Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27/04/2024, 12:01
Static task
static1
Behavioral task
behavioral1
Sample
0333fade9df6ce37b2f76ad9bb31d4d2_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0333fade9df6ce37b2f76ad9bb31d4d2_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0333fade9df6ce37b2f76ad9bb31d4d2_JaffaCakes118.html
-
Size
40KB
-
MD5
0333fade9df6ce37b2f76ad9bb31d4d2
-
SHA1
b923e07ff7f05a6da3c0a7ce8f0d7851213cab11
-
SHA256
5bc4bd9e340b6b9970e8556103e87acc0bef29dfad64c3017815b5342460e8cb
-
SHA512
a2740f738f882b39b25eb0e61989f610665cafcfe3042590dcd393afc4da6280cf2f99c4a2a625109c1491b8e79d7be582f3b0aece19211ee0199da1a2da0dca
-
SSDEEP
384:AEE6HLhh5bOb41vSVYFRyr1hsRx8Sx+tLpyLJHm0qINzGal0voz6+moxhCYWn/yu:zr75A+Rx8Sx+Z00aqBnqu
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4400 msedge.exe 4400 msedge.exe 3440 msedge.exe 3440 msedge.exe 1992 identity_helper.exe 1992 identity_helper.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe 2052 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe 3440 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3440 wrote to memory of 4172 3440 msedge.exe 84 PID 3440 wrote to memory of 4172 3440 msedge.exe 84 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 1752 3440 msedge.exe 85 PID 3440 wrote to memory of 4400 3440 msedge.exe 86 PID 3440 wrote to memory of 4400 3440 msedge.exe 86 PID 3440 wrote to memory of 400 3440 msedge.exe 87 PID 3440 wrote to memory of 400 3440 msedge.exe 87 PID 3440 wrote to memory of 400 3440 msedge.exe 87 PID 3440 wrote to memory of 400 3440 msedge.exe 87 PID 3440 wrote to memory of 400 3440 msedge.exe 87 PID 3440 wrote to memory of 400 3440 msedge.exe 87 PID 3440 wrote to memory of 400 3440 msedge.exe 87 PID 3440 wrote to memory of 400 3440 msedge.exe 87 PID 3440 wrote to memory of 400 3440 msedge.exe 87 PID 3440 wrote to memory of 400 3440 msedge.exe 87 PID 3440 wrote to memory of 400 3440 msedge.exe 87 PID 3440 wrote to memory of 400 3440 msedge.exe 87 PID 3440 wrote to memory of 400 3440 msedge.exe 87 PID 3440 wrote to memory of 400 3440 msedge.exe 87 PID 3440 wrote to memory of 400 3440 msedge.exe 87 PID 3440 wrote to memory of 400 3440 msedge.exe 87 PID 3440 wrote to memory of 400 3440 msedge.exe 87 PID 3440 wrote to memory of 400 3440 msedge.exe 87 PID 3440 wrote to memory of 400 3440 msedge.exe 87 PID 3440 wrote to memory of 400 3440 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0333fade9df6ce37b2f76ad9bb31d4d2_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ff891b046f8,0x7ff891b04708,0x7ff891b047182⤵PID:4172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,1930315704631496082,15313479193567973858,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:1752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,1930315704631496082,15313479193567973858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,1930315704631496082,15313479193567973858,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1930315704631496082,15313479193567973858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1930315704631496082,15313479193567973858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:3024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1930315704631496082,15313479193567973858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 /prefetch:82⤵PID:3252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1930315704631496082,15313479193567973858,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1930315704631496082,15313479193567973858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:12⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1930315704631496082,15313479193567973858,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:12⤵PID:1244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1930315704631496082,15313479193567973858,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:12⤵PID:4960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1930315704631496082,15313479193567973858,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:12⤵PID:4920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,1930315704631496082,15313479193567973858,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4376 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2052
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:804
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2120
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54e96ed67859d0bafd47d805a71041f49
SHA17806c54ae29a6c8d01dcbc78e5525ddde321b16b
SHA256bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d
SHA512432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7
-
Filesize
152B
MD51cbd0e9a14155b7f5d4f542d09a83153
SHA127a442a921921d69743a8e4b76ff0b66016c4b76
SHA256243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c
SHA51217e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d
-
Filesize
6KB
MD5a6dcdec1bccb87750ddce42d0cb76d70
SHA137d906272c518de06a4197f84f0fdb01bca81cf9
SHA256cd5f601f1e9b19a4569e88eefed53027f712abdabfcff8febf6c69a71619183f
SHA512bdb0aad52d7590a15fe1a54c7b1e230007434b52984ad51d229a8da28d53ec07a1145787ac3a4cc07469244a7077f8af4cf2b32b08499d2643c17ce8788651ed
-
Filesize
6KB
MD5e4a98a9cc6a70159c72e559700f55a6b
SHA16eeebc1c1f219b835e37fa660f2fd20de3857ae8
SHA256a44aac647d2657d56844fe8a478be7fcaf7d3ad9772df920da903ccdfaf9f46f
SHA5122765ea5b6df3f3a6a6a84a558a1715d3bce303b22ebcd4c23137d94fa62edfb96b033803264d6d37dbaa690501a7b85e4fb94595f9a1e22a39af945d911a7327
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD5965272c6bde4b5ce8f93fcff036c2605
SHA161cf5dff04747f4f25cf81dec771dd87e4746f3c
SHA256ab36c3823e70eefac699381b583e2dac5f8a6a88e4893347eaf57c4e5f9a7b72
SHA51252d141973b6ab53efe2423aeb76530f83b3268a9caa7c622c2dce83c27bef0471380090cc84cb608bea9dd664f21c132b93fbec6c6490b25042d346e893063db