Analysis
-
max time kernel
145s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 14:39
Static task
static1
Behavioral task
behavioral1
Sample
63a6258420f90b4c10f749eab3f61482_JaffaCakes118.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
63a6258420f90b4c10f749eab3f61482_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
63a6258420f90b4c10f749eab3f61482_JaffaCakes118.html
-
Size
4KB
-
MD5
63a6258420f90b4c10f749eab3f61482
-
SHA1
8d8b2188f4cc51f2c912f8211db7300c31bf4fca
-
SHA256
555c29a51e90448684994223f33a3cecc9918a1b52ddcd390e177119860c9ed2
-
SHA512
89f81f60b7ba351b423ce90fde93fbdd7d7e2591a08184a905249a57eb1f21f909cf3ee962fbb06ae0a4e5c57334f0d0a79f14da69245024bbadc6976fae53c2
-
SSDEEP
96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oQcod:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDt
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 4244 msedge.exe 4244 msedge.exe 1164 msedge.exe 1164 msedge.exe 2796 identity_helper.exe 2796 identity_helper.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe 1908 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe 1164 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1164 wrote to memory of 1320 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 1320 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 2424 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 4244 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 4244 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 4764 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 4764 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 4764 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 4764 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 4764 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 4764 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 4764 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 4764 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 4764 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 4764 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 4764 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 4764 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 4764 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 4764 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 4764 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 4764 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 4764 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 4764 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 4764 1164 msedge.exe msedge.exe PID 1164 wrote to memory of 4764 1164 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63a6258420f90b4c10f749eab3f61482_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc468746f8,0x7ffc46874708,0x7ffc468747182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6007187168221186462,8781733845763506568,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,6007187168221186462,8781733845763506568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,6007187168221186462,8781733845763506568,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6007187168221186462,8781733845763506568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6007187168221186462,8781733845763506568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6007187168221186462,8781733845763506568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,6007187168221186462,8781733845763506568,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6007187168221186462,8781733845763506568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6007187168221186462,8781733845763506568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6007187168221186462,8781733845763506568,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,6007187168221186462,8781733845763506568,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,6007187168221186462,8781733845763506568,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5152 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5537815e7cc5c694912ac0308147852e4
SHA12ccdd9d9dc637db5462fe8119c0df261146c363c
SHA256b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
SHA51263969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD58b167567021ccb1a9fdf073fa9112ef0
SHA13baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA25626764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
SHA512726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
292B
MD52fab4197ab8ce04f4f104e28c6dcd66e
SHA1e076411304b1f4a721e821d01479a907c8bcd172
SHA256faaa190b2b1ab1a3d738c6398e3218da04c7aac945b79a9ca00f1d4ac6dbc27a
SHA512e101a941c0e6d20b7a412299873ae380772801f821ca5f1006b9476490cc775910d317a90290350f3b4edb9381e4721ee2f7a0fa66b1ae52ecc44dc030e95465
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5f9de9dd6e07fd8eb38a98a85524ff795
SHA1ef024c8e45967eccbf82270dde601f4bdf290c2a
SHA2565f8fc3078f5f888c892a36b024977dd2690c743556d62df846ebeb8b0b00c0b7
SHA512b003041dc59316b50e0440e3d430a9a9a07a6c960ea60833db44c2603921c819c4f5431427882be9742e8f6e5f934e7b2b81631516b8448b2c7186fccdb62db4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5394b298d86e221657c9963839c609e47
SHA161aa7ebfc4e0047a35316229f452c86b94b13076
SHA2563fc6face2d87d04142b70a17055087e8a50234089a77dc2ab5e7935677324b97
SHA512b7c8f175101e36619a38cdb533183c857bf4d79eb53b59498bfc088d59f2ecd08fdb6357c3613bda7d87d58c134273fe9ab8915a59e77f00d7a98df94844613a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f6ee36d3-14d0-46b4-99c9-f970a3ebc607.tmpFilesize
11KB
MD563b007bd98993a89f87770d13abe179c
SHA1ea91e13acca0a60a29e216a626902e5ce3469ec7
SHA25610be5f88fb46115352c3f493cdf3e0bfcbddb2fa5a33afd6facc10730b779d22
SHA512e6927b85a26d40c59b7671fd903adfd674412ab44795f9d1f129be551b10ae590d16d9dfb931541a858f253f3cb6bbaea59cf2935ae20949052e35961af4b3a2
-
\??\pipe\LOCAL\crashpad_1164_UOFPDIZXXGKEOLZOMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e