Analysis
-
max time kernel
145s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 22:24
Static task
static1
Behavioral task
behavioral1
Sample
03c29f6913f7ecdbf060582a664397be_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
03c29f6913f7ecdbf060582a664397be_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
03c29f6913f7ecdbf060582a664397be_JaffaCakes118.html
-
Size
104KB
-
MD5
03c29f6913f7ecdbf060582a664397be
-
SHA1
f1c34d55396071e0c465c454d3d44e7564fe850f
-
SHA256
6b49f6b4095c87c0495f4091a0998dce27b3187b0371dbc7b93e4a6fff11401a
-
SHA512
30732142effa75821eb75f403fc07d63499bc34cd5e8588958b727104d8d4721ffbbd5089222a1116d4e5b0b951e34fb429bac1863c20cb4e6b10248710b8351
-
SSDEEP
1536:BEnERa/9lwkesZyGX/N/BS76DuK5k14f1RS:BEELLsZyGX/JBSck14f1RS
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 3420 msedge.exe 3420 msedge.exe 5052 msedge.exe 5052 msedge.exe 4596 identity_helper.exe 4596 identity_helper.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe 3308 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe 5052 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 5052 wrote to memory of 232 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 232 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 2124 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 3420 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 3420 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 4516 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 4516 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 4516 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 4516 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 4516 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 4516 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 4516 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 4516 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 4516 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 4516 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 4516 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 4516 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 4516 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 4516 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 4516 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 4516 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 4516 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 4516 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 4516 5052 msedge.exe msedge.exe PID 5052 wrote to memory of 4516 5052 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\03c29f6913f7ecdbf060582a664397be_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb0c0c46f8,0x7ffb0c0c4708,0x7ffb0c0c47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8669174888425594876,16103173850963238498,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,8669174888425594876,16103173850963238498,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,8669174888425594876,16103173850963238498,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8669174888425594876,16103173850963238498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8669174888425594876,16103173850963238498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8669174888425594876,16103173850963238498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8669174888425594876,16103173850963238498,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8669174888425594876,16103173850963238498,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8669174888425594876,16103173850963238498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8669174888425594876,16103173850963238498,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8669174888425594876,16103173850963238498,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8669174888425594876,16103173850963238498,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8669174888425594876,16103173850963238498,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD59dc60aef38e7832217e7fa02d6f0d9f6
SHA14f8539dc7d5739b36fe976a932338f459d066db6
SHA2568a0ee0b6fafabb256571b691c2faf77c7244945faa749c72124d5eb43a197a32
SHA51218371541811910992c2b84a8eae7e997e8627640bdb60b9e82751389e50931db9b3e206d31f4d9d2dc3ca25ea3a82c0be413ecb0ef3ac227a14e54f406eaa7e7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57ac03b15b68af2d5cb5c8063057cc83e
SHA19b2d4db737f57322ff5c4bbddd765b3177f930ab
SHA256b90d7596301470b389842eecb46bd3a8e614260b0d374d5c35a36afb9c71a700
SHA512a5e9f40dd9040803046b0218fab6b058d49e5e2a3ada315e161fe9fc80ebb8d6d4442ccc1c98d19e561fc7c61bcf43d662fe2231cacacb447876a2113c2e3732
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5a9cb1b0f599527d91ecaa7836f975f47
SHA1dfcae7b082b471a54dd66d2f9ad64f37d17c2238
SHA256ec534d71ea12e3a45fea4142ff67add6c31a68f5ee894a2c6eb071defda83e10
SHA5128f3de994d052f8be7c1a6fe8675b7a2d3884b69be4a4876229b674c07621736c3d82acb3603948573f58f0220635c844e7fb68645252936e329c63ea540ed73f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5cabaf7effc201258be3a86cca8515389
SHA1fe440eee21d8c99794c902ff14c5ebc36b9400ab
SHA256dde00556cb9018a046bde9a4adc5961eb35a35f40b5fe0434907690d80a4978b
SHA5129837c2313f1b407716d380d04fd89245b46263affae4a73c1acff981b2566fd6cfc0c4aaac5c4c9f882d912d86af67e6a620416166b6237c0736cba9dfc2b54e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
8KB
MD50e9cfe34b9c4f030b12f206da162221a
SHA143fb00ddfbc2fa295e108bc72cc7437b978f7582
SHA256f1d2776d8ba37400f4f700b5c01311831581e8ffa676af266a93701e711d239c
SHA512e5bfd38308f6c4897b3afddbb312edda65afd07b6fe033fcf2832ca6ff834ed459e840d7a4bf82003058ad53376fff59c98ced6aac1537831e8377e96e43790a
-
\??\pipe\LOCAL\crashpad_5052_TTHIQZFZSRXBCOPWMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e