Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 18:57
Static task
static1
Behavioral task
behavioral1
Sample
2b6a495bffec84d7b27ef8a8deef4a06_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2b6a495bffec84d7b27ef8a8deef4a06_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2b6a495bffec84d7b27ef8a8deef4a06_JaffaCakes118.html
-
Size
36KB
-
MD5
2b6a495bffec84d7b27ef8a8deef4a06
-
SHA1
265ed866cacc395a7b22cb7371f3758d2c941ca0
-
SHA256
36fcd6484ff90e306371fed7cc420400f5c48b2d3345c047816e3991b59170b6
-
SHA512
ac336d8b28291b5ee3efb8476be24ece941bc91cdc669f943eb277eefbc56d88a5f0a60e181ee479eb86504d33eb186c234e64b1e688af778b19b9ff945597e4
-
SSDEEP
768:zwx/MDTHoy88hAR+ZPXVE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TBZOh6DJtxo6qLH:Q/jbJxNVHuxSs/I8FK
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1680 msedge.exe 1680 msedge.exe 1996 msedge.exe 1996 msedge.exe 5052 identity_helper.exe 5052 identity_helper.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe 3248 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe 1996 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1996 wrote to memory of 3636 1996 msedge.exe 81 PID 1996 wrote to memory of 3636 1996 msedge.exe 81 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1728 1996 msedge.exe 82 PID 1996 wrote to memory of 1680 1996 msedge.exe 83 PID 1996 wrote to memory of 1680 1996 msedge.exe 83 PID 1996 wrote to memory of 1188 1996 msedge.exe 84 PID 1996 wrote to memory of 1188 1996 msedge.exe 84 PID 1996 wrote to memory of 1188 1996 msedge.exe 84 PID 1996 wrote to memory of 1188 1996 msedge.exe 84 PID 1996 wrote to memory of 1188 1996 msedge.exe 84 PID 1996 wrote to memory of 1188 1996 msedge.exe 84 PID 1996 wrote to memory of 1188 1996 msedge.exe 84 PID 1996 wrote to memory of 1188 1996 msedge.exe 84 PID 1996 wrote to memory of 1188 1996 msedge.exe 84 PID 1996 wrote to memory of 1188 1996 msedge.exe 84 PID 1996 wrote to memory of 1188 1996 msedge.exe 84 PID 1996 wrote to memory of 1188 1996 msedge.exe 84 PID 1996 wrote to memory of 1188 1996 msedge.exe 84 PID 1996 wrote to memory of 1188 1996 msedge.exe 84 PID 1996 wrote to memory of 1188 1996 msedge.exe 84 PID 1996 wrote to memory of 1188 1996 msedge.exe 84 PID 1996 wrote to memory of 1188 1996 msedge.exe 84 PID 1996 wrote to memory of 1188 1996 msedge.exe 84 PID 1996 wrote to memory of 1188 1996 msedge.exe 84 PID 1996 wrote to memory of 1188 1996 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2b6a495bffec84d7b27ef8a8deef4a06_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9572946f8,0x7ff957294708,0x7ff9572947182⤵PID:3636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,10461319554537150104,2920126273008716662,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:22⤵PID:1728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,10461319554537150104,2920126273008716662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,10461319554537150104,2920126273008716662,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:82⤵PID:1188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,10461319554537150104,2920126273008716662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:3732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,10461319554537150104,2920126273008716662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵PID:4804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,10461319554537150104,2920126273008716662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:82⤵PID:2920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,10461319554537150104,2920126273008716662,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,10461319554537150104,2920126273008716662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:12⤵PID:4356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,10461319554537150104,2920126273008716662,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:12⤵PID:3328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,10461319554537150104,2920126273008716662,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:3384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,10461319554537150104,2920126273008716662,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:12⤵PID:5060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,10461319554537150104,2920126273008716662,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=212 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3248
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2704
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
613B
MD55c4adefecffcf207d968c327cf498a26
SHA13e88d8bd0659db83577f4b57ed02e329328a11e5
SHA256a101657389ce283c104dfd96c4868d30ae5dd0e6ba4cd554fdbb10b512efe849
SHA5126b956993d960aef99ecd2c3f106dfe1902d6efbb88070935d88a855a5bb5a393325965b1adf5fbe492a52786ec1a7072fbb0536092fc406fab2b6e07121d55cf
-
Filesize
6KB
MD5467b0d3180e9c37926c155f05dc7d484
SHA16014cb55a9412b482c26be880dd1f062e3b4413d
SHA2565e81cddbea0f5734dbe8732538a72c25beab8ea7defa8e85b50f73f270a9ecfb
SHA512a58cb63fbf67a12a75198b2a36aa3eb80b15e42151fdb873c32b0a55dbdaab83ed8b62984b6f4f325be719cd4dfd94918c53fd64a275b407ac6d1d1b14221b1e
-
Filesize
6KB
MD525738e63b5f7a216f89dad64344d4dd1
SHA14946ebac81ae67eaaf899e4fb6747fb5518ba446
SHA2560554de8746cb72cb372936e2d955ea3cc0bcb2f5b094ce21ab54609eccf49bcc
SHA5128af21574a61fbe446645d6dc8d1a44db1cd31843e5afcd62b57fed1b1c22ead6bb72498626b679843c3f9461b823590ded23bbcab6ecb1ac524540f81fdafdad
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD5c8b020800ff0e0bd6261f85476d185bc
SHA1d9193029aeb28179363b2b7edf217ac74f4308d5
SHA2567a2856c9188f851458d7571c0cf7743668e9f409ba86db6ddd114847c2c4e01c
SHA5121ec7840041bed3c7395fe62182ff2745612b3c59c71dbb53a8d592d3b8d3e75ce8a21238925050f8c502fed01f3660a91d64e6d6d5e57a0f0e94f0c31269c502