Analysis
-
max time kernel
145s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22/05/2024, 08:13
Static task
static1
Behavioral task
behavioral1
Sample
6699d7920bd256b48f34f2a73e54ccf7_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
6699d7920bd256b48f34f2a73e54ccf7_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
6699d7920bd256b48f34f2a73e54ccf7_JaffaCakes118.html
-
Size
18KB
-
MD5
6699d7920bd256b48f34f2a73e54ccf7
-
SHA1
2afb45bbbf677eb3a1888d694e1b864eadfa434e
-
SHA256
74edf1ddb404bba37f4d5c1c2ce17ae7c8bf2403a9b9a266f65ec34e4f07a7e1
-
SHA512
7ac9d359c17366fc71197e035e1978e1079add4d1e59df9c3dff7e5dd33b4f3cdce74690b88b17128bd29c513d1b7e130082c38d4a748f8101fb20e11cdd72ea
-
SSDEEP
192:9K/ypUhTxiq8LTgE9d37gfMwWjQDT+hRnMlUx9V6cxjb79DXSbiFGiC:4/yoTxixLXfYaQDixp55ibiYiC
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 380 msedge.exe 380 msedge.exe 1448 msedge.exe 1448 msedge.exe 1948 identity_helper.exe 1948 identity_helper.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe 632 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe 1448 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1448 wrote to memory of 5108 1448 msedge.exe 85 PID 1448 wrote to memory of 5108 1448 msedge.exe 85 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 1196 1448 msedge.exe 86 PID 1448 wrote to memory of 380 1448 msedge.exe 87 PID 1448 wrote to memory of 380 1448 msedge.exe 87 PID 1448 wrote to memory of 2328 1448 msedge.exe 88 PID 1448 wrote to memory of 2328 1448 msedge.exe 88 PID 1448 wrote to memory of 2328 1448 msedge.exe 88 PID 1448 wrote to memory of 2328 1448 msedge.exe 88 PID 1448 wrote to memory of 2328 1448 msedge.exe 88 PID 1448 wrote to memory of 2328 1448 msedge.exe 88 PID 1448 wrote to memory of 2328 1448 msedge.exe 88 PID 1448 wrote to memory of 2328 1448 msedge.exe 88 PID 1448 wrote to memory of 2328 1448 msedge.exe 88 PID 1448 wrote to memory of 2328 1448 msedge.exe 88 PID 1448 wrote to memory of 2328 1448 msedge.exe 88 PID 1448 wrote to memory of 2328 1448 msedge.exe 88 PID 1448 wrote to memory of 2328 1448 msedge.exe 88 PID 1448 wrote to memory of 2328 1448 msedge.exe 88 PID 1448 wrote to memory of 2328 1448 msedge.exe 88 PID 1448 wrote to memory of 2328 1448 msedge.exe 88 PID 1448 wrote to memory of 2328 1448 msedge.exe 88 PID 1448 wrote to memory of 2328 1448 msedge.exe 88 PID 1448 wrote to memory of 2328 1448 msedge.exe 88 PID 1448 wrote to memory of 2328 1448 msedge.exe 88
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6699d7920bd256b48f34f2a73e54ccf7_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a1dd46f8,0x7ff9a1dd4708,0x7ff9a1dd47182⤵PID:5108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:22⤵PID:1196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2272 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:82⤵PID:2328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:2100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:12⤵PID:3248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:12⤵PID:4896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:82⤵PID:1596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:12⤵PID:4672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:12⤵PID:1916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:12⤵PID:5096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:12⤵PID:3468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,8686437914475633402,4236168750292262406,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:632
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1752
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4444
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5537815e7cc5c694912ac0308147852e4
SHA12ccdd9d9dc637db5462fe8119c0df261146c363c
SHA256b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
SHA51263969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
-
Filesize
152B
MD58b167567021ccb1a9fdf073fa9112ef0
SHA13baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA25626764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
SHA512726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
-
Filesize
1KB
MD5500c2c7fa156990a3721ef89c45ca6ac
SHA1b87b23d65a19d4065369e35de6564089e063d801
SHA256ff721fe4168424cb7523c4779e41b9ca3887711af4d867a89ab3c3daa75ebf1b
SHA512ab71628644e811cce765245482bd9ad0a316b51b809d75f5720a69f26437a00e64ce7756b99f884f369ee0be662e5cab471dce0cff5d258421a4274c4009dd40
-
Filesize
5KB
MD5bdab2dcae15db097518553283644653e
SHA14af13c16753b90721aee79ae217fa357855b76bf
SHA256abd9f33de7782c2f4d04865d6a1381d42086bae0c6263c806528a93dc53d827a
SHA5121a69290e1c3bffb8a51b504c2cb1f041e5288af1b5702705ec7c0b3e47c54e27d8caad7e7bc3ddc1e7d342110bcc31691d8976adf3f916ebcbf1af7914688594
-
Filesize
6KB
MD58ff0931a52a960410a9dd8258692b63b
SHA115642cfaeb74e53e20e417d645dbc2df22c62c10
SHA25630c3ca6980e8536bb99efae8c69de5e3cd473b4f2984209092c29e38dd4c4d8e
SHA5127482ae8a8a4e5c78f81aae66b513fbe981cbf17545df83968215c7a821b7e718cd857af6cbcf7acd4d318c353cca6cfe00df0974ddc62947ac024720136bdc9b
-
Filesize
6KB
MD56da3ff57da0822401a5d7965f1fdd447
SHA1377ccf092c9205d52731b70e130e0996cfc8e77a
SHA256aaa8ddd04e9fdc4ef8c6378437ad053ed4bf44adb6e8f4fa2bbebcdaa473c863
SHA512d10cf7e0fc4e4ae4aa8e4aee872b0c9d2b5c7dd9165dd94dded7b9231ee3c53297de6cf28d0be4b0006f171c23f68f70c0cbadb02924b658a4b9c213f213d0cc
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5b45a376b8f4290f4c51f8c9d6a90300a
SHA1ac76b2e8c34296fc8763a5fe50130f8f4c4cc631
SHA25628d615a1b7419f2f663d2b039f0a136906e20012204865d103b09cd6371e9e15
SHA512754377bb295b1606ad6a07d39f562e508bf58f1505d5ee7d4f94e62fa775ae4662a4a59d05a5a1457852566038a4e3bed5e1070f10c4736be6209c49c79b7f2f