Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 02:43
Static task
static1
Behavioral task
behavioral1
Sample
65bc7ce00f6b97c4d32882f3dc340cf0_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
65bc7ce00f6b97c4d32882f3dc340cf0_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
65bc7ce00f6b97c4d32882f3dc340cf0_JaffaCakes118.html
-
Size
218KB
-
MD5
65bc7ce00f6b97c4d32882f3dc340cf0
-
SHA1
1bc25b932ab909476c42879746e005b1d16107d7
-
SHA256
1db1fbd315df4b147c296d810a81d6b423ce9dcbbbd433a7c0ac152d2a3a554d
-
SHA512
6b0aa03e4667c5bf9676b999bd2c3cbcea3c932918f66897157c89dcfa55d3463e6c4ae8bf0cac3d637415b303db508143d4dc9d998f34a85254b366af0bf456
-
SSDEEP
3072:SNi4HlO7EhVKaYyfkMY+BES09JXAnyrZalI+YQ:SNi4HSeVjVsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exemsedge.exepid process 552 msedge.exe 552 msedge.exe 4724 msedge.exe 4724 msedge.exe 4048 msedge.exe 4048 msedge.exe 4048 msedge.exe 4048 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
msedge.exepid process 4724 msedge.exe 4724 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe 4724 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 4724 wrote to memory of 3260 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 3260 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4756 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 552 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4864 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4864 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4864 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4864 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4864 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4864 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4864 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4864 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4864 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4864 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4864 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4864 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4864 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4864 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4864 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4864 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4864 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4864 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4864 4724 msedge.exe msedge.exe PID 4724 wrote to memory of 4864 4724 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65bc7ce00f6b97c4d32882f3dc340cf0_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f40f46f8,0x7ff8f40f4708,0x7ff8f40f47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6135925564358528337,11928824276405363537,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,6135925564358528337,11928824276405363537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,6135925564358528337,11928824276405363537,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6135925564358528337,11928824276405363537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6135925564358528337,11928824276405363537,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6135925564358528337,11928824276405363537,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4912 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5a6aa738827eda8188cf444bb823751e4
SHA13798a00592deffa077d6ce39cc464c04e3739307
SHA25685536e6034ba812e8bcb8a5c38c5db3b6c76b096af7df0161264331350b58da7
SHA512b97d182ab04fe1ae3e915f392406efe79428aa5458ac03ecd3ee02fe14d83efb29badd8da6245915504b6e1710ad23bbfb11fdb8a668ac088a2b327fc823a672
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD54398792c09a1c932f27cb45dfe14bf3d
SHA1a568d64b63a566bf32c9898f1c46ff810febf0e6
SHA25684abf38a9f4d35235772e2c1ed35ef822af06da584dfb9bb3ce1ca6c4d8f9f95
SHA5121bba3fb6f216c59ad704e23fa666cb4643dc999ab681a6c56fca78e53fe0c72ce541264ee8fb1f5f441f376bf130328faefcb2d0d54b67081380baba4e0a351b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5616f884ba2b8095d853f87d30e052f65
SHA1a62437d0f1a66d327b16348b4b8855064e70d5fc
SHA25608d6cb7a7d77a394caf139e4add41784897abfbeca0dcb129a61315999ba36a1
SHA5129ebb179995526d80f032b64febd4032f378d574aa18ca872678132c8ad38fc383791c2cbd6ebcab8079a49007df4dc27e0f02f81ece42ff06f4d578dd0c5f27a