Analysis
-
max time kernel
145s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2024 14:52
Static task
static1
Behavioral task
behavioral1
Sample
41e5b8e93b930deef6e6a3fe22e63aee_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
41e5b8e93b930deef6e6a3fe22e63aee_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
41e5b8e93b930deef6e6a3fe22e63aee_JaffaCakes118.html
-
Size
29KB
-
MD5
41e5b8e93b930deef6e6a3fe22e63aee
-
SHA1
4cae2b84b08b5a73e0b99329ed633fd08e742d8d
-
SHA256
1ba07e2189b4e7ed1c2ca9f01bed5424b326b70e36df2e730d9de0bbd91ad2e7
-
SHA512
ef8dbae5eb7d1a9713d1b9e69a20e3c27cc46c3eed5d6527527299f7d720dc06e0ce1d8bc75e5d814517cd71d1575ec60441deb18feee45a13328c7b5da9f268
-
SSDEEP
192:uWHIb5nS9nQjxn5Q/hnQiecNnwnQOkEntX3nQTbnBnQ47YEMCaGRAPGKTYvkkkk4:eQ/XJxWYXYLtJ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2152 msedge.exe 2152 msedge.exe 5104 msedge.exe 5104 msedge.exe 2860 identity_helper.exe 2860 identity_helper.exe 1992 msedge.exe 1992 msedge.exe 1992 msedge.exe 1992 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe 5104 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5104 wrote to memory of 4772 5104 msedge.exe 81 PID 5104 wrote to memory of 4772 5104 msedge.exe 81 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 4424 5104 msedge.exe 82 PID 5104 wrote to memory of 2152 5104 msedge.exe 83 PID 5104 wrote to memory of 2152 5104 msedge.exe 83 PID 5104 wrote to memory of 628 5104 msedge.exe 84 PID 5104 wrote to memory of 628 5104 msedge.exe 84 PID 5104 wrote to memory of 628 5104 msedge.exe 84 PID 5104 wrote to memory of 628 5104 msedge.exe 84 PID 5104 wrote to memory of 628 5104 msedge.exe 84 PID 5104 wrote to memory of 628 5104 msedge.exe 84 PID 5104 wrote to memory of 628 5104 msedge.exe 84 PID 5104 wrote to memory of 628 5104 msedge.exe 84 PID 5104 wrote to memory of 628 5104 msedge.exe 84 PID 5104 wrote to memory of 628 5104 msedge.exe 84 PID 5104 wrote to memory of 628 5104 msedge.exe 84 PID 5104 wrote to memory of 628 5104 msedge.exe 84 PID 5104 wrote to memory of 628 5104 msedge.exe 84 PID 5104 wrote to memory of 628 5104 msedge.exe 84 PID 5104 wrote to memory of 628 5104 msedge.exe 84 PID 5104 wrote to memory of 628 5104 msedge.exe 84 PID 5104 wrote to memory of 628 5104 msedge.exe 84 PID 5104 wrote to memory of 628 5104 msedge.exe 84 PID 5104 wrote to memory of 628 5104 msedge.exe 84 PID 5104 wrote to memory of 628 5104 msedge.exe 84
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\41e5b8e93b930deef6e6a3fe22e63aee_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb884446f8,0x7ffb88444708,0x7ffb884447182⤵PID:4772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,3921735163863568453,10790071313763530772,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1956 /prefetch:22⤵PID:4424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,3921735163863568453,10790071313763530772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,3921735163863568453,10790071313763530772,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:82⤵PID:628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3921735163863568453,10790071313763530772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3921735163863568453,10790071313763530772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵PID:1928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,3921735163863568453,10790071313763530772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4140 /prefetch:82⤵PID:3172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,3921735163863568453,10790071313763530772,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4140 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3921735163863568453,10790071313763530772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:12⤵PID:1116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3921735163863568453,10790071313763530772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:12⤵PID:1176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3921735163863568453,10790071313763530772,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:12⤵PID:2820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,3921735163863568453,10790071313763530772,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:12⤵PID:2140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,3921735163863568453,10790071313763530772,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1992
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3596
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1396
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
Filesize
6KB
MD58e9a57e96ac974e17af090fada2df550
SHA114f44b4f96d63d0d7b70017b62abfe1256de852d
SHA256aa6a91e490179789d9d87077d20183210587229fb8d09ea23678088361d805bb
SHA512e9ed73bc98d4c6e3169d62456382da81ae1170e5698a40005d1fa5b68567b364665a102b9365c301ef2087747d561c364c994164f845fa9901eac27656058319
-
Filesize
6KB
MD5b53a82e5e5a79aca67cc7137b3fa42d2
SHA157459166dd39d3337b9ab4a7ef59184eb51b14f4
SHA256a2195fd27273d07465abd3d474d9ff098d5c3ea52fc68cfc848ccdbae94cb921
SHA512032526a47f843e86e44487efbcea3c40d4057fa54135d5e559eab4258cba9fe5f6b7f8c7cf887f8487efba76ca896142f417147f494059c4047acce4952fe5e0
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5f423c397a8dc575a29169315410ebf39
SHA19b559fd0a8f787f5501824b9de413eb9ceaab881
SHA256c7c8e4b4abe3c74429d992f9f0b51169a275447adee256cb37cdf31d0844272c
SHA51264259f66dc10849e3c8fe8faa25ae6775648939407de024c2db3c8fc87a3180ee05d5ac2f4ff65f8d3c678903bf7032e9f57f07f6c8dc7ca967e6904c5cd9be0