Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 07:08
Static task
static1
Behavioral task
behavioral1
Sample
2df13d71e451915056b9536bd91ef61e_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2df13d71e451915056b9536bd91ef61e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
2df13d71e451915056b9536bd91ef61e_JaffaCakes118.html
-
Size
36KB
-
MD5
2df13d71e451915056b9536bd91ef61e
-
SHA1
9aa0ec97ee2b1f424a13c24538df549f174759b0
-
SHA256
8ec9c1b17327cbdb1628735f5fe7696395620564d8b7fb30092b534e53cc0642
-
SHA512
d57c49f39a850b34f2b66c90102c5b2c48658afb9893eb943281e454d862ce8fb14461b5884e8f1e8fc9b7d4dc15f61a0b405a3cd0b0461c46339928ae77d5b7
-
SSDEEP
768:zwx/MDTHpx88hARSZPXVE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6ThZOg6f9U56lLRX:Q//bJxNVNufSM/P8mK
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3968 msedge.exe 3968 msedge.exe 3608 msedge.exe 3608 msedge.exe 4224 identity_helper.exe 4224 identity_helper.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe 4240 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe 3608 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3608 wrote to memory of 3048 3608 msedge.exe 81 PID 3608 wrote to memory of 3048 3608 msedge.exe 81 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3908 3608 msedge.exe 83 PID 3608 wrote to memory of 3968 3608 msedge.exe 84 PID 3608 wrote to memory of 3968 3608 msedge.exe 84 PID 3608 wrote to memory of 1680 3608 msedge.exe 85 PID 3608 wrote to memory of 1680 3608 msedge.exe 85 PID 3608 wrote to memory of 1680 3608 msedge.exe 85 PID 3608 wrote to memory of 1680 3608 msedge.exe 85 PID 3608 wrote to memory of 1680 3608 msedge.exe 85 PID 3608 wrote to memory of 1680 3608 msedge.exe 85 PID 3608 wrote to memory of 1680 3608 msedge.exe 85 PID 3608 wrote to memory of 1680 3608 msedge.exe 85 PID 3608 wrote to memory of 1680 3608 msedge.exe 85 PID 3608 wrote to memory of 1680 3608 msedge.exe 85 PID 3608 wrote to memory of 1680 3608 msedge.exe 85 PID 3608 wrote to memory of 1680 3608 msedge.exe 85 PID 3608 wrote to memory of 1680 3608 msedge.exe 85 PID 3608 wrote to memory of 1680 3608 msedge.exe 85 PID 3608 wrote to memory of 1680 3608 msedge.exe 85 PID 3608 wrote to memory of 1680 3608 msedge.exe 85 PID 3608 wrote to memory of 1680 3608 msedge.exe 85 PID 3608 wrote to memory of 1680 3608 msedge.exe 85 PID 3608 wrote to memory of 1680 3608 msedge.exe 85 PID 3608 wrote to memory of 1680 3608 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2df13d71e451915056b9536bd91ef61e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcaaf146f8,0x7ffcaaf14708,0x7ffcaaf147182⤵PID:3048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,543754328664066083,16189789512698337713,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:3908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,543754328664066083,16189789512698337713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3968
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,543754328664066083,16189789512698337713,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:82⤵PID:1680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,543754328664066083,16189789512698337713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:2800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,543754328664066083,16189789512698337713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:4728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,543754328664066083,16189789512698337713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:82⤵PID:1580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,543754328664066083,16189789512698337713,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,543754328664066083,16189789512698337713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:12⤵PID:532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,543754328664066083,16189789512698337713,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:12⤵PID:8
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,543754328664066083,16189789512698337713,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:12⤵PID:1420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,543754328664066083,16189789512698337713,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:12⤵PID:3448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,543754328664066083,16189789512698337713,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5796 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4240
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4920
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
614B
MD5c2c9d0e333e08d81494f45e8838768d6
SHA103dafd6f314ac72b6724fbb8b76f6791ff5d9751
SHA256357ee9a5615036a51466b78ebefd34b478d0c48546ce8eb1445081675ec15f7f
SHA5123813e6b109b3d4eaf8578ffeff4a00132067bb42e878d19a62202f4f3fb1445aebaa747d11d4a5d3e30093763c645833ecad2104506857620680738b93e4ad4c
-
Filesize
6KB
MD5bc36b714726c231d85987548487c781c
SHA1554909cf886eb8b6b49a2f0cdb2bc048cb9a76e2
SHA25648b76862d5a7c17d6121f63695decf0837836f4b4696902d040d4184f01bedf6
SHA512b6243a5349d8e6e7400550a5364e2c03a45c6bebe8d2d41180cd87b45b63d41a28e603fc57e7f1085c5b32acfeea62b577fd2ec247b46b0f885702bf778f3af8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aaf5649d-6006-4b5d-b33a-cfb62eccc0fb.tmp
Filesize6KB
MD5c4b274b6e2dd80c2d9dc4a9864d92f80
SHA13490da362d2a4cab3a4c2d2c9e964f6abca11b3b
SHA2563623570f52c941f226a65c134fffd2e2fdbafbd79b1fbae7a0b5a9babc4f0da6
SHA512d40af708f12a4184d920516c17d8bd100050b6d2fec8ae568281ff2aeb258f464025a6346a19764b7a593c8fa42ad4a428b81c3d3161dc25be20417875068c52
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD5b391c75a8a7bcdf6de94c97bf0fd4894
SHA119da3fd65b460f2d94adc1b81e777cb641591cc0
SHA256dc15ce496eda43f351d6b3c329805d2deae09c000b5350d02b8dbffab82fa759
SHA512501918d438ae0e20dfd9e93a47dfda787c7b8519c8fbe3e441d6946d84d253ccdfb432470161c79e6bdcbd66fc7a8d4d15ad3cca0ed23bb2586cf5a657a301f9