Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 15:37
Static task
static1
Behavioral task
behavioral1
Sample
5038da260fbdd162433b41d2454aa89d_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5038da260fbdd162433b41d2454aa89d_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
5038da260fbdd162433b41d2454aa89d_JaffaCakes118.html
-
Size
57KB
-
MD5
5038da260fbdd162433b41d2454aa89d
-
SHA1
b98c630cd3b5e0fed12010353f50e9b36d952e8d
-
SHA256
850eb3ce58e94ca235dc760815ca2e971d898e9071059605c71db50b2fb1caf7
-
SHA512
eeaab8d07484844ed6d1a9c912b5eb777128c032ad461177e68d633c99dacca902b2a20e6c600170507b6f6f9777c4c210e75d299f2fc2b85be400437eb5722c
-
SSDEEP
768:ahVIH8oa3oaYlmy1RW3NM+tgz8k1L1M6Cy9+J4tcqeCJv2lNk2L:aXIHg3vYl7EuN1/Cy/c2v2lF
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2240 msedge.exe 2240 msedge.exe 3932 msedge.exe 3932 msedge.exe 1476 identity_helper.exe 1476 identity_helper.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe 3696 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe 3932 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3932 wrote to memory of 1496 3932 msedge.exe 85 PID 3932 wrote to memory of 1496 3932 msedge.exe 85 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 960 3932 msedge.exe 86 PID 3932 wrote to memory of 2240 3932 msedge.exe 87 PID 3932 wrote to memory of 2240 3932 msedge.exe 87 PID 3932 wrote to memory of 3612 3932 msedge.exe 88 PID 3932 wrote to memory of 3612 3932 msedge.exe 88 PID 3932 wrote to memory of 3612 3932 msedge.exe 88 PID 3932 wrote to memory of 3612 3932 msedge.exe 88 PID 3932 wrote to memory of 3612 3932 msedge.exe 88 PID 3932 wrote to memory of 3612 3932 msedge.exe 88 PID 3932 wrote to memory of 3612 3932 msedge.exe 88 PID 3932 wrote to memory of 3612 3932 msedge.exe 88 PID 3932 wrote to memory of 3612 3932 msedge.exe 88 PID 3932 wrote to memory of 3612 3932 msedge.exe 88 PID 3932 wrote to memory of 3612 3932 msedge.exe 88 PID 3932 wrote to memory of 3612 3932 msedge.exe 88 PID 3932 wrote to memory of 3612 3932 msedge.exe 88 PID 3932 wrote to memory of 3612 3932 msedge.exe 88 PID 3932 wrote to memory of 3612 3932 msedge.exe 88 PID 3932 wrote to memory of 3612 3932 msedge.exe 88 PID 3932 wrote to memory of 3612 3932 msedge.exe 88 PID 3932 wrote to memory of 3612 3932 msedge.exe 88 PID 3932 wrote to memory of 3612 3932 msedge.exe 88 PID 3932 wrote to memory of 3612 3932 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5038da260fbdd162433b41d2454aa89d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdfb5346f8,0x7ffdfb534708,0x7ffdfb5347182⤵PID:1496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,14037888231544217873,14581288387251426382,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:22⤵PID:960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,14037888231544217873,14581288387251426382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,14037888231544217873,14581288387251426382,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:82⤵PID:3612
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14037888231544217873,14581288387251426382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:12⤵PID:3444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14037888231544217873,14581288387251426382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:12⤵PID:3108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14037888231544217873,14581288387251426382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:12⤵PID:4432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14037888231544217873,14581288387251426382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:12⤵PID:1456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14037888231544217873,14581288387251426382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:12⤵PID:4128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,14037888231544217873,14581288387251426382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:82⤵PID:4268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,14037888231544217873,14581288387251426382,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14037888231544217873,14581288387251426382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3592 /prefetch:12⤵PID:2260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14037888231544217873,14581288387251426382,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:12⤵PID:672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14037888231544217873,14581288387251426382,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:12⤵PID:2588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,14037888231544217873,14581288387251426382,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:12⤵PID:2748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,14037888231544217873,14581288387251426382,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5212 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3696
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3112
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1556
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c3cfadeead1e6fd004519a5bc41892db
SHA15991016184d9747f1c2a14433f205a994d1cced4
SHA256deb6dd9d34f1ab504f0ed362f00e0fd2ef197b2b96223d45eea06fda24b39976
SHA5129eb9d587b1f4e12a17588d624234dafba6d40f90584d152727d59f95661284dc682b6bc5757360ab012463059cb56e83b94aad61f18ff24339bae95db51bb68f
-
Filesize
152B
MD5f61fa5143fe872d1d8f1e9f8dc6544f9
SHA1df44bab94d7388fb38c63085ec4db80cfc5eb009
SHA256284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64
SHA512971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6
-
Filesize
152B
MD587f7abeb82600e1e640b843ad50fe0a1
SHA1045bbada3f23fc59941bf7d0210fb160cb78ae87
SHA256b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262
SHA512ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize96B
MD51505678372117fadfb62f75a360c4036
SHA1f4d1b09ee11caa25d2f21ca8228724982a501cf7
SHA2569b580a07682cebd934241bfde7ddf24dcdf11fe6a3083021812e924907028c22
SHA5126be7fafebb115b6b62e3a26b07ac9b41631e561717459c664757499c58da37d6c08a5a5aaaba1247679e17b0ea7ddff7afac3eef28b60d89f59e55fc65a66e9e
-
Filesize
1KB
MD56475d1602b156027388c8b5709cbf50e
SHA18424157f464186e8d2eb76e76cdf0f242dc62925
SHA2567bc3c2ca7b82ef78abe3148f2f85f738c37913bef444924173bc377fe2c74f48
SHA512e2250b768c93209ded9d8245fadcd1fedf6b3a0934281d2d6686be9fbea157661d78991bb2e63b9b2d4d24d9ad08ef8920b5bb20b16b965e1d623e812e9b8d0e
-
Filesize
5KB
MD5fc9c0ea08f1409ea92ad68e8118d1462
SHA10f039c6736eecfda852b7f19741ef81361ae9277
SHA2564c6034a1118e14e314abc5b76087a8cd1895d13624c49216af0d695c49f1b422
SHA512ddaaa7c5a5dd31917c39283cea45b2f880765dbf5cc02f50365a03477d0856e52c6fc20618f85be01d41f2e952d786f6a419e093ef8d70cbf75970fb00341b33
-
Filesize
6KB
MD57ce5de7a3a229d17e1b546b8c7a386a1
SHA1fbb044631d2d828a5b0493d5cc72edabc8e9939b
SHA2564e69bff1292acd20d440333bd3d966e5a62fd53e463fe28c23df68b4606f35aa
SHA512588556f4b67d567cac50c0c2f0fa90c73e8be081ac56d86db1d85d77a6c5029aef3230fc28738c8271ea0423e82b93dc7c50687279ed65f1a36bf6079fe41190
-
Filesize
6KB
MD5fe4eb1e6b092719685d15d189c98b540
SHA1ddecbb43f5b9903f04cecb550f2723345ddfd05d
SHA25694aa591c94f6aa148763d68c18aaf0e530f1a1ca63a80584962e082d182eed82
SHA51267661da9103566d1d147af76e5cb710c6341e8c174676457ff7efef45578cb498d2220b3fedece34882daf49728cc57dc5d70f27c8268dbed7b7b251717b9eac
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389