Analysis
-
max time kernel
150s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 20:25
Static task
static1
Behavioral task
behavioral1
Sample
42ed9e5b44e478eb8e8bd8e810500a6a_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
42ed9e5b44e478eb8e8bd8e810500a6a_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
42ed9e5b44e478eb8e8bd8e810500a6a_JaffaCakes118.html
-
Size
139KB
-
MD5
42ed9e5b44e478eb8e8bd8e810500a6a
-
SHA1
d56a3327045b039b645c5c51993a63cbc61cc31f
-
SHA256
65e8e200ba7feb35f6ad5d9ecf333b7aa31d2812ffe8dde105e3cf7ef89e2aba
-
SHA512
8c246dd298740ea7610c69cf660dff938ad0a51cd68432c69e753a548cd9ca9ae6c9319fc51763a7bde65002dd86d0f1dd4c3c338b568068e87f7be26278f869
-
SSDEEP
1536:Smdgk/Ild4yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:SmfyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1844 msedge.exe 1844 msedge.exe 3260 msedge.exe 3260 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe 4868 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3260 msedge.exe 3260 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe 3260 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3260 wrote to memory of 4252 3260 msedge.exe 82 PID 3260 wrote to memory of 4252 3260 msedge.exe 82 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1856 3260 msedge.exe 83 PID 3260 wrote to memory of 1844 3260 msedge.exe 84 PID 3260 wrote to memory of 1844 3260 msedge.exe 84 PID 3260 wrote to memory of 5036 3260 msedge.exe 85 PID 3260 wrote to memory of 5036 3260 msedge.exe 85 PID 3260 wrote to memory of 5036 3260 msedge.exe 85 PID 3260 wrote to memory of 5036 3260 msedge.exe 85 PID 3260 wrote to memory of 5036 3260 msedge.exe 85 PID 3260 wrote to memory of 5036 3260 msedge.exe 85 PID 3260 wrote to memory of 5036 3260 msedge.exe 85 PID 3260 wrote to memory of 5036 3260 msedge.exe 85 PID 3260 wrote to memory of 5036 3260 msedge.exe 85 PID 3260 wrote to memory of 5036 3260 msedge.exe 85 PID 3260 wrote to memory of 5036 3260 msedge.exe 85 PID 3260 wrote to memory of 5036 3260 msedge.exe 85 PID 3260 wrote to memory of 5036 3260 msedge.exe 85 PID 3260 wrote to memory of 5036 3260 msedge.exe 85 PID 3260 wrote to memory of 5036 3260 msedge.exe 85 PID 3260 wrote to memory of 5036 3260 msedge.exe 85 PID 3260 wrote to memory of 5036 3260 msedge.exe 85 PID 3260 wrote to memory of 5036 3260 msedge.exe 85 PID 3260 wrote to memory of 5036 3260 msedge.exe 85 PID 3260 wrote to memory of 5036 3260 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\42ed9e5b44e478eb8e8bd8e810500a6a_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9053046f8,0x7ff905304708,0x7ff9053047182⤵PID:4252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,16748288160508178194,769585878764167278,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:22⤵PID:1856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,16748288160508178194,769585878764167278,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,16748288160508178194,769585878764167278,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:82⤵PID:5036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16748288160508178194,769585878764167278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵PID:1452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,16748288160508178194,769585878764167278,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:2068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,16748288160508178194,769585878764167278,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2752 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4868
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2776
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3248
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
Filesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
Filesize
6KB
MD558141465ef5de87d87ecaaa6b3ba4356
SHA16482393c14b7a8843092faeb970b12d82eefaa51
SHA2562a43b45ee109a6513b15a85bac6d56be294090041a43a3ab8494c9f91edee4a4
SHA512fa30ec35b4404e5986715aa30f80289681d45409897e683b90db6d9893585dfaa3f9a30e4e78f9a8e0df3abe4da42b1dd400074123cac8e849ee1caf04d23e90
-
Filesize
6KB
MD5e12602c65e26937c4632605babb7a5d5
SHA13090c42a8b99ce1a6722f15c7c853a4774ddf300
SHA2563a6a33c90712613690ca0cec2da7ba4308b6cf01f6da30f3b807208eb0ba636f
SHA512ddf0d1fd87704d18ccffabb08d8613e70779bcce0cfc032d5319ada57c6d027e812ead45eb72727f47da72605730f21c2184bc47e8945fc75e5019c78c89cefc
-
Filesize
11KB
MD5c51f1b2272093cd25de4b78b3e97afdd
SHA17ac680894b56b82bcb22307b5caf885f93b66f40
SHA2561938df5458289557d6d5723e7e07d915512d899af1098be3ef080e2d58e800f3
SHA512f067dd5bbcfd0174d69f0ad76d86f70a54079097d32ffd458a65be49350a5a2d50fe244d1871aa63edfae15b60a9c892f5946561041ce9ee85993da09db2590b