Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 17:07
Static task
static1
Behavioral task
behavioral1
Sample
641512b92840a85c09b9aca71862c7b2_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
641512b92840a85c09b9aca71862c7b2_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
641512b92840a85c09b9aca71862c7b2_JaffaCakes118.html
-
Size
350KB
-
MD5
641512b92840a85c09b9aca71862c7b2
-
SHA1
03c0a67b5a4b5ad115e2bf61382c5722f78173b4
-
SHA256
478b72a65d5970bcada09961b9434df3509ee0a50dc2b66964c8717e4bcbf086
-
SHA512
5ed5107423b9bc3bfd608960181793d00115127a14b439e0db793769d624a448a23b6debda6fe617189134221822a871e3a3a21277db395d68f60ba63b5b7b4f
-
SSDEEP
6144:SwsMYod+X3oI+Ye/8sMYod+X3oI+YAsMYod+X3oI+YQ:F5d+X3gS5d+X3Y5d+X3+
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4216 msedge.exe 4216 msedge.exe 4880 msedge.exe 4880 msedge.exe 4336 msedge.exe 4336 msedge.exe 4336 msedge.exe 4336 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4880 msedge.exe 4880 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe 4880 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4880 wrote to memory of 4828 4880 msedge.exe 83 PID 4880 wrote to memory of 4828 4880 msedge.exe 83 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 1876 4880 msedge.exe 84 PID 4880 wrote to memory of 4216 4880 msedge.exe 85 PID 4880 wrote to memory of 4216 4880 msedge.exe 85 PID 4880 wrote to memory of 764 4880 msedge.exe 86 PID 4880 wrote to memory of 764 4880 msedge.exe 86 PID 4880 wrote to memory of 764 4880 msedge.exe 86 PID 4880 wrote to memory of 764 4880 msedge.exe 86 PID 4880 wrote to memory of 764 4880 msedge.exe 86 PID 4880 wrote to memory of 764 4880 msedge.exe 86 PID 4880 wrote to memory of 764 4880 msedge.exe 86 PID 4880 wrote to memory of 764 4880 msedge.exe 86 PID 4880 wrote to memory of 764 4880 msedge.exe 86 PID 4880 wrote to memory of 764 4880 msedge.exe 86 PID 4880 wrote to memory of 764 4880 msedge.exe 86 PID 4880 wrote to memory of 764 4880 msedge.exe 86 PID 4880 wrote to memory of 764 4880 msedge.exe 86 PID 4880 wrote to memory of 764 4880 msedge.exe 86 PID 4880 wrote to memory of 764 4880 msedge.exe 86 PID 4880 wrote to memory of 764 4880 msedge.exe 86 PID 4880 wrote to memory of 764 4880 msedge.exe 86 PID 4880 wrote to memory of 764 4880 msedge.exe 86 PID 4880 wrote to memory of 764 4880 msedge.exe 86 PID 4880 wrote to memory of 764 4880 msedge.exe 86
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\641512b92840a85c09b9aca71862c7b2_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa94c146f8,0x7ffa94c14708,0x7ffa94c147182⤵PID:4828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,7233963595893219162,11013012136220898345,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:22⤵PID:1876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,7233963595893219162,11013012136220898345,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,7233963595893219162,11013012136220898345,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:82⤵PID:764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7233963595893219162,11013012136220898345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:12⤵PID:4944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,7233963595893219162,11013012136220898345,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:1692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,7233963595893219162,11013012136220898345,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1900 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4336
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3640
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1584
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54b4f91fa1b362ba5341ecb2836438dea
SHA19561f5aabed742404d455da735259a2c6781fa07
SHA256d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
-
Filesize
152B
MD5eaa3db555ab5bc0cb364826204aad3f0
SHA1a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
-
Filesize
5KB
MD58ca2f7e8db8b18bd1822e89752ba30c6
SHA1850016bb5ada83784db6a28fe15dbb75b8fd9fbe
SHA25624d788a7675e53e3ccd3644ab337b8f6eaf7674e8cb1a19b40fc635050baee08
SHA5120a50c2690be5088a4fff70153920f61dc71e01f886531ede15b5239bffe9e1dc1d9643ebf26b6e0b11c3d2397bee0fa4e9b2f799916fa78f2dec774babf5d3ae
-
Filesize
6KB
MD5fcdb72df254bc2a6fbeb539399132ad9
SHA194df40fde090ce8f340aa72b7cdb88ffd18548a8
SHA2567b4cacca15febcd41d9d47ececa663079958d33f775233c0f6e945f3e2c7dc32
SHA512fecc082b9f66cf794921479cc3ab1d95c0edd604e023f88156296d14701ba7c969de96bd1cc2a6e54006c0b87af3d7c83ce925cbd572437b42f13ba75c3211f2
-
Filesize
11KB
MD575b5415c4da62c670030cbdd4096fbec
SHA155113c7385cd584f765a4dc79af7e231ca6f8cad
SHA25689445a7aaa468d4881f84d9edf8f5a2ac3ca5e5913116e90687d88fd89c63c12
SHA512feec6bad03c8018190e8b0e428298a8154954eeaba97ee106dd99af9c381d15c0c6c147c2ceaf66699ca2414adcc78cdf51e798f465459f75e71b22a35758b93