4f64_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd753846f8,0x7ffd75384708,0x7ffd753847182⤵PID:1948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6058071838401980701,5743774214150948301,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:22⤵PID:2712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,6058071838401980701,5743774214150948301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,6058071838401980701,5743774214150948301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:82⤵PID:212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6058071838401980701,5743774214150948301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:3012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6058071838401980701,5743774214150948301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵PID:2740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6058071838401980701,5743774214150948301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:82⤵PID:3360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6058071838401980701,5743774214150948301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6058071838401980701,5743774214150948301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:12⤵PID:1880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6058071838401980701,5743774214150948301,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:12⤵PID:4172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6058071838401980701,5743774214150948301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:12⤵PID:4220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6058071838401980701,5743774214150948301,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:12⤵PID:2356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6058071838401980701,5743774214150948301,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4024 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4832
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4456
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4048
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5f35bb0615bb9816f562b83304e456294
SHA11049e2bd3e1bbb4cea572467d7c4a96648659cb4
SHA25605e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71
SHA512db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1
-
Filesize
152B
MD51eb86108cb8f5a956fdf48efbd5d06fe
SHA17b2b299f753798e4891df2d9cbf30f94b39ef924
SHA2561b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40
SHA512e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d
-
Filesize
196B
MD5355d6a9d451bd955345e29150b21e35b
SHA1d685b102a1447b11f04809d5171569eaf39e401a
SHA2565e1bf2751284d5c802ab040b0090949d412eaa5891d56732a69deab8045e9493
SHA512bbbfdab25660ff9fcf6b67f3158e022d6163ce27432843ef2283c4c862c23ed81ae98d375b054f49bbf1ee585d7c222d9c153def6456b9ec20635e85f6abc65b
-
Filesize
6KB
MD5d21e863a599dad2b3175bcb4981ae5ab
SHA1178c622887e278bb79d190cfb17658f68bec499f
SHA256bebc2fa248310638daf61801e3aaef43e0f4b7a1160b6ab886f8408130f59ffd
SHA5120247683a392cb30d0239e5feba72748d82b03db839674a21aa262ff7b1f1b967a0c1970f156d31c1acb3b134cfda19057b776950dd27f120ee8b2458eb3daeaf
-
Filesize
6KB
MD56e07c3d86e28ac6ee2cb8642374ebebd
SHA11e3a9dbaf3b70e2e5853c9260c1cda4ce74c3d5b
SHA25652f12028a422efac5e3ca41c58629d5b8ef575c93c02e3a5ad249e37accf695d
SHA5121a708d1e455edbb285c2de4bc6dd13bad89ea418ec3d3f746ca9950c0042b81a94f60beea31bb23875a001216c3ae78079fddec6fb1fe52f713d2861988bc42c
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD56824992b61ec8d99288f9382d77392b0
SHA1ec917f7e947df5087bd5b63fb19db4d949d64745
SHA2564858e520dfac88aaa78e5eee1cc03a8c9d21dbace8ba728e0d82444d6cf53f89
SHA5123c55595cded829164c19a2615e3beb572a6b2e74fca0910cb7e7e5c387d48a664c193e81fe202e6772be2b4d4f09e680dc053064ed5b7a5732b0b16759c8df9e