Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 16:18
Static task
static1
Behavioral task
behavioral1
Sample
505f49bb5934f01531b22693015a0b60_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
505f49bb5934f01531b22693015a0b60_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
505f49bb5934f01531b22693015a0b60_JaffaCakes118.html
-
Size
34KB
-
MD5
505f49bb5934f01531b22693015a0b60
-
SHA1
c2ecf4a73289bb5dd276c4b5dcd54155ff05a002
-
SHA256
82fb47dc821fa11a5838041aed8914039a256ee6aa8b3183f63f6823293c3183
-
SHA512
5622f3a8d88ffff556b4f77333a5084e560f56c4eb516eb58d7433f654a8e2608ed999b95f57b7ec0b1fc43b76e428e0f205c146a144a0e1dd4a1e5b7f6efaeb
-
SSDEEP
768:j7EpFwSXe6eDewe7eIeygjI1xCJC3CNChCICrC/CvCPJExBq0Z24HLx8lFsFn:jwpFwSuDqtClpjI/EWmyP84yiJ4q0Z28
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2648 msedge.exe 2648 msedge.exe 3868 msedge.exe 3868 msedge.exe 3424 identity_helper.exe 3424 identity_helper.exe 2056 msedge.exe 2056 msedge.exe 2056 msedge.exe 2056 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe 3868 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3868 wrote to memory of 3512 3868 msedge.exe 84 PID 3868 wrote to memory of 3512 3868 msedge.exe 84 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 720 3868 msedge.exe 85 PID 3868 wrote to memory of 2648 3868 msedge.exe 86 PID 3868 wrote to memory of 2648 3868 msedge.exe 86 PID 3868 wrote to memory of 3452 3868 msedge.exe 87 PID 3868 wrote to memory of 3452 3868 msedge.exe 87 PID 3868 wrote to memory of 3452 3868 msedge.exe 87 PID 3868 wrote to memory of 3452 3868 msedge.exe 87 PID 3868 wrote to memory of 3452 3868 msedge.exe 87 PID 3868 wrote to memory of 3452 3868 msedge.exe 87 PID 3868 wrote to memory of 3452 3868 msedge.exe 87 PID 3868 wrote to memory of 3452 3868 msedge.exe 87 PID 3868 wrote to memory of 3452 3868 msedge.exe 87 PID 3868 wrote to memory of 3452 3868 msedge.exe 87 PID 3868 wrote to memory of 3452 3868 msedge.exe 87 PID 3868 wrote to memory of 3452 3868 msedge.exe 87 PID 3868 wrote to memory of 3452 3868 msedge.exe 87 PID 3868 wrote to memory of 3452 3868 msedge.exe 87 PID 3868 wrote to memory of 3452 3868 msedge.exe 87 PID 3868 wrote to memory of 3452 3868 msedge.exe 87 PID 3868 wrote to memory of 3452 3868 msedge.exe 87 PID 3868 wrote to memory of 3452 3868 msedge.exe 87 PID 3868 wrote to memory of 3452 3868 msedge.exe 87 PID 3868 wrote to memory of 3452 3868 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\505f49bb5934f01531b22693015a0b60_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa604a46f8,0x7ffa604a4708,0x7ffa604a47182⤵PID:3512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,13282882001864814735,17493746695637759408,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵PID:720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,13282882001864814735,17493746695637759408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,13282882001864814735,17493746695637759408,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:82⤵PID:3452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13282882001864814735,17493746695637759408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:12⤵PID:4976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13282882001864814735,17493746695637759408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:12⤵PID:3232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,13282882001864814735,17493746695637759408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2808 /prefetch:82⤵PID:1280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,13282882001864814735,17493746695637759408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2808 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13282882001864814735,17493746695637759408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2248 /prefetch:12⤵PID:1372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13282882001864814735,17493746695637759408,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:12⤵PID:3660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13282882001864814735,17493746695637759408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4260 /prefetch:12⤵PID:3992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13282882001864814735,17493746695637759408,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:12⤵PID:5108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,13282882001864814735,17493746695637759408,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4908 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2056
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2176
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4296
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52daa93382bba07cbc40af372d30ec576
SHA1c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA2561826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
SHA51265635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
-
Filesize
152B
MD5ecdc2754d7d2ae862272153aa9b9ca6e
SHA1c19bed1c6e1c998b9fa93298639ad7961339147d
SHA256a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
SHA512cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
-
Filesize
111B
MD5807419ca9a4734feaf8d8563a003b048
SHA1a723c7d60a65886ffa068711f1e900ccc85922a6
SHA256aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
SHA512f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
-
Filesize
111B
MD578ef85bc0686dc4ee6313bd7b43e9c11
SHA10986f6b281a43d715a08c757b46333f0119f98ec
SHA2565930ae6358d4329029ecf1c01ac4152c83289cc410a324c5967d8793bcbd8b2c
SHA512dd103e629aaa3e1a7a38e2661161ef80006a3b80f040b0e27bf0cbb173c6c01e3fd042d6d37c0621038ebff4144939a9a86de2593eca6adf16a638f3ca2f8fba
-
Filesize
308B
MD5e89c0088c0b271c0d84f362d9ccf4bf0
SHA1f72f347831d4de951536f53a39c0f118c572aeec
SHA2561e3c39abd038eeb0a1a3b2205bae74671c7f8a91574b7488190a15e17727726d
SHA51275c238c4081295374c5bdfdd1109052da4017b95e22f769f16bd7e5c1d70c76b2f68f74d1bd5522e10c851af79c2abcf88e6400b457ccdfb908a37b50ef17374
-
Filesize
6KB
MD5e6a019aab937f7342daca98c7f7412dc
SHA107add86c51b9a85d90b0c5aa3c04408eae7932e3
SHA2569fcf496b3e00a8dfabfb6aa134056ef81a09791195703eaed2bfc707a8cfe2fb
SHA51254a9ca6f9df729d2110c64c508dbd05986bccfa7951d463b09be23de0e868ccc97699151976e4ed1a5ee4384e95be6886244e98de9f532d04bb1d4fb43b44e1a
-
Filesize
5KB
MD58fad2c014505bfbd6c38f73ccc081ba8
SHA13f6222d3ea43918ec1abe3c9b8e016bb99110d17
SHA2564d56c4b78f574e1d7e85e81ca277610b5e8af3225fe7cbfe3ebbcad769b75670
SHA512538150760375366beb3df00ff1c93311f1cdc5f21d2b2d6dc58843bcbb97cbc80a5da66e4f5b2cd72f3a063dd1beb022b348116bf180adb4db46fa9e2c4f66b8
-
Filesize
6KB
MD5ee7d6c6caa812c6495a160cfc9e407d8
SHA122ef35b27857ed5d55ef1b7a84454c22b3a94f86
SHA2560236763e666b5003eee3c499edf3bb7a8915c8fe26c5777e69002acf05f4acce
SHA512afc02131c7be99f9833d4c89ed61f12f63512e6fa07b904c2fbbcab2d982d44af6247ea3b2784290210c964428056fa5df8063c0ef4cadc62aad05ac08e5617d
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD56fca32c6449bc682e1eb437f24618945
SHA110af2e9823592b1e98faaae6dab5c29aeb602060
SHA25608289b46370266984dfb3edea1706f3e3b97faed60c2e92d4dda48a43407b8e6
SHA51209cb761bc49a2c05087318b75164533e388453ba16f096edf1cd8f94d990808015be385538accf6491e804e279b06f0f7642c839f84a082b620c02e71d0e5b1f