Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 08:41
Static task
static1
Behavioral task
behavioral1
Sample
f9ee6e297f86e8e131d4b3ee4bf69c1e_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
f9ee6e297f86e8e131d4b3ee4bf69c1e_JaffaCakes118.html
Resource
win10v2004-20240412-en
General
-
Target
f9ee6e297f86e8e131d4b3ee4bf69c1e_JaffaCakes118.html
-
Size
2KB
-
MD5
f9ee6e297f86e8e131d4b3ee4bf69c1e
-
SHA1
8145aa6d698d570004cf3435564a9ac6cab52c00
-
SHA256
28a6eb97f9d3aff32b6559b35b96f323010cad31cfb3bac7c78ac0f0c283136b
-
SHA512
8212ca67e97bd307ba00c8ed33478bdabd445c21ab02e380eea6bc45b74c971955da09817822401e2d65511911118598b91fede24f4c0327dd4fb8b5cc225e6d
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2452 msedge.exe 2452 msedge.exe 3308 msedge.exe 3308 msedge.exe 4128 identity_helper.exe 4128 identity_helper.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe 2648 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3308 wrote to memory of 4656 3308 msedge.exe 83 PID 3308 wrote to memory of 4656 3308 msedge.exe 83 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 4956 3308 msedge.exe 84 PID 3308 wrote to memory of 2452 3308 msedge.exe 85 PID 3308 wrote to memory of 2452 3308 msedge.exe 85 PID 3308 wrote to memory of 4192 3308 msedge.exe 86 PID 3308 wrote to memory of 4192 3308 msedge.exe 86 PID 3308 wrote to memory of 4192 3308 msedge.exe 86 PID 3308 wrote to memory of 4192 3308 msedge.exe 86 PID 3308 wrote to memory of 4192 3308 msedge.exe 86 PID 3308 wrote to memory of 4192 3308 msedge.exe 86 PID 3308 wrote to memory of 4192 3308 msedge.exe 86 PID 3308 wrote to memory of 4192 3308 msedge.exe 86 PID 3308 wrote to memory of 4192 3308 msedge.exe 86 PID 3308 wrote to memory of 4192 3308 msedge.exe 86 PID 3308 wrote to memory of 4192 3308 msedge.exe 86 PID 3308 wrote to memory of 4192 3308 msedge.exe 86 PID 3308 wrote to memory of 4192 3308 msedge.exe 86 PID 3308 wrote to memory of 4192 3308 msedge.exe 86 PID 3308 wrote to memory of 4192 3308 msedge.exe 86 PID 3308 wrote to memory of 4192 3308 msedge.exe 86 PID 3308 wrote to memory of 4192 3308 msedge.exe 86 PID 3308 wrote to memory of 4192 3308 msedge.exe 86 PID 3308 wrote to memory of 4192 3308 msedge.exe 86 PID 3308 wrote to memory of 4192 3308 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f9ee6e297f86e8e131d4b3ee4bf69c1e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9675246f8,0x7ff967524708,0x7ff9675247182⤵PID:4656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,4190995233054801485,5886558213664696099,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:22⤵PID:4956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,4190995233054801485,5886558213664696099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,4190995233054801485,5886558213664696099,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:82⤵PID:4192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4190995233054801485,5886558213664696099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:4136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4190995233054801485,5886558213664696099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:4888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4190995233054801485,5886558213664696099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:12⤵PID:1700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4190995233054801485,5886558213664696099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:12⤵PID:3132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4190995233054801485,5886558213664696099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:12⤵PID:1932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4190995233054801485,5886558213664696099,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:12⤵PID:3480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,4190995233054801485,5886558213664696099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:82⤵PID:3928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,4190995233054801485,5886558213664696099,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4190995233054801485,5886558213664696099,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:12⤵PID:2828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4190995233054801485,5886558213664696099,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:12⤵PID:1080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,4190995233054801485,5886558213664696099,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5360 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2648
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4920
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5cff358b013d6f9f633bc1587f6f54ffa
SHA16cb7852e096be24695ff1bc213abde42d35bb376
SHA25639205cdf989e3a86822b3f473c5fc223d7290b98c2a3fb7f75e366fc8e3ecbe9
SHA5128831c223a1f0cf5f71fa851cdd82f4a9f03e5f267513e05b936756c116997f749ffa563623b4724de921d049de34a8f277cc539f58997cda4d178ea205be2259
-
Filesize
152B
MD5dc629a750e345390344524fe0ea7dcd7
SHA15f9f00a358caaef0321707c4f6f38d52bd7e0399
SHA25638b634f3fedcf2a9dc3280aa76bd1ea93e192200b8a48904664fac5c9944636a
SHA5122a941fe90b748d0326e011258fa9b494dc2f47ac047767455ed16a41d523f04370f818316503a5bad0ff5c5699e92a0aaf3952748b09287c5328354bfa6cc902
-
Filesize
477B
MD54538e364649344d0b0650d0ab11c2a52
SHA1a22ce226b55e8430f513a078c1097ca5559ba965
SHA256033e8af8c08f33e6961542dbd73a22222e871ac08e688b96757d46e5ef7ecb5e
SHA51254708b2e6fc28c8303674176ceb16e4eadd3ad8dfcc48aaaf1de8181fffe781cf1d68521a30e535b2985bcb58c9d9c84ef80355cc268b5470221d2e1d985fa18
-
Filesize
6KB
MD59d838814136fa1ad2e4ef7f4db154b77
SHA17d6fff3bdbcc93d4da476d6198e4c2788985a392
SHA25689ef932b3a2ee290931232129abdffc5484f35d23a3b554950b8a1017403229d
SHA512d250449f4f4af973622e13c3d4c2bb39d0488e01465f43d4bf33254340cdbbaea4642566dcc440b94837033faf32d73f25ab8f2b6a6585f9a761644698b75ff7
-
Filesize
6KB
MD5dae4342d6b8cff267c6edbb0291e72b1
SHA108a0efb32efb34986504c33d42ec0520407c724e
SHA256c00aeffae69c3c7e9120a28081dd9d39a86fc6610be8e1aa296d4473099c2dae
SHA512de33b8bf1aca1b0284f582ed085703e5f61c3cacb6abc02c921c431cfc22f4c5c70118f118217844108e843602ae6f4a99f6c057596c8f60ada9b9faf1b37dad
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD53a3c8d1e1dca67bc4518b531c026e11b
SHA18e57b64c044c7fa334fabe015b7d007fd01afba2
SHA256e3009fd867ceed06926cbaa170cc093e82692e59fdf7a3b37a7f1f35db6806e0
SHA512e30dd5d508965b34946034f10cc6858eae94fcd5650e171e3d2e0ef8830dc5a1488318b9280cca48bdf1af2a1ec2df980089de483dd7c4a2898710e7a05f1de1