Analysis
-
max time kernel
145s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 15:03
Static task
static1
Behavioral task
behavioral1
Sample
63b7fa8ab2b6fea7bd6b62b50ebd8232_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
63b7fa8ab2b6fea7bd6b62b50ebd8232_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
63b7fa8ab2b6fea7bd6b62b50ebd8232_JaffaCakes118.html
-
Size
42KB
-
MD5
63b7fa8ab2b6fea7bd6b62b50ebd8232
-
SHA1
ec8acb6eba842f131354b351f3c8fa926b788233
-
SHA256
8f70323ff3b5fb4d5a2dc515c6071179f8f93e1b08cb2992e1ed04ebd80a6008
-
SHA512
072a31ca0cc5c43a4c7bb3f77f0b10beeeb1302f64f95eefc31f2243522d9302e15274b1f906b04034836b53694c605ddfbb87f47807b6958eea10db74dc2499
-
SSDEEP
768:I5zDSbWbbx2xRxZxRxGznjIhcCKC+Bz26aOSHDQuZWEwYraE6M3zgIyAIyznySti:I5sWbbx2xRxZxRxGznjIhcjtdIOSHDQN
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 1616 msedge.exe 1616 msedge.exe 3448 msedge.exe 3448 msedge.exe 4932 identity_helper.exe 4932 identity_helper.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe 4460 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe 3448 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3448 wrote to memory of 780 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 780 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 4980 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 1616 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 1616 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 3108 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 3108 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 3108 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 3108 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 3108 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 3108 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 3108 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 3108 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 3108 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 3108 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 3108 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 3108 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 3108 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 3108 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 3108 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 3108 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 3108 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 3108 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 3108 3448 msedge.exe msedge.exe PID 3448 wrote to memory of 3108 3448 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\63b7fa8ab2b6fea7bd6b62b50ebd8232_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff912ed46f8,0x7ff912ed4708,0x7ff912ed47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,2515126737062738597,1617565943262403922,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,2515126737062738597,1617565943262403922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,2515126737062738597,1617565943262403922,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,2515126737062738597,1617565943262403922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,2515126737062738597,1617565943262403922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,2515126737062738597,1617565943262403922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1900 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,2515126737062738597,1617565943262403922,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1900 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,2515126737062738597,1617565943262403922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,2515126737062738597,1617565943262403922,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,2515126737062738597,1617565943262403922,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,2515126737062738597,1617565943262403922,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,2515126737062738597,1617565943262403922,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5903a0fda0be6292cf730c1dd8aaa1156
SHA1e4641da3a337fe801dc5ef526e7533699d8b2af9
SHA256dc08bd4cc82dc12ef0840739b372536f5a1dbd2a719b39fd62a2e27d97db8e4b
SHA5124e7ab57327cbd741b4369d4a2fe4b086661c49efea8230d56dfa77aa4588af6c5d78ff4726ffa95c051926058bf985b47ac5d93c784036eac8cc58d39bdb1aba
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD563c1beb9227c79d811fafb12bb74f057
SHA172c81a99cd88da799670e0627143ad7386cfe968
SHA256ab486507e1156d70d84beddd5aee89af66098de91e8913ed67f0a55345e0f949
SHA51297eee5844f2bd3d5c206495010e07fc35c24b06c5e9e2083e1a2cc7782078109a6d3d4fe637232aceca3e74a9eaa5a40154e7d9f4628fb60795b859119656678
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD579afda9f53b1195155044f9f4495a65d
SHA1a75d7bf98817b5aae165ae40ba266d89d3c3c547
SHA2565672af4e5376dbd2a0dc65463876f4bbb5fe1517e3cd27773093abf32c22377f
SHA51254885f83afc0487f78744c53476269abf5acef6a091d893d0c3955291f23bd7880f807d1c0f79ac9b8285cf3b3b25ee2a671e7a54d5cc5bd8f1708d9f24a01ec
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5d0f02bcabf3ab5aac66deca7ea07788a
SHA13ea38759a2127b6d98620b5a01ac05c218e8f5d2
SHA2567b55b431fdc80ae842c498ef48e1290ab46e714e36414c6af1a6707bc33b26b6
SHA512db9196fb9ff0f48cedc4fc1120c72fe0a508a21b08fb5f5af15fa9ff124bcc953bb3f9cceff2436b38d6607636bd234496ce0aa678c43a99ecc7daab46ecdf5b
-
\??\pipe\LOCAL\crashpad_3448_RLLIZHQLDNSYVPJCMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e