Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
08/05/2024, 10:46
Static task
static1
Behavioral task
behavioral1
Sample
247d6d75ce54a74c46fb22dea75c34cd_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
247d6d75ce54a74c46fb22dea75c34cd_JaffaCakes118.html
Resource
win10v2004-20240419-en
General
-
Target
247d6d75ce54a74c46fb22dea75c34cd_JaffaCakes118.html
-
Size
73KB
-
MD5
247d6d75ce54a74c46fb22dea75c34cd
-
SHA1
2945611b962212e5ecc341387eab6e111bb840c3
-
SHA256
979dc04c55e177d8dde05c8cdb356455f108bbf1a244c6172b93c58d9c8f4fbf
-
SHA512
44a4c7873360e0a90c77def05132969fa59af608454de4822984f09e34a9d75e8e59dc224576746595fef809c180481fbb0e780bd9751668981c38c801d04cf0
-
SSDEEP
1536:9ih+8AvjGiFD40NbCHrCeMA2MJGi4hjvUDDxaQqKTVA:9uLArGiFD7NbCHrCe8MsiQxKTVA
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4920 msedge.exe 4920 msedge.exe 2900 msedge.exe 2900 msedge.exe 4384 identity_helper.exe 4384 identity_helper.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe 2900 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2900 wrote to memory of 4132 2900 msedge.exe 84 PID 2900 wrote to memory of 4132 2900 msedge.exe 84 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4556 2900 msedge.exe 85 PID 2900 wrote to memory of 4920 2900 msedge.exe 86 PID 2900 wrote to memory of 4920 2900 msedge.exe 86 PID 2900 wrote to memory of 1820 2900 msedge.exe 87 PID 2900 wrote to memory of 1820 2900 msedge.exe 87 PID 2900 wrote to memory of 1820 2900 msedge.exe 87 PID 2900 wrote to memory of 1820 2900 msedge.exe 87 PID 2900 wrote to memory of 1820 2900 msedge.exe 87 PID 2900 wrote to memory of 1820 2900 msedge.exe 87 PID 2900 wrote to memory of 1820 2900 msedge.exe 87 PID 2900 wrote to memory of 1820 2900 msedge.exe 87 PID 2900 wrote to memory of 1820 2900 msedge.exe 87 PID 2900 wrote to memory of 1820 2900 msedge.exe 87 PID 2900 wrote to memory of 1820 2900 msedge.exe 87 PID 2900 wrote to memory of 1820 2900 msedge.exe 87 PID 2900 wrote to memory of 1820 2900 msedge.exe 87 PID 2900 wrote to memory of 1820 2900 msedge.exe 87 PID 2900 wrote to memory of 1820 2900 msedge.exe 87 PID 2900 wrote to memory of 1820 2900 msedge.exe 87 PID 2900 wrote to memory of 1820 2900 msedge.exe 87 PID 2900 wrote to memory of 1820 2900 msedge.exe 87 PID 2900 wrote to memory of 1820 2900 msedge.exe 87 PID 2900 wrote to memory of 1820 2900 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\247d6d75ce54a74c46fb22dea75c34cd_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff826a846f8,0x7ff826a84708,0x7ff826a847182⤵PID:4132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,6794982430325811523,11566927051797550329,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 /prefetch:22⤵PID:4556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,6794982430325811523,11566927051797550329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,6794982430325811523,11566927051797550329,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:82⤵PID:1820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6794982430325811523,11566927051797550329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:4380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6794982430325811523,11566927051797550329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:2364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6794982430325811523,11566927051797550329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:12⤵PID:636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6794982430325811523,11566927051797550329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:12⤵PID:4576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6794982430325811523,11566927051797550329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:12⤵PID:2496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,6794982430325811523,11566927051797550329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1336 /prefetch:82⤵PID:4972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,6794982430325811523,11566927051797550329,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1336 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6794982430325811523,11566927051797550329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:12⤵PID:2196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6794982430325811523,11566927051797550329,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:12⤵PID:4328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6794982430325811523,11566927051797550329,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:12⤵PID:780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,6794982430325811523,11566927051797550329,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:12⤵PID:4828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,6794982430325811523,11566927051797550329,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5500 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3248
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1056
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52a70f1bd4da893a67660d6432970788d
SHA1ddf4047e0d468f56ea0c0d8ff078a86a0bb62873
SHA256c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561
SHA51226b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343
-
Filesize
152B
MD5fbe1ce4d182aaffb80de94263be1dd35
SHA1bc6c9827aa35a136a7d79be9e606ff359e2ac3ea
SHA2560021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51
SHA5123fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\89187cf4-afff-411d-8310-6160fd835e39.tmp
Filesize6KB
MD50baf47d39ed9cc2ce7cfb38e9551d98d
SHA16893d325ee74b68adbcdeb800a876b9a601d35d1
SHA25626ab9450ffbc72dd43fe0b80c92ae454f6f2b122fb529b5795ff67b3a82c49d6
SHA51295faea9bacfc45ca3ffc73c0f12eaf15a790a852c3f18310b261a590059aa307ae0077626cf749bce21e0cb52d00ce21472a9bdc6fa6a4fcf8868f357ffafc0c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD5c8b8009dc1c0b0142450005f211eb9db
SHA13cf56b15e747fb7fbb097574a41288aac3eb5c87
SHA256685e9e4696e3bcb4efeef8e751ba85c72af2a646c29570c226940ad19a0819bc
SHA5123eaced71aa6ccc0a2029a3f834b244d662616031973078aa25479f6fe986c92e216c7228e80668723dc0d50956ce8aa7849d3b859a1ce92afe17a2d5a91eea34
-
Filesize
1KB
MD5d11265f0b5f4c4f671da2520756bf951
SHA1d156dea3af69d5feb13cf979723c95214aef06ac
SHA25615d2fe3c764793a86698f2021d726d08e642ed2895fb703a5e6ddce8f23ed896
SHA512b08a342c931947d5a7559f98da60b3058518b57875d6f625bd17694aaf64879b1571ae32e72af9eb17ee66782f2c153a609cbc21bc549b661ac22afd8eb7cd19
-
Filesize
5KB
MD57a5420c8808a64baf49df01d2f330269
SHA1f7ae8160c409599e4bd7bff1b2fe870f8567e8f1
SHA2568806a5f6c4a40bc17f50653af6af3a409e6ea5370f724a67556669065d459da8
SHA5128c6d7892d2f2f5e45df7406275e1dd4263a4b7563d86c835b4eb1827443ff87fe4b4f65ddb4c34954447adaefce23026e951a2baf257ac7311f09b5a9f7dafbf
-
Filesize
7KB
MD5c31da08ae6d136e2ef8d581686e78c4c
SHA1b880a38d6952118c66b669518cd3a9bc1a0d7c98
SHA25655414a59f97374e2587ec703088b9e4078b52d4f8bae9fcf9289494b5f77fbaf
SHA5121ecca37741692e125633a62e49a08e947efd75810c591a82fe3ea654395bebb05d4fb00e01350256ccf80429f48d50283f8c638ce170169746d23e662a9217e4
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5edaf2ef18313a2d96b270e9ba4375f8c
SHA11324b5febcbdc5f799bfd4a83039af094879dde7
SHA25674e484509cdb41d617901af740e009678c4be4e9b824857bfe6f90f9050541bf
SHA512b9fec81039163f38b8899f0f4f00c15908a248c3a3f967ba4425ab40aa472b43d2fa82ff79a8f7b59aa291c9ea14cad4865b4d090b2eaea7b597582e78bc66db