Analysis
-
max time kernel
145s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29/04/2024, 00:10
Static task
static1
Behavioral task
behavioral1
Sample
0661a645e9a0984fa994023c078b8649_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0661a645e9a0984fa994023c078b8649_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
0661a645e9a0984fa994023c078b8649_JaffaCakes118.html
-
Size
163KB
-
MD5
0661a645e9a0984fa994023c078b8649
-
SHA1
121178c17956119c86b191812b30af9b9d7b72a2
-
SHA256
a6328185f90e88e985bef4e7a3eb861d36d3adcb5d88ba46aa627196f7e29af0
-
SHA512
b521ba0a10ed72c74ea2c165780c80c4d1da5f6ebd3980fba0d6335d18430601d37eb3c667445862e2f55b91f7073e8cf23a878607bbe2871dbd8888e5732b54
-
SSDEEP
3072:wUZNzyxYbVz8Ee39E/LTZP9kvYGJFtBCjNvGA:z3qErGJ8
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1064 msedge.exe 1064 msedge.exe 1160 msedge.exe 1160 msedge.exe 4352 identity_helper.exe 4352 identity_helper.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe 1708 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe 1160 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1160 wrote to memory of 2316 1160 msedge.exe 85 PID 1160 wrote to memory of 2316 1160 msedge.exe 85 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 3756 1160 msedge.exe 86 PID 1160 wrote to memory of 1064 1160 msedge.exe 87 PID 1160 wrote to memory of 1064 1160 msedge.exe 87 PID 1160 wrote to memory of 4444 1160 msedge.exe 88 PID 1160 wrote to memory of 4444 1160 msedge.exe 88 PID 1160 wrote to memory of 4444 1160 msedge.exe 88 PID 1160 wrote to memory of 4444 1160 msedge.exe 88 PID 1160 wrote to memory of 4444 1160 msedge.exe 88 PID 1160 wrote to memory of 4444 1160 msedge.exe 88 PID 1160 wrote to memory of 4444 1160 msedge.exe 88 PID 1160 wrote to memory of 4444 1160 msedge.exe 88 PID 1160 wrote to memory of 4444 1160 msedge.exe 88 PID 1160 wrote to memory of 4444 1160 msedge.exe 88 PID 1160 wrote to memory of 4444 1160 msedge.exe 88 PID 1160 wrote to memory of 4444 1160 msedge.exe 88 PID 1160 wrote to memory of 4444 1160 msedge.exe 88 PID 1160 wrote to memory of 4444 1160 msedge.exe 88 PID 1160 wrote to memory of 4444 1160 msedge.exe 88 PID 1160 wrote to memory of 4444 1160 msedge.exe 88 PID 1160 wrote to memory of 4444 1160 msedge.exe 88 PID 1160 wrote to memory of 4444 1160 msedge.exe 88 PID 1160 wrote to memory of 4444 1160 msedge.exe 88 PID 1160 wrote to memory of 4444 1160 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0661a645e9a0984fa994023c078b8649_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc923546f8,0x7ffc92354708,0x7ffc923547182⤵PID:2316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,7448688497545922682,5611100962368279875,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:22⤵PID:3756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,7448688497545922682,5611100962368279875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,7448688497545922682,5611100962368279875,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:82⤵PID:4444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7448688497545922682,5611100962368279875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:4624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7448688497545922682,5611100962368279875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:12⤵PID:1076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,7448688497545922682,5611100962368279875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:82⤵PID:4484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,7448688497545922682,5611100962368279875,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7448688497545922682,5611100962368279875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:12⤵PID:1268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7448688497545922682,5611100962368279875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4276 /prefetch:12⤵PID:2772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7448688497545922682,5611100962368279875,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵PID:5000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,7448688497545922682,5611100962368279875,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:12⤵PID:992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,7448688497545922682,5611100962368279875,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4368 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1708
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4384
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4988
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52a70f1bd4da893a67660d6432970788d
SHA1ddf4047e0d468f56ea0c0d8ff078a86a0bb62873
SHA256c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561
SHA51226b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343
-
Filesize
152B
MD5fbe1ce4d182aaffb80de94263be1dd35
SHA1bc6c9827aa35a136a7d79be9e606ff359e2ac3ea
SHA2560021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51
SHA5123fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f
-
Filesize
6KB
MD5275489106c0433ba3298f0a3d6885b31
SHA1ae91dbe4b10aafb42c2873eb3fce114b4471d6f9
SHA2564655ea48fb5ee778b92bcd159b1cc704f967983100711811cfc1fdcff84e273b
SHA5124df10c0fc170ead8ab923c05f16b1138b9009bfe524e80b75c40b936b0bfa062cc4041fa1601cb49dcabd3c3bb39c70eb5d5911b78dc93b4a4ea13cb703a66e5
-
Filesize
6KB
MD57a444f86283cd0d5adac1d0b569c3b78
SHA18063c477426835654e19f96d689477fb962ac82f
SHA256d4225fe22443a080d8de38ff26126e770ce430be80da1873909a0f5181b59fd8
SHA512401d4c9c176c0c0087ed0114894fcfe00c0d5c4b37b6b77b3abb8b9ee3f4b327c7a3070372c35311d004dd439abaf18008757b5d3f3108b178e0189021345c94
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD597ebe84f9c6a2c741bcdeafb28695713
SHA1a10c16ae79fd01d7a7e691d9146c9fc9b4051aad
SHA256f4a224a22e1d45f2303e282ed1f908c856626cd3276240dcca6a699badc83ca1
SHA512871976e411bc5533ea116a7d1c3619cda762f8afdc44d2bddbef6dc6ef5913eb234419cba72ec8e4b7c2a4c81c4a669e11fe15f5ddca0bcd8d007a9c654e07b4