Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 22:28
Static task
static1
Behavioral task
behavioral1
Sample
03c44e798dfbf11120dc933aedf9397e_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
03c44e798dfbf11120dc933aedf9397e_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
03c44e798dfbf11120dc933aedf9397e_JaffaCakes118.html
-
Size
110KB
-
MD5
03c44e798dfbf11120dc933aedf9397e
-
SHA1
3fefdcd5df152a690e252394209de1397037797c
-
SHA256
f17a1ee2027c52d5af9d79d9cbd456cdc18de64a84be1812ca06ba47e464be50
-
SHA512
73f9fc4d8b5fc563a423bbb49adef63f423ecd4efa3c585e9f8cfa924f9cae88156e6cec07504819ca3b6f670089010c1ffe1112d1ca11a285e3d7d1d6329269
-
SSDEEP
1536:23q5TuwnhIdj9NPr63dmLoU6r7rKdGVrs+0wKMlq61NUM7VeB2JnuJOzJMFO:23qzIdjKrrKdGVN0nMlq61NUeVmEMFO
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1404 msedge.exe 1404 msedge.exe 1692 msedge.exe 1692 msedge.exe 4496 identity_helper.exe 4496 identity_helper.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe 768 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1692 wrote to memory of 4524 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 4524 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 3840 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1404 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1404 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1496 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1496 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1496 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1496 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1496 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1496 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1496 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1496 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1496 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1496 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1496 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1496 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1496 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1496 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1496 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1496 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1496 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1496 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1496 1692 msedge.exe msedge.exe PID 1692 wrote to memory of 1496 1692 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\03c44e798dfbf11120dc933aedf9397e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd1a0546f8,0x7ffd1a054708,0x7ffd1a0547182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,18185279905347726417,5688712165556931655,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,18185279905347726417,5688712165556931655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,18185279905347726417,5688712165556931655,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18185279905347726417,5688712165556931655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18185279905347726417,5688712165556931655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18185279905347726417,5688712165556931655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4376 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,18185279905347726417,5688712165556931655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,18185279905347726417,5688712165556931655,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18185279905347726417,5688712165556931655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18185279905347726417,5688712165556931655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18185279905347726417,5688712165556931655,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4372 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,18185279905347726417,5688712165556931655,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4364 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,18185279905347726417,5688712165556931655,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4448 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD52a70f1bd4da893a67660d6432970788d
SHA1ddf4047e0d468f56ea0c0d8ff078a86a0bb62873
SHA256c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561
SHA51226b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5fbe1ce4d182aaffb80de94263be1dd35
SHA1bc6c9827aa35a136a7d79be9e606ff359e2ac3ea
SHA2560021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51
SHA5123fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD584b29d344472d88d43afcaebb22b6054
SHA18a156e675545d521cbb6b60232c1bd642d58204b
SHA2564b9e071d664cb2a73ad96d017108883196612a033f2719bc0e54808ea22986a2
SHA512c3f510a9f4f2b81d1efe5d0d48d19450c84e4bf683962cbe7e2dcb9dd3eca246ff212bef2dba09c2e5994dfffdb0ac305f65dd6fd86ab532bd2e8f1b5ccc1ac1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD51a36be809d91ec1f914a2f2843c3367c
SHA161a4bc5058f200f577aa9c4a4117d222e2971f94
SHA2563fee2fbc477db55a8aedbdae4006a6278face8be219ad00d78fe0d8a51222760
SHA51212f787d4dcad7759362190f68886e55d8a102f0586ac129301bc766b3c72de3906cd04c85957670340b341014f8c7c2076e2dc64cc3733c5db6ca707c3c62b38
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
8KB
MD5c5ca8b4740576467b24e91147ae29a6e
SHA15888282edfb8ff5fc35718616ece686dc4f2ac81
SHA25617ac3ac9ede5e7e5fe805c45ee3e8ce9e9cebba4f2c0c19e99f4f74ed74cae7e
SHA512d5f43bffcede4a5f1671a028d055633233b91a98bed525685df3d48eac10f9e325be1b820b578e98f18ad5c9967104e8fb5f94f3dda2e04f3232e650cdbd4413
-
\??\pipe\LOCAL\crashpad_1692_LFVUTVFLDQTRTJUSMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e