Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 22:28
Static task
static1
Behavioral task
behavioral1
Sample
03c3ec4e996392b0dedb6def7c7446e8_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
03c3ec4e996392b0dedb6def7c7446e8_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
03c3ec4e996392b0dedb6def7c7446e8_JaffaCakes118.html
-
Size
55KB
-
MD5
03c3ec4e996392b0dedb6def7c7446e8
-
SHA1
b45bf3bb28976a55d9d9cb7c2b7b9422d9f318c3
-
SHA256
429661e9ce6e7c54d399b78da0a3eef10403aee7790494be220204c6fbb70844
-
SHA512
c1fa1fc175c820223c35221f637da71acfa229d967e2f79f40d86b8a42d43be5a9b0d4bea3380b5d6fd6b02dd5bc98f880421bd8fff6f9e2cf821a5b1a54fce2
-
SSDEEP
1536:SFPheJllJSv/3d5sSLdfd7cKveVYU8wmwRZHicBsTqzd3NjRRGn:afcM
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 4004 msedge.exe 4004 msedge.exe 2944 msedge.exe 2944 msedge.exe 4000 identity_helper.exe 4000 identity_helper.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe 3320 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe 2944 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2944 wrote to memory of 680 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 680 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 3556 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 4004 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 4004 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 2528 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 2528 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 2528 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 2528 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 2528 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 2528 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 2528 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 2528 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 2528 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 2528 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 2528 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 2528 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 2528 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 2528 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 2528 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 2528 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 2528 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 2528 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 2528 2944 msedge.exe msedge.exe PID 2944 wrote to memory of 2528 2944 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\03c3ec4e996392b0dedb6def7c7446e8_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc114846f8,0x7ffc11484708,0x7ffc114847182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,15047219882760037949,12467508040318333961,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1948 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,15047219882760037949,12467508040318333961,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,15047219882760037949,12467508040318333961,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15047219882760037949,12467508040318333961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15047219882760037949,12467508040318333961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15047219882760037949,12467508040318333961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1940,15047219882760037949,12467508040318333961,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5344 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,15047219882760037949,12467508040318333961,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,15047219882760037949,12467508040318333961,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15047219882760037949,12467508040318333961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15047219882760037949,12467508040318333961,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15047219882760037949,12467508040318333961,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,15047219882760037949,12467508040318333961,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,15047219882760037949,12467508040318333961,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2920 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4a0 0x4c81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD51ac52e2503cc26baee4322f02f5b8d9c
SHA138e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA5127670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5b2a1398f937474c51a48b347387ee36a
SHA1922a8567f09e68a04233e84e5919043034635949
SHA2562dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA5124a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
260B
MD5d69b528f69496bc094886e36e343dc9f
SHA191da6e3e3ecf7f08e553057001ad91c9dd4ac79e
SHA2566814b03c22683dc3d15573e2ee1e327d2e661926c903494f60e27ea7a8606752
SHA5126a4cc655b057e1c289f8235a3d1208de62e65b5f037d5fb6c786c580509119f82b40fee17913e0671cdae0d8393a5bda8ebf26190b1cb1de15335e1da3a47981
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5fc2f299cd267202caa6ae1a9e7f771f2
SHA1f5bf725f338228ae32fd42dd65025097f79959a1
SHA256e64508590de919d5216ba614e220945b2b2a96b61f34d0fe0f88ac7952417614
SHA5123ce10196073be79d3000c5311a8ae172b03361cac33aef22ed08a2b8ced6a368310bc40fd19f014262fa4baf582e629ed32ac8d3c21caf66405700e7210d70ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD54f5d976e4e6d619b7e0e11813a579320
SHA1e8757c0fa9304d72d99c2220214a28b9b2dcd84b
SHA256a5f2dddace87f6905f064c9c2536cdb5c4ec6e80ef57fb3747d4dd44a279f49d
SHA512f0cef71732457825922c9302bee3a46ae6ddfcdd11042a4a2d22894cf5cd6f77683c2363b1acf0fed3ad2767573afbca04af303ae7a01638bee99aa79d53ffd8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD58aaddddbcddffd8e7340a0f282b0c8e5
SHA1b3c4296aa4f16389cde24804711360d988d81818
SHA2566c2f151c23b91d89da8ed45cf49fe118c06bfcbd28865a8f62771d84073d7573
SHA5123bd27de30c93e636f8157e7892b13bd91dbf09576b9fd1e53dce196c268833421f3983ad8bc524836147293361bb3fc559568b67b14b8ab4d4105cbca9f43a7f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD52f960e96ebb78b630162ee71719e5aa6
SHA1da57408d309e803df8979e05df6d20ac9e6b00e9
SHA25642a62114076491e79868ad23760a1f08604962853f67fc770464748171231f2b
SHA512ddb43571c99866239696fc23f42fdbf21f1538ed77e2afb27073a71028c1aa64ca2e612b6be56322387369b2c9a2c2c63477fd028e87b72c5f292021ac22a5e9
-
\??\pipe\LOCAL\crashpad_2944_CPWJNQKAOPAYLIJIMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e