Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 20:32
Static task
static1
Behavioral task
behavioral1
Sample
68884418ae575ea3636e3b5193d74052_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
68884418ae575ea3636e3b5193d74052_JaffaCakes118.html
Resource
win10v2004-20240508-en
General
-
Target
68884418ae575ea3636e3b5193d74052_JaffaCakes118.html
-
Size
4KB
-
MD5
68884418ae575ea3636e3b5193d74052
-
SHA1
9d7cbbb160eeb64c725ab8355bf43e6b3c53ea6d
-
SHA256
0992b6b83c9d55d26a8003dd88971f563e9f51c5ce5bc341e117f81ad8b45747
-
SHA512
32be61bfd844f6184c52f4b4c4db3a3f39df2b1c58ffdeca4f7299f48a4a4dda4f2e185dcb13c3c294c678ab7b6a8bc0009f75ec42ad59dfe879918fcf741293
-
SSDEEP
48:Rhpxdl+tT1ODjRLO2zw/eqJWccEaCWlwljCQ+rE/1uFvc6+9vSZX5ZzKZnJYVa:rdGTc/0/eqd1UrEtuFvcXKbsBJYVa
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 4016 msedge.exe 4016 msedge.exe 2708 msedge.exe 2708 msedge.exe 1624 identity_helper.exe 1624 identity_helper.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe 4376 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
Processes:
msedge.exepid process 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe 2708 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 2708 wrote to memory of 3116 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 3116 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2868 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 4016 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 4016 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2628 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2628 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2628 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2628 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2628 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2628 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2628 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2628 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2628 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2628 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2628 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2628 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2628 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2628 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2628 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2628 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2628 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2628 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2628 2708 msedge.exe msedge.exe PID 2708 wrote to memory of 2628 2708 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68884418ae575ea3636e3b5193d74052_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcce9946f8,0x7ffcce994708,0x7ffcce9947182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,3591775940252140253,11185262652636030501,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,3591775940252140253,11185262652636030501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,3591775940252140253,11185262652636030501,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3591775940252140253,11185262652636030501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3591775940252140253,11185262652636030501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3591775940252140253,11185262652636030501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,3591775940252140253,11185262652636030501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,3591775940252140253,11185262652636030501,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3591775940252140253,11185262652636030501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3591775940252140253,11185262652636030501,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3591775940252140253,11185262652636030501,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,3591775940252140253,11185262652636030501,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,3591775940252140253,11185262652636030501,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4796 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54b4f91fa1b362ba5341ecb2836438dea
SHA19561f5aabed742404d455da735259a2c6781fa07
SHA256d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5eaa3db555ab5bc0cb364826204aad3f0
SHA1a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
262B
MD58c5bd48250406a0ca7eb2b3c75adb820
SHA1ffeacf3a1eb1e0549219b6428ec4af8c5054e060
SHA256a13323db9208c5d8edff0eab641bc5b9ef44044a8b4773b7e026661388089e1b
SHA512b58eebc062b32b6c526160393b9f8758024d09a9b14c0583f2252effb82bff52b83b48efdd10ff814c04bb417e93eedf5bb27d14c224681084ec64b27ae40f00
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD56fc3df150b8b9d704b9493c9d2cc3958
SHA12ce49765645dd0191d0dd8969b7a4c970b8a6b17
SHA256020bbca94ff6c2ea0ed1911e262a66d4d6be56100b1a5d7b48a5ae0b03a7a44c
SHA51286befd87b6d75f1e01ef35ec6758c4497cb141e8a9f599bc7536704c3130cafd12db3bb2611745df5b17cb5147976f52474fee0eb6b266fa210bbc104e6d5cb6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
5KB
MD522393ba5aee89bccedcf8fc5b233a9b3
SHA1c65d5c7105db3b46be267f165761f3c81c45e74f
SHA25637f091d80c6008317c0ed6604b9cbfbf885157ce239ada373cc219936826e170
SHA512251991b6f0276ea8fca46bdacb2a694c5ee220c1a1f96a669a952af7263c1ebfcef1eeaddc6249f1e8d4c599ff40d7a730080138fff7b94c446371ac8aecc8cf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD58eec333abf0b7fd371c64032640df2e9
SHA11ba86154b097358cd691a972f89a2a945565fa0f
SHA2564cabb8d2fe82673d253f5b3757a5150c97054b33cad44b09b6f41aa10c409775
SHA5120f5eef499e47218147ac0366a12b198269a7015ee580df3fdc93bc684011ee5f9ce030972124be811ab45a05cf36f28c47e33a3a0904ed55871df1acb27dffd1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD5e85b69df3ce8bc2f258f298580aaf7ad
SHA13b8eefd45c0849b3a3d422d3f7688e3fec592e3f
SHA25699f134091a97a7c7ddd90b0896daac544a37550c0c521557282d86ca030970da
SHA5128d16eafe62c7f57f496372401325af669c8f125a932dd3ff18072e6622450f4e0db0f2e443bb9b6eccb9fed8830515f6524d54347bfc5c67e0c0690812c437d9
-
\??\pipe\LOCAL\crashpad_2708_LXSVNTMAFHVRKGCCMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e