Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 02:40
Static task
static1
Behavioral task
behavioral1
Sample
65ba6b24e79aaad86d1e7bae01eaa55a_JaffaCakes118.html
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
65ba6b24e79aaad86d1e7bae01eaa55a_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
65ba6b24e79aaad86d1e7bae01eaa55a_JaffaCakes118.html
-
Size
56KB
-
MD5
65ba6b24e79aaad86d1e7bae01eaa55a
-
SHA1
4e38e14353054a9d4fea09d88ab176ac199b39bf
-
SHA256
059c021a6ad04d8e794ae3d22cd9d1ecbd681ebcedbdf2500ae219437fd354c6
-
SHA512
eb85c5a12684275411b0ddd193448255d2e16fbe98c356508daf587707afaa8ae5ba913f4f94b06fe7708b44183b8390e677cbd5a8b72390bbc61154c7b91efe
-
SSDEEP
1536:o6z5ILgjOGhx1PAXZtDvvDc0KKtmxmamQmJp/OrEmHOJE7GyQvdWU:o6z5ILXGhxKE2v0U
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 4900 msedge.exe 4900 msedge.exe 4272 msedge.exe 4272 msedge.exe 764 identity_helper.exe 764 identity_helper.exe 1936 msedge.exe 1936 msedge.exe 1936 msedge.exe 1936 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe 4272 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4272 wrote to memory of 920 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 920 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 3180 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 4900 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 4900 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 2488 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 2488 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 2488 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 2488 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 2488 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 2488 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 2488 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 2488 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 2488 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 2488 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 2488 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 2488 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 2488 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 2488 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 2488 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 2488 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 2488 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 2488 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 2488 4272 msedge.exe msedge.exe PID 4272 wrote to memory of 2488 4272 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65ba6b24e79aaad86d1e7bae01eaa55a_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd711f46f8,0x7ffd711f4708,0x7ffd711f47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12400266083494539484,7105607112283228196,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,12400266083494539484,7105607112283228196,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,12400266083494539484,7105607112283228196,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12400266083494539484,7105607112283228196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12400266083494539484,7105607112283228196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12400266083494539484,7105607112283228196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12400266083494539484,7105607112283228196,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12400266083494539484,7105607112283228196,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,12400266083494539484,7105607112283228196,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12400266083494539484,7105607112283228196,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,12400266083494539484,7105607112283228196,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,12400266083494539484,7105607112283228196,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2748 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD556641592f6e69f5f5fb06f2319384490
SHA16a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA25602d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
SHA512c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5612a6c4247ef652299b376221c984213
SHA1d306f3b16bde39708aa862aee372345feb559750
SHA2569d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
SHA51234a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
811B
MD51b90de0e1c9beb71bf05cebfb58ad67b
SHA1da37488880500faf39ce6825c9e8bf5ddbbccd62
SHA2563137e137143a11ca86fc1c48e8fc0aef79da223c9ad4ee45341df9104db81b99
SHA512f74573c35a96f09a459c42611a4b2e399b0e18a5fbd04c6fd639974bb37bb80e5ff6789da9adeecde6224dd2017619f155ebeaed1fabdf92393ec1e1dc40a97d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD5737cf8840429b6090563c6da71117cb6
SHA1cfe1b19444a963349d49d34dc628dea6d382d5ea
SHA25691675a8b95c3c96296f2272ee11f45354c7124fc1a8803daca14d1571be188a8
SHA5121c2bb761b5b51d36f559de635c243efba578e5e7aa37c70bcea4b7239959e0c1ab61b3fb23a64e4d87964b116bc3a5c925d6fb073f7cc47dfeb93ab680a7b2f9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5194179584e2772dd712a4e04bd7309a9
SHA1da8ad2b090eed06d1e94d3e7ae83692dc604d3e1
SHA256b5fb92affa0ec476bad09b3d4820ac0aae5d1410c987481f210ad76ab45e6758
SHA51260b961672fd622e225a6090feb85ede984fa63f9fd9f8b82e42e52244dbc5e1c99eebf339b26a46c65ef5ec8952dc83ea42a5beacd51c701624a18f6703db09d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
1KB
MD55990abbbbe571c7becdc4c4ff3e42e4f
SHA17ba00b0a9ae33fdb91f0ef390eaea390b3f98b60
SHA25636994c4a350d0e2fb2351d0593bdb373b02d9f09eff199f97278979781753325
SHA512112666d3e8164e043d945aa75053f270ed1a9d11131a40777edc42640628e8ff4bf50c0be9e726f6106744b07118a252bc6c9ed1c29d7add674fd45e06127353
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579dd6.TMPFilesize
1KB
MD5f163edf6ae90bb8294875e98d2ba1570
SHA1e88487510b35db5bb59dd2f15d58abc748033a62
SHA2566639b7ab3faa76130fa726e1ae9653d01a38db88624bafcb6ec5a3d1595d388b
SHA512b910d129dea0f460586ec6310f368fbffa48d31b380ca3391f1b18b394048d839e454ae1ca4d7d4a6a50255e56e42c5d232d6f12dbf97d844a6a41ce2d835f3e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD57c1c419b7b50689019286ac2c06eb39c
SHA1fb1dfc1bcbe4fe1f935f974401640ff1e81f98d7
SHA256bcb420ddf4e672543a2653d8e98f0b5ab2badcb8949782bb094812977f9f8285
SHA5122bd97964f2c75c7b3d7bd65a93c68531295851ebeb271c333ab37ea97d9ab47f0dfc31c94d8a3db7f51a5d88aba02ee0ae9aa1004df6abea35c868e5967b145c
-
\??\pipe\LOCAL\crashpad_4272_NUFWMOAJEGGUHRUMMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e