Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 02:35
Static task
static1
Behavioral task
behavioral1
Sample
32486c7119bd88eeb83240721cb6fe45_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
32486c7119bd88eeb83240721cb6fe45_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
32486c7119bd88eeb83240721cb6fe45_JaffaCakes118.html
-
Size
158KB
-
MD5
32486c7119bd88eeb83240721cb6fe45
-
SHA1
07121db55d3b34d81d4742e4a259c3af2639fa1e
-
SHA256
6cb58e9483531ca04f7c77f354208bcccd7ea15caf13d21607a7bf6de6126bf5
-
SHA512
e208ffd7d832f7546bcb9e44541b94a30cc69261d143749ae072cf5ff4f55455487d0c59616dcf73c12caded042fb9ef251c17e1f76802941007e386da3bb0e6
-
SSDEEP
3072:S2/kac1ChcCdUyfkMY+BES09JXAnyrZalI+YQ:S2/kac1ChcCdZsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 5056 msedge.exe 5056 msedge.exe 1692 msedge.exe 1692 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe 4156 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1692 msedge.exe 1692 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe 1692 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1692 wrote to memory of 2976 1692 msedge.exe 82 PID 1692 wrote to memory of 2976 1692 msedge.exe 82 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 3432 1692 msedge.exe 83 PID 1692 wrote to memory of 5056 1692 msedge.exe 84 PID 1692 wrote to memory of 5056 1692 msedge.exe 84 PID 1692 wrote to memory of 4044 1692 msedge.exe 85 PID 1692 wrote to memory of 4044 1692 msedge.exe 85 PID 1692 wrote to memory of 4044 1692 msedge.exe 85 PID 1692 wrote to memory of 4044 1692 msedge.exe 85 PID 1692 wrote to memory of 4044 1692 msedge.exe 85 PID 1692 wrote to memory of 4044 1692 msedge.exe 85 PID 1692 wrote to memory of 4044 1692 msedge.exe 85 PID 1692 wrote to memory of 4044 1692 msedge.exe 85 PID 1692 wrote to memory of 4044 1692 msedge.exe 85 PID 1692 wrote to memory of 4044 1692 msedge.exe 85 PID 1692 wrote to memory of 4044 1692 msedge.exe 85 PID 1692 wrote to memory of 4044 1692 msedge.exe 85 PID 1692 wrote to memory of 4044 1692 msedge.exe 85 PID 1692 wrote to memory of 4044 1692 msedge.exe 85 PID 1692 wrote to memory of 4044 1692 msedge.exe 85 PID 1692 wrote to memory of 4044 1692 msedge.exe 85 PID 1692 wrote to memory of 4044 1692 msedge.exe 85 PID 1692 wrote to memory of 4044 1692 msedge.exe 85 PID 1692 wrote to memory of 4044 1692 msedge.exe 85 PID 1692 wrote to memory of 4044 1692 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\32486c7119bd88eeb83240721cb6fe45_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff850fe46f8,0x7ff850fe4708,0x7ff850fe47182⤵PID:2976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,16337353746646305733,16339979721957645720,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2304 /prefetch:22⤵PID:3432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2252,16337353746646305733,16339979721957645720,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:5056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2252,16337353746646305733,16339979721957645720,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:82⤵PID:4044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,16337353746646305733,16339979721957645720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:4568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,16337353746646305733,16339979721957645720,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:2076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,16337353746646305733,16339979721957645720,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3168 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4156
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3520
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3640
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
6KB
MD56947fe545480caf83a90804d24fcc3ac
SHA1a29837ec5b695db82ed411eb5b1bc0a52655fb0a
SHA2566c91c3d2f267a5a45f15d070e6f83bf6e34e1d5f79f683046c5ce82362070bda
SHA5129e6f2859a4fe90e5727b812a7a609a2f90bc269c084b6faf65453657ec99f5a8eaaa60200110416ad22b96acc426a68ec8e31301e25590daccd25bcedefb34cf
-
Filesize
6KB
MD5055604e9d9074077b408c826d5a88055
SHA190ff561daa6e58c227bad0addb54286ea06adb82
SHA256f7e69555bafc6d8f5a8fb3ef25c5adc3fb3fe3c945335e627c4a1910fb7ff39c
SHA5120b2152d0e5da205ec8eb4e9bfaa97e2830ec185c3848bc0689dad758381e6e3ad8ca9c6dcdb4b4d3251053e9ecccfd0bbbe284b9102d66036a8a84b848ba9f49
-
Filesize
11KB
MD57b3d76976509f42f1974329c02cb35a6
SHA1d8f6f45688f9c16bdcce4a54f0fc1c99c6e8887a
SHA256f4ff13ef75dda0730c18b5f7218a50eaf0a5b6d37da1e5d01218cb87617f3c28
SHA512a4bdd0d544aeb68099772930653fc52cedee14f34f08bde9a3cfc9675abc91272b2156770a332ee59d47d727f07b1b307518abc2301d8826561d8d7de156d69d