Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 22:54
Static task
static1
Behavioral task
behavioral1
Sample
4d6a40ec9f2be5bb7995e39829b5a47b_JaffaCakes118.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4d6a40ec9f2be5bb7995e39829b5a47b_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
4d6a40ec9f2be5bb7995e39829b5a47b_JaffaCakes118.html
-
Size
139KB
-
MD5
4d6a40ec9f2be5bb7995e39829b5a47b
-
SHA1
0e4ff0e4ad4d5caddd04dafbff19f381f95d4b03
-
SHA256
0e700836cf35ca3e7dda2b9cb89d9927a5905ed0708b64dc4ec0f2c8c982962b
-
SHA512
78757d5ed58f38e425fc37afbbb46b5ffbc7d61a69dd6ef8c4810b9d44ee1dd96d37306177248cabbde0a3c155e6fd2797bf3edbb0b980a51e83ed9130c3333c
-
SSDEEP
1536:SevQ0QplXyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOZ:SegyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 752 msedge.exe 752 msedge.exe 2336 msedge.exe 2336 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe 1196 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2336 msedge.exe 2336 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe 2336 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2336 wrote to memory of 4388 2336 msedge.exe 83 PID 2336 wrote to memory of 4388 2336 msedge.exe 83 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 884 2336 msedge.exe 84 PID 2336 wrote to memory of 752 2336 msedge.exe 85 PID 2336 wrote to memory of 752 2336 msedge.exe 85 PID 2336 wrote to memory of 2924 2336 msedge.exe 86 PID 2336 wrote to memory of 2924 2336 msedge.exe 86 PID 2336 wrote to memory of 2924 2336 msedge.exe 86 PID 2336 wrote to memory of 2924 2336 msedge.exe 86 PID 2336 wrote to memory of 2924 2336 msedge.exe 86 PID 2336 wrote to memory of 2924 2336 msedge.exe 86 PID 2336 wrote to memory of 2924 2336 msedge.exe 86 PID 2336 wrote to memory of 2924 2336 msedge.exe 86 PID 2336 wrote to memory of 2924 2336 msedge.exe 86 PID 2336 wrote to memory of 2924 2336 msedge.exe 86 PID 2336 wrote to memory of 2924 2336 msedge.exe 86 PID 2336 wrote to memory of 2924 2336 msedge.exe 86 PID 2336 wrote to memory of 2924 2336 msedge.exe 86 PID 2336 wrote to memory of 2924 2336 msedge.exe 86 PID 2336 wrote to memory of 2924 2336 msedge.exe 86 PID 2336 wrote to memory of 2924 2336 msedge.exe 86 PID 2336 wrote to memory of 2924 2336 msedge.exe 86 PID 2336 wrote to memory of 2924 2336 msedge.exe 86 PID 2336 wrote to memory of 2924 2336 msedge.exe 86 PID 2336 wrote to memory of 2924 2336 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4d6a40ec9f2be5bb7995e39829b5a47b_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd952e46f8,0x7ffd952e4708,0x7ffd952e47182⤵PID:4388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,4359287767738201108,13563867696844951508,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵PID:884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,4359287767738201108,13563867696844951508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,4359287767738201108,13563867696844951508,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:82⤵PID:2924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4359287767738201108,13563867696844951508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:2180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4359287767738201108,13563867696844951508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:2056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,4359287767738201108,13563867696844951508,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2876 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1196
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1748
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3344
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
Filesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
Filesize
5KB
MD557adc3af628e2d124e8b2cb308226659
SHA164644f85fdbecf6d7a41d5691c8f13851c1a49ec
SHA256122aee9ab158d0270a0c01c870b690894a9db62a50bea35a555c70573d02c059
SHA512d984968da165eeec02614df9b95a59c66161ab1fa8b13a9da2dba293a8736aaba85b567c49aecd664e31b686d82233b62c517948a71fc4f2487d6b05ca82f6d3
-
Filesize
6KB
MD57bd99b969abecf8d6ac72f6790979823
SHA1acc50215e2408bec0ee87cc59611802bcec6c185
SHA256317028a922068b71e0874b95882c88335d23dcbe6b867e36fcd1aa7235f1cd16
SHA512c32104f9ec8bd18a45c6fb0cc845e2a7f4c987d146ed3b0a06a2238f1cc61bf68244dc8fbd651313b438753fc250fe9e638d1130ad2ec8b5d7bfc1df82103b3e
-
Filesize
11KB
MD59918304766a84ba5eeb9dd09f9fe53e7
SHA132af266b6fd9d4e58fcfd076cd59ca5a6f8c324c
SHA2568903def4d6273579f6b527d085829b78cc97d7bee26b734b2ccca210cc3d3dbb
SHA51213d6aed4257dada3d8bf8636bec333175dcf84a19a2b42a09cd20184a4670f382fe879597ade39a283351cb1574f3705a93a2e0320fde4b96f4f5656864156d7