Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 20:46
Static task
static1
Behavioral task
behavioral1
Sample
68934a48818a59f4734b9c07f0920d75_JaffaCakes118.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
68934a48818a59f4734b9c07f0920d75_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
68934a48818a59f4734b9c07f0920d75_JaffaCakes118.html
-
Size
139KB
-
MD5
68934a48818a59f4734b9c07f0920d75
-
SHA1
03be76071e7d8f6687919854b23fad34bb187344
-
SHA256
2bd77251dad14c8af5f0d33dc7fa7acf946df1095d33ba2efe8aa23630d4f410
-
SHA512
3c566faf0b29e116ba021cbcb25810c87cecfce5f186dff2a804adca2c2e3e4e1ffcc5a518e62d2fe90ab8cdc23044c72dba5efb13f95ba53669c07041cd2112
-
SSDEEP
3072:SILu40Sbx3yfkMY+BES09JXAnyrZalI+YQ:SItttCsMYod+X3oI+YQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
msedge.exemsedge.exemsedge.exepid process 4324 msedge.exe 4324 msedge.exe 3496 msedge.exe 3496 msedge.exe 2104 msedge.exe 2104 msedge.exe 2104 msedge.exe 2104 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
Processes:
msedge.exepid process 3496 msedge.exe 3496 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe 3496 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3496 wrote to memory of 3448 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 3448 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 2988 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 4324 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 4324 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 1888 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 1888 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 1888 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 1888 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 1888 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 1888 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 1888 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 1888 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 1888 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 1888 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 1888 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 1888 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 1888 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 1888 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 1888 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 1888 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 1888 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 1888 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 1888 3496 msedge.exe msedge.exe PID 3496 wrote to memory of 1888 3496 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\68934a48818a59f4734b9c07f0920d75_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5fea46f8,0x7ffa5fea4708,0x7ffa5fea47182⤵PID:3448
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7278367539403075692,6107222561311311747,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:22⤵PID:2988
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,7278367539403075692,6107222561311311747,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4324 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,7278367539403075692,6107222561311311747,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:82⤵PID:1888
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7278367539403075692,6107222561311311747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:12⤵PID:4036
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,7278367539403075692,6107222561311311747,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:1412
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,7278367539403075692,6107222561311311747,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2104
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2864
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4880
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD52daa93382bba07cbc40af372d30ec576
SHA1c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA2561826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
SHA51265635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
-
Filesize
152B
MD5ecdc2754d7d2ae862272153aa9b9ca6e
SHA1c19bed1c6e1c998b9fa93298639ad7961339147d
SHA256a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
SHA512cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
-
Filesize
5KB
MD50e0bad63d0bf26f3df067aade59c08de
SHA13544314a8f7dbd4a675cdfbaa790e3fd4ea93162
SHA25695a77a2882f333c22b0901a06df3f53bd1f5b6634f84de03f5bfaaa666e47972
SHA51206a82863869972ff14d1a2f0c4ceb58bc3dd4d80d4301f90f9611d18f97042594969e943f1cd40640b03cd270e6d85c2aae40f51367bfbd33e93671312e351d2
-
Filesize
6KB
MD5c9cc93bb191e06766c85a951d271b61d
SHA17137863a5592ef9bffeaa86afd3767efa7ce74a8
SHA25655883d6137f0fe917280a9d97531c91a2960472f8b1b7a42d7159855897d39e7
SHA512c5399ec7a6ff8601bcd6d4d51d24c6db64d669b3907a346e3bebe9dfd36eb44b159d47023983c07f6e522995accc31f83400d0d98c202a0bbd3d7bc686af0587
-
Filesize
11KB
MD591638a2a3ef006571eeb74b16fc4f0e2
SHA12862b7e6db5b60e5a1459eea6c2be4b9d77afae3
SHA2561a1f8ebb92833eeec84588b3b966bb6ad649237b072074f03d19dae071882526
SHA51263c6b4f3e6c3e5dd605274a861c0d34c3961f52f0f143a7f4872f18a072663ce2642aaab07c78978e0d617514befe18ad8107a928e9bcaa79d34e2b7cf1a93b9
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e