Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
26-04-2024 13:12
Static task
static1
Behavioral task
behavioral1
Sample
00d83655e9952fd449ef29ba0006b4b7_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
00d83655e9952fd449ef29ba0006b4b7_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
00d83655e9952fd449ef29ba0006b4b7_JaffaCakes118.html
-
Size
158KB
-
MD5
00d83655e9952fd449ef29ba0006b4b7
-
SHA1
b1bbcd4c5008b39e5d73c52fe72984b4f0fb0944
-
SHA256
4f730e0961c8beb259a9f640bb1907890a45222b7a1aeb246fe6432bbc99d9b8
-
SHA512
c46751f5219a7ed42418be332b1e56ae071141169635892d51bca9d1bccd0f9298f9c12e1390ef3a7c93bee135239b2eb521294a6d9a38fa87de019a0acbecb5
-
SSDEEP
3072:iwg0Slx3Q4yfkMY+BES09JXAnyrZalI+YQ:ib0YQ1sMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 4416 msedge.exe 4416 msedge.exe 3492 msedge.exe 3492 msedge.exe 4980 identity_helper.exe 4980 identity_helper.exe 760 msedge.exe 760 msedge.exe 760 msedge.exe 760 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe 3492 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3492 wrote to memory of 2964 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 2964 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 3536 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 4416 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 4416 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 4040 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 4040 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 4040 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 4040 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 4040 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 4040 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 4040 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 4040 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 4040 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 4040 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 4040 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 4040 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 4040 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 4040 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 4040 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 4040 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 4040 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 4040 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 4040 3492 msedge.exe msedge.exe PID 3492 wrote to memory of 4040 3492 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\00d83655e9952fd449ef29ba0006b4b7_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7d0b46f8,0x7fff7d0b4708,0x7fff7d0b47182⤵PID:2964
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,17307174157762118593,16253219941259546344,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2056 /prefetch:22⤵PID:3536
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,17307174157762118593,16253219941259546344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4416 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,17307174157762118593,16253219941259546344,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:82⤵PID:4040
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17307174157762118593,16253219941259546344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4304
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17307174157762118593,16253219941259546344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:4536
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,17307174157762118593,16253219941259546344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 /prefetch:82⤵PID:4964
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,17307174157762118593,16253219941259546344,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4980 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17307174157762118593,16253219941259546344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4492 /prefetch:12⤵PID:3028
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17307174157762118593,16253219941259546344,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:12⤵PID:2544
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17307174157762118593,16253219941259546344,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:12⤵PID:4068
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,17307174157762118593,16253219941259546344,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:12⤵PID:3572
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,17307174157762118593,16253219941259546344,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5084 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:760
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4756
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2440
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD52a70f1bd4da893a67660d6432970788d
SHA1ddf4047e0d468f56ea0c0d8ff078a86a0bb62873
SHA256c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561
SHA51226b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5fbe1ce4d182aaffb80de94263be1dd35
SHA1bc6c9827aa35a136a7d79be9e606ff359e2ac3ea
SHA2560021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51
SHA5123fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD55f58973fe29b0c5f3fabd80856323859
SHA1e5eac6e4224f6daba8c62763fce476b00ff6116a
SHA2563b59b201f71c8f77bfaa1c9f5c33d16cdde44a1227f8a8ffb6835a0ba57fd9a7
SHA512c4e069639d0697190388e8b97d5c6498074acc55165a8f6577422318f7e74e9e1b9bbefe27c5cc9141438e7f76bb18a59a03d8340c189226f47c646e508d510c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5fb86ce394cda7acc1f9dde2f0b2eee2d
SHA10d9dd46c1853283edf86a39a99b7b4faba4fc58f
SHA25677ce449708e57b06a539d99127248448d6324da2b2f8ec622627c1983b1c4ce3
SHA51243c844909885209fc51e5906488f06b42b83019b229280169ea7e142b16f74a0dd665c0e32170c990b7422eb7abc6030f292a21cb97f2c70010846d7577bd56a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
8KB
MD56cee2ab5a452d72fdbe75cc44198fbd1
SHA1e491ce4e9263f030390a9bae4b4dbb66fd3a493a
SHA256dbd25baa273c49c8384bbed2b59be90fd101421edefa22b553b2991b62e5a504
SHA512af8703ba01199a4df24ac522b64808f01a89f5b8a13f6433321cd0270a263a521fdf1e7f69c2741f7bb82c122b42ce8a262a07104320f05f29e214330a8ade31
-
\??\pipe\LOCAL\crashpad_3492_BQOGRHBTKLDOBKCZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e