Analysis
-
max time kernel
130s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 02:24
Static task
static1
Behavioral task
behavioral1
Sample
65add3a938f6745ffbe0ab386ce7226d_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
65add3a938f6745ffbe0ab386ce7226d_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
65add3a938f6745ffbe0ab386ce7226d_JaffaCakes118.html
-
Size
3KB
-
MD5
65add3a938f6745ffbe0ab386ce7226d
-
SHA1
74237194c4717474a5a96df5940eddd7ad76c9d1
-
SHA256
0a52545cc39c1c310854e9b04eeee08074ed20fe503bed869bbc4d0c6e9597d7
-
SHA512
9b8c6c786a2cad1f5d442378daa30eff27a7962dc5c6e0a9f01ab097a5a4f4e6c7212fa47fe42a80d032da76bdc62393a2fbfab6aa44637b7ee6693ffc4a7162
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exepid process 4612 msedge.exe 4612 msedge.exe 5080 msedge.exe 5080 msedge.exe 4756 identity_helper.exe 4756 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
Processes:
msedge.exepid process 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
Processes:
msedge.exepid process 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe 5080 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 5080 wrote to memory of 2372 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 2372 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3044 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 4612 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 4612 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3820 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3820 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3820 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3820 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3820 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3820 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3820 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3820 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3820 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3820 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3820 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3820 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3820 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3820 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3820 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3820 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3820 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3820 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3820 5080 msedge.exe msedge.exe PID 5080 wrote to memory of 3820 5080 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65add3a938f6745ffbe0ab386ce7226d_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff936df46f8,0x7ff936df4708,0x7ff936df47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,2312355175465168973,17775117639842115484,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,2312355175465168973,17775117639842115484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,2312355175465168973,17775117639842115484,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2312355175465168973,17775117639842115484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2312355175465168973,17775117639842115484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,2312355175465168973,17775117639842115484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,2312355175465168973,17775117639842115484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2312355175465168973,17775117639842115484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2312355175465168973,17775117639842115484,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2312355175465168973,17775117639842115484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2312355175465168973,17775117639842115484,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2312355175465168973,17775117639842115484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,2312355175465168973,17775117639842115484,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD52daa93382bba07cbc40af372d30ec576
SHA1c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA2561826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
SHA51265635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ecdc2754d7d2ae862272153aa9b9ca6e
SHA1c19bed1c6e1c998b9fa93298639ad7961339147d
SHA256a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
SHA512cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
276B
MD563e94862b42530f86676ad4d8dad984d
SHA13fd2230f79711e641c7d8bc1fc8f6d671319aec8
SHA25602bd271fbf1d8f8cfeb229ec24d7bfb1c261116853c2e66a3f5d0b3536f59a25
SHA5128f57ba1d96f3a97a7867f7eb43efd22baea3a78766fd88e87affcbc1e2e1699de833cbe9d78d22fa784ebf9602bd2006ee315ea13aebbcb79b56ec137c7a5aff
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD56ddecacf34a7892fdd8fdd647ff9fc97
SHA1a56a103f44152e035ea6e54cd2b93016bf5ef89f
SHA2565d030f5249a86db30797453398080888d170f35eb45709dee37b82ee48df2c89
SHA512455b19be255451c3251e942a76c933846033bae1367f9b3aee62192690702afedaa48efaa3dbb1794222457aad42e117b3d56475b2e8bb6315494e14306b34fa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5f7f7db23b3076784aa233b63cde46d69
SHA1a63ffadaa348a7d120f3605a7afa316149eb2872
SHA256f45ffed990cd7c3b438be2619359f0233bb17ce99f599bd45947b19fd546df15
SHA51229e3e1c83161e4263fbbe755d53d81879ae441dbd5ebf094ba4eedd66803c0b6ec900037de99ea2db9187491ab3aaf05ba3e00582dc34cb1aa282ca6c5c9b7ed
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5c0e8ae4ad236208e082d912e9d83268c
SHA1c487f4836b5638e9d251a4c91c7351eb22903e19
SHA25638b7aacba38c1b8872d78cfb684026f789c386afedff24afbdd4cb3d720883ff
SHA512aef73c2dd34634d3b910f0dc2b5ea2147308271cc4ece24aa5e113bc8da99c65c78fdc5adab821c8769b15a0b88c0d5130f5a68ded9d073b74ba2cbf4c055a29
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD54c7ffef5c21b2551484ec365c2b43b11
SHA195a36edd06bf79e4bfef8392626c9ebd12e4acce
SHA256f632534ca3262ca5c7b43ed1dc8336afcc9a52fbe8affab561025601c4ed4ab2
SHA5127c167c88793da0bfd7f91a12c25e037407547145411c20f1b297a0261dcc02eca5bab86a7f77e675cbaf1dcf473857647ec9e0ea41d2bd60961da664c3e67cd6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD54dfe1d731ada55cad89deed7bc687589
SHA18d6f3cc99087f2e4015c58d9b264a1e0dc797495
SHA2561320d73d42a9d9d5d834c5cd28dea65922e6c1db43883568fdd0435819e43681
SHA5125def3f7c580d7c63bb918b0f4f8db1d6ad58623bd05629b7e8c30fa9e9e3a2a986622ca90b500800c61deffdf85fe063347225406c579833acd8ee909eebfc68
-
\??\pipe\LOCAL\crashpad_5080_BMPCWOTIMRLXXLTKMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e