Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 09:13
Static task
static1
Behavioral task
behavioral1
Sample
33d7e1eaae789c11c97a28b44d8cf71e_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
33d7e1eaae789c11c97a28b44d8cf71e_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
33d7e1eaae789c11c97a28b44d8cf71e_JaffaCakes118.html
-
Size
56KB
-
MD5
33d7e1eaae789c11c97a28b44d8cf71e
-
SHA1
0a5cc50a4d2ecc7516591cb9b2d0432c2eebb66c
-
SHA256
cbbfa5ec5d183279905cdb9ced854aa11e057f16e3b00fbda46250449535314a
-
SHA512
3729caa61f758ee9d05e94b30c03c386d8a0bac5d005f2c45b8ced3d18c2c8db879d055a6e82d8850f43ba1ec8413535497aea3b2e7bf86bab74b853c1ba48d8
-
SSDEEP
768:wLscpHvvCIooV0mLLqSlvD7i4SRZAJXmqO/6fN+ggV3A:wLHv7oi0m/qSlL7i4SRZAw6fND
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1848 msedge.exe 1848 msedge.exe 1672 msedge.exe 1672 msedge.exe 3784 identity_helper.exe 3784 identity_helper.exe 1716 msedge.exe 1716 msedge.exe 1716 msedge.exe 1716 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe 1672 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1672 wrote to memory of 1780 1672 msedge.exe 82 PID 1672 wrote to memory of 1780 1672 msedge.exe 82 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 472 1672 msedge.exe 83 PID 1672 wrote to memory of 1848 1672 msedge.exe 84 PID 1672 wrote to memory of 1848 1672 msedge.exe 84 PID 1672 wrote to memory of 5032 1672 msedge.exe 85 PID 1672 wrote to memory of 5032 1672 msedge.exe 85 PID 1672 wrote to memory of 5032 1672 msedge.exe 85 PID 1672 wrote to memory of 5032 1672 msedge.exe 85 PID 1672 wrote to memory of 5032 1672 msedge.exe 85 PID 1672 wrote to memory of 5032 1672 msedge.exe 85 PID 1672 wrote to memory of 5032 1672 msedge.exe 85 PID 1672 wrote to memory of 5032 1672 msedge.exe 85 PID 1672 wrote to memory of 5032 1672 msedge.exe 85 PID 1672 wrote to memory of 5032 1672 msedge.exe 85 PID 1672 wrote to memory of 5032 1672 msedge.exe 85 PID 1672 wrote to memory of 5032 1672 msedge.exe 85 PID 1672 wrote to memory of 5032 1672 msedge.exe 85 PID 1672 wrote to memory of 5032 1672 msedge.exe 85 PID 1672 wrote to memory of 5032 1672 msedge.exe 85 PID 1672 wrote to memory of 5032 1672 msedge.exe 85 PID 1672 wrote to memory of 5032 1672 msedge.exe 85 PID 1672 wrote to memory of 5032 1672 msedge.exe 85 PID 1672 wrote to memory of 5032 1672 msedge.exe 85 PID 1672 wrote to memory of 5032 1672 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\33d7e1eaae789c11c97a28b44d8cf71e_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa94c146f8,0x7ffa94c14708,0x7ffa94c147182⤵PID:1780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,17587369385411829612,11375980881145280601,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:22⤵PID:472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,17587369385411829612,11375980881145280601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,17587369385411829612,11375980881145280601,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:82⤵PID:5032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17587369385411829612,11375980881145280601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17587369385411829612,11375980881145280601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:3208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17587369385411829612,11375980881145280601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:12⤵PID:1724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17587369385411829612,11375980881145280601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1324 /prefetch:12⤵PID:3852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17587369385411829612,11375980881145280601,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2256 /prefetch:12⤵PID:2360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,17587369385411829612,11375980881145280601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:82⤵PID:2120
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,17587369385411829612,11375980881145280601,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17587369385411829612,11375980881145280601,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:12⤵PID:1976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,17587369385411829612,11375980881145280601,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:12⤵PID:1000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,17587369385411829612,11375980881145280601,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3164 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1716
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1508
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2852
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54b4f91fa1b362ba5341ecb2836438dea
SHA19561f5aabed742404d455da735259a2c6781fa07
SHA256d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
-
Filesize
152B
MD5eaa3db555ab5bc0cb364826204aad3f0
SHA1a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize144B
MD5effd41f278eb5baa109e8d6e926f0d4b
SHA11313be8edcca48790345c5e752ee5f3b8996688f
SHA256c754941b3cb0be942d50ade1cc31ccf5b832ba151b9c20061a7e7693d89bc8bc
SHA51225c7e9e512ca1ec2d20a7d1be465653455c2dc00338bfe9dd954756dbee7b801647a301997d4d2537dd4bf14b901b30b2e1b8ab04a1a0968ddb3bc17f305dd8b
-
Filesize
1KB
MD5618678191b34b6816fc0d59dd8462a84
SHA1d9e93602433897c0307ed07da716465815504baa
SHA2560af0774186dedf152377d6b68866fcc93ae7550a5b19209869bc29bea37badd6
SHA512836a6504a200752790a0783b7229a2e8858b0bdd0328d4266c73d7eb944a6ae838e42875a69587662b00c30ddd831c04c6a41146a393d804cb0a564bc248b023
-
Filesize
6KB
MD56fb5fe15a0ec04f15b20d91ecdc6e38a
SHA10e2e573e8e6bfa120ba47a1241c042b429fdc06c
SHA256826abc4bbb6b5c6ac01862306d99a38e5f469a271b4291edd2098f6f69bd9a88
SHA51225787a44843eeffef0a8bef56e6f07ff65c071806899a34047822a8f1976152f45235dab2e469f571fa32aedca51fb6c5d48237367b222cceeb8ea4dff7dc968
-
Filesize
7KB
MD5cc9288bcd256b947bdf0ac4d539762a6
SHA18dae7021271f04911b382b23dd21971e291e60f5
SHA2566cac49b1222576cc97ee0c8fc47e993664854964ae58c190d2b173df8c2499d2
SHA51249aa21a0b36ac538ad0c573329438fa5d526668b7bda78970bacc122979be8dedd1bf95b1ee7d3c1e4eee72e8ace3c77299751530dc50db0c92702ac4bfa8159
-
Filesize
6KB
MD5853475b2276bc9d6a12a61df91d8a335
SHA115cea58bb13213df73182323d86616a0c80bb4ed
SHA2567e6bf200ddbd98a258c6117bd4c045e70ba74279bef3df2c8f00d0aa8c3555a1
SHA512c196a0ba79bb7a2f08a02cb342c1fd54e3d2db4d4f235c35e0a11c3f9b30030e54ce9a7d025f7aed0d93e04d1822c88c18c583fca202bc9c275738030295e0d0
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
11KB
MD5944fc3bf4b97cf624aac062b2440a36e
SHA11772d43024e89e7cebb925ba50d2b5da9b1fc6c6
SHA256960067fd0c90f6133a674f82375ad5ff6b4d6aad74e7adb37d4492ce14286843
SHA5127d3c41f78863ca35732ce3bc71eb158fb53f65bd23c858896cc4ca48dbeb86b4365f9e92e2e78e8395f0ec19b7161f06c593982663adaf2fcd10b1745d8d1ffc