Analysis
-
max time kernel
145s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 00:22
Static task
static1
Behavioral task
behavioral1
Sample
5c3d155826b4b98bb801d2ff019bcb0c_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
5c3d155826b4b98bb801d2ff019bcb0c_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
5c3d155826b4b98bb801d2ff019bcb0c_JaffaCakes118.html
-
Size
11KB
-
MD5
5c3d155826b4b98bb801d2ff019bcb0c
-
SHA1
9e1fc135db5f127618eb6a2bfb0513fc843f7bc0
-
SHA256
a32924886cddb1308999636a1923f5261011c5b2b4460c5d1ad2d273189b4b82
-
SHA512
0c2b196ac9e59ed3bfba6704c60da7db8fff51df05c87ce5b40df52f0b2a579891fac0265296c49ecab9ec6e66975441dfea28a6ee3a2219706ba4bbaa4b0586
-
SSDEEP
192:f1QVUVqt1/kJrxvuiDOflWRleGWR/DceRbjmAA3crLUmN4tv8GUD8u2u0pVvoK1Z:f1QVUVqt1yxvuiqf4RleGW9fjM3SLQtZ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1580 msedge.exe 1580 msedge.exe 2388 msedge.exe 2388 msedge.exe 3416 identity_helper.exe 3416 identity_helper.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe 3384 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe 2388 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 4412 2388 msedge.exe 84 PID 2388 wrote to memory of 4412 2388 msedge.exe 84 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 5008 2388 msedge.exe 85 PID 2388 wrote to memory of 1580 2388 msedge.exe 86 PID 2388 wrote to memory of 1580 2388 msedge.exe 86 PID 2388 wrote to memory of 4164 2388 msedge.exe 87 PID 2388 wrote to memory of 4164 2388 msedge.exe 87 PID 2388 wrote to memory of 4164 2388 msedge.exe 87 PID 2388 wrote to memory of 4164 2388 msedge.exe 87 PID 2388 wrote to memory of 4164 2388 msedge.exe 87 PID 2388 wrote to memory of 4164 2388 msedge.exe 87 PID 2388 wrote to memory of 4164 2388 msedge.exe 87 PID 2388 wrote to memory of 4164 2388 msedge.exe 87 PID 2388 wrote to memory of 4164 2388 msedge.exe 87 PID 2388 wrote to memory of 4164 2388 msedge.exe 87 PID 2388 wrote to memory of 4164 2388 msedge.exe 87 PID 2388 wrote to memory of 4164 2388 msedge.exe 87 PID 2388 wrote to memory of 4164 2388 msedge.exe 87 PID 2388 wrote to memory of 4164 2388 msedge.exe 87 PID 2388 wrote to memory of 4164 2388 msedge.exe 87 PID 2388 wrote to memory of 4164 2388 msedge.exe 87 PID 2388 wrote to memory of 4164 2388 msedge.exe 87 PID 2388 wrote to memory of 4164 2388 msedge.exe 87 PID 2388 wrote to memory of 4164 2388 msedge.exe 87 PID 2388 wrote to memory of 4164 2388 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5c3d155826b4b98bb801d2ff019bcb0c_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9584f46f8,0x7ff9584f4708,0x7ff9584f47182⤵PID:4412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,3164040372627577523,15887600491363946600,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:5008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,3164040372627577523,15887600491363946600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,3164040372627577523,15887600491363946600,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵PID:4164
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3164040372627577523,15887600491363946600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:1484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3164040372627577523,15887600491363946600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵PID:5072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,3164040372627577523,15887600491363946600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:82⤵PID:1360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,3164040372627577523,15887600491363946600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3164040372627577523,15887600491363946600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:12⤵PID:1720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3164040372627577523,15887600491363946600,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:12⤵PID:1264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3164040372627577523,15887600491363946600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:12⤵PID:3360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,3164040372627577523,15887600491363946600,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:12⤵PID:3332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,3164040372627577523,15887600491363946600,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2736 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3384
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1056
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51ac52e2503cc26baee4322f02f5b8d9c
SHA138e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA5127670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
-
Filesize
152B
MD5b2a1398f937474c51a48b347387ee36a
SHA1922a8567f09e68a04233e84e5919043034635949
SHA2562dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA5124a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
-
Filesize
256B
MD502c8ffeab71998d11066f83d8607e0fe
SHA1a09b81a4b02a5976b2ddcc341715262a5d1fff47
SHA256e39a3c1937c5b196c861a02a9a3ae35d54c9aec8d7536c03ffadee3557fec25b
SHA512aac7470085e3da75d84f33aac7165bd46215b7b99896b7189da35d64eedee738ec11b59a935dabee8d80ae19282cc873a0b636f71b5f877a89039932a641485e
-
Filesize
6KB
MD54fecef8c85f5ec910301616f4f7b5294
SHA12c8fe9c486e045cbb1cf6cd2bb9180b8d0b9b275
SHA2567849e5c781b2427bde59d73fe0c9b889b3aaa288bc7ee26427834819c7fc38fc
SHA512714e3780384a1fa4fe75e84bc403590cfdac4941caaa695394f18089ffb8df3846a97bd5ad8ea585c782edaf14a32168becaee673ccd87addb04f4d488ac16ad
-
Filesize
5KB
MD579d6985852bcc7f4a3c41448369e01e8
SHA1cb3a0404a68a1b555c9702d90a5f0f0e78d15d93
SHA256f7d49042b5c17eeddece4a1098d73a1f7a734d834c7b5328fdce7207a582be66
SHA512a3d91a7a64221e34081c04be1e81692e486f223ff9f5556a7d505f5d13d9c7f48c2286bc2d3dc3ce732ae94d406936b0be823f2e4073528bdd611ace29d38471
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD596bfac51426317f80f3cae262b8513a6
SHA1532435f232eb134b61cc31bd5930454f6d5f44b1
SHA256e61e91f50d0ef9e196079a8b5682ea9f47d4474636363a832758821175c79891
SHA512e3ad3cc210c7594ed90a0200852c3375c943fe08807a936e02cbef63f2eab839b57c2bb2f4eea43e5c7492a4e8b2efdd604af02b844d2e2263a2b701cbd89d34