Analysis
-
max time kernel
145s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 22:27
Static task
static1
Behavioral task
behavioral1
Sample
03c3dd245766c57289834ada84cce57d_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
03c3dd245766c57289834ada84cce57d_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
03c3dd245766c57289834ada84cce57d_JaffaCakes118.html
-
Size
23KB
-
MD5
03c3dd245766c57289834ada84cce57d
-
SHA1
2e5e5156632090f9555ccea96400b8472553b2bf
-
SHA256
8b9b76433686532e3eb833d81359d242861d1bf1066e9d6d13c9be20a6f92a23
-
SHA512
161f90cc2c6d1858a386083f253e37c61416cf01ca20550c2d1ccbba309af09d4b5e4973a42ac2dbb414f038e3c73f719153cdc2dd5e800394a027cde6181544
-
SSDEEP
384:67wCQf7UOpZ8XRW+esLAYAJJSxhMqdVoEwYpumFll5BmPKvWbNO8wk:67wCQ3pc4+kYAr4hNCE5VeKc
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 888 msedge.exe 888 msedge.exe 2824 msedge.exe 2824 msedge.exe 1488 identity_helper.exe 1488 identity_helper.exe 1620 msedge.exe 1620 msedge.exe 1620 msedge.exe 1620 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe 2824 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2824 wrote to memory of 696 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 696 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 2000 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 888 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 888 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 4960 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 4960 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 4960 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 4960 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 4960 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 4960 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 4960 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 4960 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 4960 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 4960 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 4960 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 4960 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 4960 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 4960 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 4960 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 4960 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 4960 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 4960 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 4960 2824 msedge.exe msedge.exe PID 2824 wrote to memory of 4960 2824 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\03c3dd245766c57289834ada84cce57d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd2d046f8,0x7ffbd2d04708,0x7ffbd2d047182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,18111522528012356510,17457665297598324485,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,18111522528012356510,17457665297598324485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,18111522528012356510,17457665297598324485,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,18111522528012356510,17457665297598324485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,18111522528012356510,17457665297598324485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,18111522528012356510,17457665297598324485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,18111522528012356510,17457665297598324485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,18111522528012356510,17457665297598324485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,18111522528012356510,17457665297598324485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,18111522528012356510,17457665297598324485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,18111522528012356510,17457665297598324485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,18111522528012356510,17457665297598324485,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4448 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD59dc60aef38e7832217e7fa02d6f0d9f6
SHA14f8539dc7d5739b36fe976a932338f459d066db6
SHA2568a0ee0b6fafabb256571b691c2faf77c7244945faa749c72124d5eb43a197a32
SHA51218371541811910992c2b84a8eae7e997e8627640bdb60b9e82751389e50931db9b3e206d31f4d9d2dc3ca25ea3a82c0be413ecb0ef3ac227a14e54f406eaa7e7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD57ac03b15b68af2d5cb5c8063057cc83e
SHA19b2d4db737f57322ff5c4bbddd765b3177f930ab
SHA256b90d7596301470b389842eecb46bd3a8e614260b0d374d5c35a36afb9c71a700
SHA512a5e9f40dd9040803046b0218fab6b058d49e5e2a3ada315e161fe9fc80ebb8d6d4442ccc1c98d19e561fc7c61bcf43d662fe2231cacacb447876a2113c2e3732
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD58f357565eec42a3fa23a7f4ad3d86db0
SHA1ae858146b6140fa32f1b5f5d4316da65e813df62
SHA256151d6bb10860e03b6050cea9811a31fedab0296425984deee60e89eb4dbeaa4e
SHA51214e9f7c9dcd1adb98650248c7d6a8c9481d4584ba1a9304e173725dc3f4d1afc54ac810855c94845ba6f2817af5845542e5094fe8fe234efc74d16584375fff8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
8KB
MD50f53572e74fdafd51e24fb84e857f5e3
SHA11c26adad2000ba3de5d382dfbf513692b21a674a
SHA2569d4bf7ea7884fc4306bb5ca1481c38a35cf19e51de36da08bba6e69e286ef315
SHA512a7a300f35427a74d2d7c44dae541ee8eba28229b11b482002d745cc1113eb57296116124970161b0928ce070b5e28e81f5158f24102e14454deb1fbee2dc740a
-
\??\pipe\LOCAL\crashpad_2824_CKXOIIMCKNEOUCEYMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e