Analysis
-
max time kernel
145s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2024 14:29
Static task
static1
Behavioral task
behavioral1
Sample
181aa7f96e9d3ab22aaae2124977eb3c_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
181aa7f96e9d3ab22aaae2124977eb3c_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
181aa7f96e9d3ab22aaae2124977eb3c_JaffaCakes118.html
-
Size
21KB
-
MD5
181aa7f96e9d3ab22aaae2124977eb3c
-
SHA1
2cfca8ae356a8609ec44660ef004516eb48032cc
-
SHA256
a0d1d472fd8057c221f1c102c2aa2344cb5769bc5e6f1a61649e6acb19a5bd5b
-
SHA512
373d02b251425f3ac7e5877db059f983226d110df0eeba079880ffdce5b90efb3297e8ead1c5c86bfafcf9e478e8f28c1cc16e018c2b69f37f15cebab4d4d99f
-
SSDEEP
384:e983KSZCV35ikoxnhiL0/eUxBGnASp4CMn9g6C9Piwoss6G/t0dFsuAquvb36X6W:eKq3EXxnhiL021T0xF0dFsuAquvb36Xn
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3704 msedge.exe 3704 msedge.exe 2300 msedge.exe 2300 msedge.exe 624 identity_helper.exe 624 identity_helper.exe 4676 msedge.exe 4676 msedge.exe 4676 msedge.exe 4676 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe 2300 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2300 wrote to memory of 1568 2300 msedge.exe 84 PID 2300 wrote to memory of 1568 2300 msedge.exe 84 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 1724 2300 msedge.exe 85 PID 2300 wrote to memory of 3704 2300 msedge.exe 86 PID 2300 wrote to memory of 3704 2300 msedge.exe 86 PID 2300 wrote to memory of 4532 2300 msedge.exe 87 PID 2300 wrote to memory of 4532 2300 msedge.exe 87 PID 2300 wrote to memory of 4532 2300 msedge.exe 87 PID 2300 wrote to memory of 4532 2300 msedge.exe 87 PID 2300 wrote to memory of 4532 2300 msedge.exe 87 PID 2300 wrote to memory of 4532 2300 msedge.exe 87 PID 2300 wrote to memory of 4532 2300 msedge.exe 87 PID 2300 wrote to memory of 4532 2300 msedge.exe 87 PID 2300 wrote to memory of 4532 2300 msedge.exe 87 PID 2300 wrote to memory of 4532 2300 msedge.exe 87 PID 2300 wrote to memory of 4532 2300 msedge.exe 87 PID 2300 wrote to memory of 4532 2300 msedge.exe 87 PID 2300 wrote to memory of 4532 2300 msedge.exe 87 PID 2300 wrote to memory of 4532 2300 msedge.exe 87 PID 2300 wrote to memory of 4532 2300 msedge.exe 87 PID 2300 wrote to memory of 4532 2300 msedge.exe 87 PID 2300 wrote to memory of 4532 2300 msedge.exe 87 PID 2300 wrote to memory of 4532 2300 msedge.exe 87 PID 2300 wrote to memory of 4532 2300 msedge.exe 87 PID 2300 wrote to memory of 4532 2300 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\181aa7f96e9d3ab22aaae2124977eb3c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca21f46f8,0x7ffca21f4708,0x7ffca21f47182⤵PID:1568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,855523570176453110,36453535320769801,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:22⤵PID:1724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,855523570176453110,36453535320769801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,855523570176453110,36453535320769801,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:82⤵PID:4532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,855523570176453110,36453535320769801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵PID:4448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,855523570176453110,36453535320769801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:1452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,855523570176453110,36453535320769801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:82⤵PID:3076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,855523570176453110,36453535320769801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,855523570176453110,36453535320769801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:12⤵PID:3532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,855523570176453110,36453535320769801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:12⤵PID:1924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,855523570176453110,36453535320769801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,855523570176453110,36453535320769801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:12⤵PID:3236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,855523570176453110,36453535320769801,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4676
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3076
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1624
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD58b2290ca03b4ca5fe52d82550c7e7d69
SHA120583a7851a906444204ce8ba4fa51153e6cd494
SHA256f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2
SHA512704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d
-
Filesize
152B
MD5919c29d42fb6034fee2f5de14d573c63
SHA124a2e1042347b3853344157239bde3ed699047a8
SHA25617cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141
SHA512bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\50efd410-385b-4a4a-b161-c0e72e4054f6.tmp
Filesize5KB
MD54dcc4d4d326b1ac0c3e0c2f4e98edf82
SHA131048e2378a909d87ef8b1f173b61bc5a7bcda33
SHA2563b0790a899ff52a08c292147bd43e4ac246b8d4b7ab8c2f5a82814c92c30759f
SHA5122c43d19bfadd338099c527f8fb478662503d05c2450be481b5be041f24cef4da12c2a96cee2f3daadd310751634d5f38a355bbb8c9bddf36b0acd755a385990c
-
Filesize
6KB
MD5078656fdf866149fcadf8a35ad8395a5
SHA195ef9e8dfc8a6b24697883cc4ef4978dfa7ed690
SHA256b8b4c5a32502c09421b50b411116717b9f88192fc097b0a1cc0c8ac80d3c89e3
SHA51202f251e4b97bee2f564d51d17e929c762befa1e27837af75eb2e053712d82a52656cd60a1074affa80ef8c9a870f8a791b05b6a4e39d13844136b442804596e4
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD559b196c24a660ca3d266c9f728ddf562
SHA119fbd3a538c983b375b5876aff33a5bf7e792590
SHA2563db792debb2a0bf5502353037f4da31b472eb7de3af7800912926ceb662b3dbb
SHA51216538aec9c32ee526a61d4432708aeff8dddde0a120f22789882da8927056e0ab0f7ade9a03a020b537e2d72837ac32a3a3091b6fbea25878de435b24fda8c70