Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
15-05-2024 22:14
Static task
static1
Behavioral task
behavioral1
Sample
4846bacdf7f94efbe05c3e4544c21b93_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4846bacdf7f94efbe05c3e4544c21b93_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
4846bacdf7f94efbe05c3e4544c21b93_JaffaCakes118.html
-
Size
139KB
-
MD5
4846bacdf7f94efbe05c3e4544c21b93
-
SHA1
82dc495a5a787d4fc226bab4ceba4910545d7c07
-
SHA256
847bc19d51964b12da1083d625f6888c80e2b0e318cc0f5106796436c4d899c1
-
SHA512
3a45e283708399b5cd699328ecb766639c84021b3e9c663fc36153aa2b2734cfc0a7b8e90f6ebc52d8d2cc41bf07ca7ae91abed181d70ef44001b79c971f05dd
-
SSDEEP
1536:SpvCuPqrZl+roh32yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3om:SpPirBhGyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exemsedge.exepid process 1264 msedge.exe 1264 msedge.exe 3960 msedge.exe 3960 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe 1380 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
msedge.exepid process 3960 msedge.exe 3960 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe 3960 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3960 wrote to memory of 3040 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 3040 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 4456 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 1264 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 1264 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 2856 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 2856 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 2856 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 2856 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 2856 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 2856 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 2856 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 2856 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 2856 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 2856 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 2856 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 2856 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 2856 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 2856 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 2856 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 2856 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 2856 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 2856 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 2856 3960 msedge.exe msedge.exe PID 3960 wrote to memory of 2856 3960 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4846bacdf7f94efbe05c3e4544c21b93_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab30c46f8,0x7ffab30c4708,0x7ffab30c47182⤵PID:3040
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,4006945819736027906,89723580353249180,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:22⤵PID:4456
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,4006945819736027906,89723580353249180,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1264 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,4006945819736027906,89723580353249180,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:82⤵PID:2856
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4006945819736027906,89723580353249180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:3256
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,4006945819736027906,89723580353249180,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2964 /prefetch:12⤵PID:2600
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,4006945819736027906,89723580353249180,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2764 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1380
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1476
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD528f146a00bfa5f8d9d0703a0f133aa1c
SHA1f53d2943f22acdc0ff9668cd7ce8646a6410d1ea
SHA256a852466a587d0d8e9c5dc6337311375159cbfb89dfac0df978e56f6b54593a73
SHA5123bda0855f5ec765636d1df48ca4f6199f3da1919d3e2d788947ca64d190d7521e4bfc9e2ae0646771c3174e3197296de4f75851abb7918969f5b4f029dc50ced
-
Filesize
152B
MD51ac52e2503cc26baee4322f02f5b8d9c
SHA138e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA5127670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
-
Filesize
152B
MD5b2a1398f937474c51a48b347387ee36a
SHA1922a8567f09e68a04233e84e5919043034635949
SHA2562dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA5124a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
-
Filesize
5KB
MD517670d339e3db2f142e5af800fd6d4f9
SHA10fbadf44f7b095da1e2a18e37908f25e71691069
SHA2568e9733c5847b027243408e6dea474d4b702aeb18c75ebc7cf8fa3f15fb6bc4f5
SHA512531b64e708b434f3e7c071f14de90d9d3af8f0d9806cce4789fcb7169e11257ad86cfb969bddc69b8f29c49df86f63a3186ee435bb5eed8b2134067c2904b3ff
-
Filesize
6KB
MD5dbd88973375456deb4c7e5f9a87e83df
SHA1c73296762934355b7021ffea25f09d617fa5edd2
SHA2560bbe09a9916b666b60d15a46f638a2f1c00d7c0fad0dd4ddacff3b005af39262
SHA512122fb3c35a823a28988cb167325f8865853f7d3d503b78285b1075ddd6d40f8c55b75134bbb96a5fa718f357e46601f684cbfeb9660ddad01730b4bb1c525d5a
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e