Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 18:26
Static task
static1
Behavioral task
behavioral1
Sample
4c736bc72b6c22bf18033b7951dbbc4f_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4c736bc72b6c22bf18033b7951dbbc4f_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
4c736bc72b6c22bf18033b7951dbbc4f_JaffaCakes118.html
-
Size
139KB
-
MD5
4c736bc72b6c22bf18033b7951dbbc4f
-
SHA1
6fc915f24f7993c1271e3c96176fae486f4156f9
-
SHA256
f965403208c99d4f5f7782bfc117b36be49d30b2ad50438e857e4b112511d0fa
-
SHA512
23d746c2530af354355949123880c0ab75715cae6d36b880e13c00b49d0a23248c8feca27de641c6bcf191441f5a3d788f744f196c6a5dbe9da227561c59bbd0
-
SSDEEP
1536:S9NazHlqQyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOZ:S93QyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1076 msedge.exe 1076 msedge.exe 368 msedge.exe 368 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe 3916 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 368 msedge.exe 368 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe 368 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 368 wrote to memory of 5044 368 msedge.exe 81 PID 368 wrote to memory of 5044 368 msedge.exe 81 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 4212 368 msedge.exe 85 PID 368 wrote to memory of 1076 368 msedge.exe 86 PID 368 wrote to memory of 1076 368 msedge.exe 86 PID 368 wrote to memory of 1400 368 msedge.exe 87 PID 368 wrote to memory of 1400 368 msedge.exe 87 PID 368 wrote to memory of 1400 368 msedge.exe 87 PID 368 wrote to memory of 1400 368 msedge.exe 87 PID 368 wrote to memory of 1400 368 msedge.exe 87 PID 368 wrote to memory of 1400 368 msedge.exe 87 PID 368 wrote to memory of 1400 368 msedge.exe 87 PID 368 wrote to memory of 1400 368 msedge.exe 87 PID 368 wrote to memory of 1400 368 msedge.exe 87 PID 368 wrote to memory of 1400 368 msedge.exe 87 PID 368 wrote to memory of 1400 368 msedge.exe 87 PID 368 wrote to memory of 1400 368 msedge.exe 87 PID 368 wrote to memory of 1400 368 msedge.exe 87 PID 368 wrote to memory of 1400 368 msedge.exe 87 PID 368 wrote to memory of 1400 368 msedge.exe 87 PID 368 wrote to memory of 1400 368 msedge.exe 87 PID 368 wrote to memory of 1400 368 msedge.exe 87 PID 368 wrote to memory of 1400 368 msedge.exe 87 PID 368 wrote to memory of 1400 368 msedge.exe 87 PID 368 wrote to memory of 1400 368 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4c736bc72b6c22bf18033b7951dbbc4f_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb44b146f8,0x7ffb44b14708,0x7ffb44b147182⤵PID:5044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15404557535653851821,1537724556341846627,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵PID:4212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,15404557535653851821,1537724556341846627,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,15404557535653851821,1537724556341846627,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:82⤵PID:1400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15404557535653851821,1537724556341846627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:12⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15404557535653851821,1537724556341846627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:12⤵PID:3808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15404557535653851821,1537724556341846627,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1344 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3916
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1896
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1120
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51ac52e2503cc26baee4322f02f5b8d9c
SHA138e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA5127670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
-
Filesize
152B
MD5b2a1398f937474c51a48b347387ee36a
SHA1922a8567f09e68a04233e84e5919043034635949
SHA2562dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA5124a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
-
Filesize
5KB
MD5043db27f03ca908466ffa341f3cbeaa6
SHA16b7f57b80d7339c19899a646e380b6ed37108e1e
SHA256c40f2e4a8fdc60655271839c125aa5a2971e31fb37de020b9f51eab12bd2438c
SHA5125e0ddcdcc49329a956988d65e822c2de4ad28b6737819dac5a55d6c8618b282b1a80370bcd51bdc257d311b560b5d6a26613565e5bda79f8767d2f9e7d66dc81
-
Filesize
6KB
MD500b22665051ecb6d972bc97f03ea8ace
SHA1363bd14ad88b04321b3e7c2ec8da9fa13223b4bd
SHA2568830fe9c0978b74e994ffc185aa6f9b749d77f7125893e2e265e8d0eb604d9f7
SHA512355bf89c20c319c254a781e8e42423cca8d9c7941b5dffad4163a89431447d6ea172e78f19756a64783eb1a565001be510b304679e3d92b605c7c4efd466fbb1
-
Filesize
11KB
MD568bfe8ab6023a857d30ca31616761f06
SHA15d28c133624df3768330fcac1e0e480d8e489aea
SHA2565394c49b9f33b589bad9c096624c290d81c615342c764e69c4708adbacebe366
SHA512494ae0be8eb1b77c690cf4292e9c55011c5da348e22314b22cbecd91b5a47de837b77ab5d8b778a3328a428a3a8319e923ed5afb675d1aecfb758d4a290cb0ce