Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 22:11
Static task
static1
Behavioral task
behavioral1
Sample
03bd5baf1c16c7a55acdb3aa52de3ee3_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
03bd5baf1c16c7a55acdb3aa52de3ee3_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
03bd5baf1c16c7a55acdb3aa52de3ee3_JaffaCakes118.html
-
Size
139KB
-
MD5
03bd5baf1c16c7a55acdb3aa52de3ee3
-
SHA1
f5647b55acbd846b5145c14f7627a3677f6fcf77
-
SHA256
0b43ee94ea17027da579b5f48ac8a8c98119ba9538efe5e3c69ca5b8343ae630
-
SHA512
7b13152f50c0630e62589ab9166d225d05420bff0fa6206ebc99402fe3253ea1fc7e95eae476ed2f30979d147d0148491dc91956eb90477621b6e7ba2f2c67e7
-
SSDEEP
1536:SiDNBaa6ylCXyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:SiDR0XyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 468 msedge.exe 468 msedge.exe 1464 msedge.exe 1464 msedge.exe 4688 identity_helper.exe 4688 identity_helper.exe 4408 msedge.exe 4408 msedge.exe 4408 msedge.exe 4408 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe 1464 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1464 wrote to memory of 3676 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 3676 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 4464 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 468 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 468 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 1488 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 1488 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 1488 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 1488 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 1488 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 1488 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 1488 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 1488 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 1488 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 1488 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 1488 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 1488 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 1488 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 1488 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 1488 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 1488 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 1488 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 1488 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 1488 1464 msedge.exe msedge.exe PID 1464 wrote to memory of 1488 1464 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\03bd5baf1c16c7a55acdb3aa52de3ee3_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff848f846f8,0x7ff848f84708,0x7ff848f847182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,14475596051184718236,4268020737477589287,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,14475596051184718236,4268020737477589287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,14475596051184718236,4268020737477589287,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14475596051184718236,4268020737477589287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14475596051184718236,4268020737477589287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,14475596051184718236,4268020737477589287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,14475596051184718236,4268020737477589287,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14475596051184718236,4268020737477589287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14475596051184718236,4268020737477589287,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14475596051184718236,4268020737477589287,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14475596051184718236,4268020737477589287,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,14475596051184718236,4268020737477589287,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4296 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD59dc60aef38e7832217e7fa02d6f0d9f6
SHA14f8539dc7d5739b36fe976a932338f459d066db6
SHA2568a0ee0b6fafabb256571b691c2faf77c7244945faa749c72124d5eb43a197a32
SHA51218371541811910992c2b84a8eae7e997e8627640bdb60b9e82751389e50931db9b3e206d31f4d9d2dc3ca25ea3a82c0be413ecb0ef3ac227a14e54f406eaa7e7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57ac03b15b68af2d5cb5c8063057cc83e
SHA19b2d4db737f57322ff5c4bbddd765b3177f930ab
SHA256b90d7596301470b389842eecb46bd3a8e614260b0d374d5c35a36afb9c71a700
SHA512a5e9f40dd9040803046b0218fab6b058d49e5e2a3ada315e161fe9fc80ebb8d6d4442ccc1c98d19e561fc7c61bcf43d662fe2231cacacb447876a2113c2e3732
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5f2de2fe9436025afbf25ed25177ec6ef
SHA1e5458b937bab9191817567222cda90f8cca61564
SHA256878543c673bdb4a25a33b53614072ca80e6af728840c210f9dd1c8d702edb0a8
SHA512f49105068a74d296d3f3937e69f17faed5b089e27e891af3cd16e317dc30da0befc06527fc3d332c33451d82544f2bc11dc424713aa46bd52992909b44c0bc7a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5f496f39dfd08b922b085ba612ae7eecb
SHA1bb63d8ca5f2f0dd7b687635410b6c92b6777e464
SHA256b6a384644a2ae9fea30417d246d0caecc860a4f813988fd748b191b319e848cd
SHA512718ab1e6c5d0c990167ce8cc4461382c2c96dd3685f997ba07a9dee5e356d751daae06278ba2bd3be2f9dd29ae5379eb227c76c27d3d2401ead5a6e20d353619
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
8KB
MD54d4c38cf3d1858787e1ddc02aaf42fa4
SHA113297cdad67dbd0f967191c8cbfd69e25db3f950
SHA25675f85a185acb7eff534130b1f1826eaa1a83a6026e236276b3a95dffad76a225
SHA5125909fe1a16786fba5aeb65f978ccc05f04a24c4611a8426ff5a28df53f664f8329366646debe450156ccc4df89596e60312d60f0e321d58752b2e46ef1d7a2f0
-
\??\pipe\LOCAL\crashpad_1464_PSQJADRXDTYYUJBUMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e