Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
04-05-2024 18:18
Static task
static1
Behavioral task
behavioral1
Sample
13e9be4756aa037b5693dc6cc9a14be2_JaffaCakes118.html
Resource
win7-20240221-en
General
-
Target
13e9be4756aa037b5693dc6cc9a14be2_JaffaCakes118.html
-
Size
57KB
-
MD5
13e9be4756aa037b5693dc6cc9a14be2
-
SHA1
9d74ae6be1ad01f57ce20f4417abe47b2caff5c5
-
SHA256
c42eb4f9e30b38069a29763d36ce5aa5c0fe3b0a21920dd044c98ceee6521e3b
-
SHA512
7b43943ab021da6fb689e79129d968bb15d9f8979f372e7aaf0e5170387ce5461339180e2c6310adad58fd819b6af30a6b493164c0c3a797aa73366dbdbd4e4d
-
SSDEEP
768:pwhnUdWX7P3vsvgatGMRxAwymzrbj6biNgAE5Pn57i1yxtm0A64ySkaLcoXP:ddWX7jatGcAez3mbiNgA2PntoySx7XP
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2060 msedge.exe 2060 msedge.exe 4876 msedge.exe 4876 msedge.exe 400 identity_helper.exe 400 identity_helper.exe 5672 msedge.exe 5672 msedge.exe 5672 msedge.exe 5672 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe 4876 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4876 wrote to memory of 1588 4876 msedge.exe 85 PID 4876 wrote to memory of 1588 4876 msedge.exe 85 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2036 4876 msedge.exe 86 PID 4876 wrote to memory of 2060 4876 msedge.exe 87 PID 4876 wrote to memory of 2060 4876 msedge.exe 87 PID 4876 wrote to memory of 3500 4876 msedge.exe 88 PID 4876 wrote to memory of 3500 4876 msedge.exe 88 PID 4876 wrote to memory of 3500 4876 msedge.exe 88 PID 4876 wrote to memory of 3500 4876 msedge.exe 88 PID 4876 wrote to memory of 3500 4876 msedge.exe 88 PID 4876 wrote to memory of 3500 4876 msedge.exe 88 PID 4876 wrote to memory of 3500 4876 msedge.exe 88 PID 4876 wrote to memory of 3500 4876 msedge.exe 88 PID 4876 wrote to memory of 3500 4876 msedge.exe 88 PID 4876 wrote to memory of 3500 4876 msedge.exe 88 PID 4876 wrote to memory of 3500 4876 msedge.exe 88 PID 4876 wrote to memory of 3500 4876 msedge.exe 88 PID 4876 wrote to memory of 3500 4876 msedge.exe 88 PID 4876 wrote to memory of 3500 4876 msedge.exe 88 PID 4876 wrote to memory of 3500 4876 msedge.exe 88 PID 4876 wrote to memory of 3500 4876 msedge.exe 88 PID 4876 wrote to memory of 3500 4876 msedge.exe 88 PID 4876 wrote to memory of 3500 4876 msedge.exe 88 PID 4876 wrote to memory of 3500 4876 msedge.exe 88 PID 4876 wrote to memory of 3500 4876 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\13e9be4756aa037b5693dc6cc9a14be2_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcdea146f8,0x7ffcdea14708,0x7ffcdea147182⤵PID:1588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11323779290956489558,18204222987575064692,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:22⤵PID:2036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,11323779290956489558,18204222987575064692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,11323779290956489558,18204222987575064692,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:82⤵PID:3500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11323779290956489558,18204222987575064692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:1492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11323779290956489558,18204222987575064692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵PID:2776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11323779290956489558,18204222987575064692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:12⤵PID:3564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11323779290956489558,18204222987575064692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:82⤵PID:4676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11323779290956489558,18204222987575064692,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11323779290956489558,18204222987575064692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:12⤵PID:3876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11323779290956489558,18204222987575064692,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:12⤵PID:1064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11323779290956489558,18204222987575064692,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:12⤵PID:3800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11323779290956489558,18204222987575064692,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:12⤵PID:2924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11323779290956489558,18204222987575064692,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5672
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2332
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4500
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58b2290ca03b4ca5fe52d82550c7e7d69
SHA120583a7851a906444204ce8ba4fa51153e6cd494
SHA256f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2
SHA512704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d
-
Filesize
152B
MD5919c29d42fb6034fee2f5de14d573c63
SHA124a2e1042347b3853344157239bde3ed699047a8
SHA25617cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141
SHA512bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d
-
Filesize
515B
MD5d406b808db03486c92a1a59238b1e5b0
SHA1a06abab63f4139c38acae4c4321e8c1887bcad58
SHA25653f8cbcb57ccf678366099900cbf010017e5ef1e8fc7ca60d70c6f15eb774570
SHA512d3281d8e015fdcdd8808e586bffae6c63555eb27fdf1078c6d9dd52f804f34428a5880a0bcb37b82ebc110da6d91242775c54a53f8b0e2819fc46580537ec649
-
Filesize
5KB
MD5e380cc8cc05b5b93b3a75060a776bc19
SHA1d5972aefdc74bbfa7d4e2f9675ef2e0c53e0bf9d
SHA25682efa7799f3a2fd146dd42f8e85121816b3c8eb2f2dc722aaa17d3dac22137d1
SHA5122fbc2546d25bc60ad85f37804a1d98922fd78e546cd64c70f776baf5d7dd85ece05b381da34c165a94137ecd359136ab6c977d9255cfab4e97da7428caaa2d65
-
Filesize
6KB
MD53607e2f12d23207af05aa3a7bca4121a
SHA196708388ac5b58ad9f168c812c66c0120f7d8cb3
SHA25674ae9f324bc62f8bc88e403457c5cff8b025214892f46de07b49b55327d64906
SHA512edd0ed9da9fa80f8a65c1b954bd681195945e6a8e63cebbcabdd1e175155f7247e308e50418b3f0898564dfee235162824d865b623d6a51d909200d8642f33be
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5aea1f49f357c8243283b01e1968d0715
SHA1d32c1b0f9ed01c324583eb641481ca5d858c830c
SHA256982548f2e69a792768efe58c0b84a7b51b63f8a0147b3f81061371c822b1396d
SHA5120ae0c66f0a8b30f1eca62260c0c138490582f3c5580d12160693f7706dc4e531795812363d3df15eec62d892232a964c58d91b333232dc6e1a24e7a19cba86c6